Use security groups modules. Get: One of ['cidr_blocks', 'ipv6_cidr_blocks', 'self', 'source_security_group_id', 'prefix_list_ids'] must be set to create an AWS Security Group Rule about terraform-aws-security-group HOT 6 CLOSED

In fact, those arguments are marked as optional because they can be defined in a variety of combinations so that at least one is required.

ingress_cidr_blocks, ingress_with_cidr_blocks, ingress_with_source_security_group_id - these are typically the options you need to choose from. See complete example for all possible values.

from terraform-aws-security-group.

Glad that you like these modules.

The error you are receiving is because you are creating named security group, which means it open some ports and it requires explicit specification of CIDR blocks (or other properties as listed in the error) to be associated with those ports. Normally you specify CIDR blocks like this:

module "web_security_group" {
  source = "terraform-aws-modules/security-group/aws//modules/web"
  name   = "web_security_group"
  vpc_id = "${module.vpc.vpc_id}"

  ingress_cidr_blocks = ["0.0.0.0/0"]
}

from terraform-aws-security-group.

@antonbabenko Thanks for your explanation, but there are things I am not quite clear.

I try to create this sg according to its documentation.

Since name is a required variable, I definitely need to create a named security group for using this web module, right? However, the documents says, ingress_cidr_blocks is not a required variable. Should I use them together? Is there a way to create a named sg without specifying the ingress_cidr_blocks?

Or do I just misunderstood something? I guess I should add ingress_cidr_blocks anyway, because, for example, psql sg, I definitely want its ingress_cidr_blocks in my private subnet, right?

from terraform-aws-security-group.

I solve the issue and understand the idea of your module.
Really appreciate your help.

from terraform-aws-security-group.

In case you'd like to create a security group without specifying a CIDR range, add

ingress_with_self = [
    {
      rule = "all-all"
    },
]

under the security-group module.

Note that you might want to change the rule in case you want to be more limit about the access

from terraform-aws-security-group.

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

from terraform-aws-security-group.