iac-sei/nsg-sei-servers-nsg.tf

resource "oci_core_network_security_group" "sei-servers-nsg" {
  compartment_id = var.ocid_compartment_networking
  display_name = "sei-servers-nsg"
  vcn_id = var.ocid_vcn_3_tier
}
#--------------------------------------------------------------------------------------------------------------------------------------------
resource "oci_core_network_security_group_security_rule" "sei_servers_security_ingress_rule_01" {
  network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
  description =  "Ingress HTTP from Load Balancer."
  source =  var.cidr_subnet_web
  source_type =  "CIDR_BLOCK"
  direction =  "INGRESS"
  protocol =  "6"
  tcp_options  {
    destination_port_range  {
      max =  80
      min =  80
    }
  }
}

resource "oci_core_network_security_group_security_rule" "sei_servers_security_ingress_rule_02" {
  network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
  description =  "Ingress HTTPS from Load Balancer."
  source =  var.cidr_subnet_web
  source_type =  "CIDR_BLOCK"
  direction =  "INGRESS"
  protocol =  "6"
  tcp_options  {
    destination_port_range  {
      max =  443
      min =  443
    }
  }
}

resource "oci_core_network_security_group_security_rule" "sei_servers_security_ingress_rule_03" {
  network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
  description =  "Ingress SOLR from Load Balancer."
  source =  var.cidr_subnet_web
  source_type =  "CIDR_BLOCK"
  direction =  "INGRESS"
  protocol =  "6"
  tcp_options  {
    destination_port_range  {
      max =  8983
      min =  8983
    }
  }
}

#--------------------------------------------------------------------------------------------------------------------------------------------
resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_01" {
  network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
  description =  "Egress to Internet port TCP/80"
  destination =  var.cidr_anywhere
  destination_type =  "CIDR_BLOCK"
  direction =  "EGRESS"
  protocol =  "6"
  tcp_options  {
    destination_port_range  {
      max =  80
      min =  80
    }
  }
}

resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_02" {
  network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
  description =  "Egress to OSN port TCP/443"
  destination =  lookup(data.oci_core_services.all_services.services[1], "cidr_block")
  destination_type =  "SERVICE_CIDR_BLOCK"
  direction =  "EGRESS"
  protocol =  "6"
  tcp_options  {
    destination_port_range  {
      max =  443
      min =  443
    }
  }
}

resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_03" {
  network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
  description =  "Egress to Internet port TCP/443"
  destination =  var.cidr_anywhere
  destination_type =  "CIDR_BLOCK"
  direction =  "EGRESS"
  protocol =  "6"
  tcp_options  {
    destination_port_range  {
      max =  443
      min =  443
    }
  }
}

resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_04" {
  network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
  description =  "Egress MySQL to sn-database"
  destination =  var.cidr_subnet_database
  destination_type =  "CIDR_BLOCK"
  direction =  "EGRESS"
  protocol =  "6"
  tcp_options  {
    destination_port_range  {
      max =  3306
      min =  3306
    }
  }
}

resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_05" {
  network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
  description =  "Egress Jod to sn-app"
  destination =  var.cidr_subnet_app
  destination_type =  "CIDR_BLOCK"
  direction =  "EGRESS"
  protocol =  "6"
  tcp_options  {
    destination_port_range  {
      max =  8080
      min =  8080
    }
  }
}

resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_06" {
  network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
  description =  "Egress Memcached to sn-app"
  destination =  var.cidr_subnet_app
  destination_type =  "CIDR_BLOCK"
  direction =  "EGRESS"
  protocol =  "6"
  tcp_options  {
    destination_port_range  {
      max =  11211
      min =  11211
    }
  }
}

resource "oci_core_network_security_group_security_rule" "sei_servers_security_egress_rule_07" {
  network_security_group_id = oci_core_network_security_group.sei-servers-nsg.id
  description =  "Egress MySQL Heatware to sn-database"
  destination =  var.cidr_subnet_database
  destination_type =  "CIDR_BLOCK"
  direction =  "EGRESS"
  protocol =  "6"
  tcp_options  {
    destination_port_range  {
      max =  33060
      min =  33060
    }
  }
}
#--------------------------------------------------------------------------------------------------------------------------------------------