Chapter 40: Terraform Real AWS Labs VPC EC2 nginx S3 and IAM Role

40.2 Lab part 2 — security group for the web server

By Ravindra Bagale · Last updated: 25 October 2026

In short: Security groups are the instance firewall, and the safest SSH rule is none at all: use Session Manager through the IAM role in part 4.

Story. An Infosys client penetration test flagged a lab server with SSH open to the whole internet. Security groups are the instance firewall, and the safest SSH rule is none at all: use Session Manager through the IAM role in part 4. This group allows HTTP from anywhere and all outbound traffic, and nothing else.

resource "aws_security_group" "web" {
  name        = "badge-lab-web"
  description = "HTTP in, all out"
  vpc_id      = aws_vpc.lab.id
}

resource "aws_vpc_security_group_ingress_rule" "http" {
  security_group_id = aws_security_group.web.id
  cidr_ipv4         = "0.0.0.0/0"
  ip_protocol       = "tcp"
  from_port         = 80
  to_port           = 80
}

resource "aws_vpc_security_group_egress_rule" "all" {
  security_group_id = aws_security_group.web.id
  cidr_ipv4         = "0.0.0.0/0"
  ip_protocol       = "-1"
}

What each line does

• resource "aws_security_group" "web" { — The group itself, in the lab VPC.
• vpc_id = aws_vpc.lab.id — Ties it to part 1's VPC.
• resource "aws_vpc_security_group_ingress_rule" "http" { — One inbound rule as its own resource, the current recommended style.
• cidr_ipv4 = "0.0.0.0/0" — From any IPv4 address.
• ip_protocol = "tcp" — TCP traffic.
• from_port = 80 / to_port = 80 — Only port 80.
• resource "aws_vpc_security_group_egress_rule" "all" { — One outbound rule.
• ip_protocol = "-1" — All protocols and ports outbound, so dnf can download nginx.

When it is green.

Plan: 3 to add, 0 to change, 0 to destroy.

When it is red.

Error: creating Security Group (badge-lab-web): InvalidVpcID.NotFound

Fix. The VPC id is wrong or in another region. Reference aws_vpc.lab.id rather than pasting an id.

What: every term in plain English

• security group — A firewall attached to a network interface. It allows traffic; anything not allowed is dropped.
• ingress — Traffic coming into the server.
• egress — Traffic leaving the server.
• stateful — A reply to allowed traffic is allowed back out automatically.
• aws_vpc_security_group_ingress_rule — The current resource for one inbound rule. One rule per resource is easier to change safely.
• cidr_ipv4 — The source address range of a rule, such as 0.0.0.0/0 for everyone.
• referenced security group — A rule that allows traffic from another group instead of an address range.

Example 1: Read the open ports with the CLI

During an audit at a Kotak vendor, the auditor asked "which ports are open to the world?". Answer with one command, not by clicking around.

1. Apply part 2.
2. Describe the group rules.
3. Check that only port 80 is open.

terraform apply -auto-approve
SG=$(terraform output -raw web_sg_id 2>/dev/null || terraform state show aws_security_group.web | awk '/^ *id /{print $3}' | tr -d '"')
aws ec2 describe-security-group-rules --filters Name=group-id,Values=$SG \
  --query "SecurityGroupRules[].[IsEgress,IpProtocol,FromPort,ToPort,CidrIpv4]" --output table

Output

----------------------------------------------
|         DescribeSecurityGroupRules         |
+--------+-------+------+------+-------------+
|  False |  tcp  |  80  |  80  |  0.0.0.0/0  |
|  True  |  -1   |  -1  |  -1  |  0.0.0.0/0  |
+--------+-------+------+------+-------------+

What it shows: One inbound rule for HTTP and one outbound rule for everything. No port 22, so nobody can try SSH.

Example 2: Add HTTPS as a separate rule

When a Zomato team added TLS, they added a new rule resource. The old HTTP rule was not touched, so there was no gap in traffic.

1. Add a new ingress rule resource for 443.
2. Plan and read that only one resource is added.
3. Apply.

resource "aws_vpc_security_group_ingress_rule" "https" {
  security_group_id = aws_security_group.web.id
  description       = "HTTPS from anywhere"
  cidr_ipv4         = "0.0.0.0/0"
  ip_protocol       = "tcp"
  from_port         = 443
  to_port           = 443
}

terraform plan | tail -1

Output

Plan: 1 to add, 0 to change, 0 to destroy.

What it shows: Inline rule blocks would rewrite the whole group. Separate rule resources change one rule at a time.

Example 3: Allow a database only from the web group

At Ola, the database security group never lists IP addresses. It trusts the web servers' group, so new servers work without a change.

1. Create a db group.
2. Add an ingress rule that references the web group.
3. Plan.

resource "aws_security_group" "db" {
  name   = "badge-lab-db"
  vpc_id = aws_vpc.lab.id
}

resource "aws_vpc_security_group_ingress_rule" "db_from_web" {
  security_group_id            = aws_security_group.db.id
  referenced_security_group_id = aws_security_group.web.id
  ip_protocol                  = "tcp"
  from_port                    = 5432
  to_port                      = 5432
}

terraform plan | grep -E "referenced|from_port|Plan"

Output

      + from_port                    = 5432
      + referenced_security_group_id = (known after apply)
Plan: 2 to add, 0 to change, 0 to destroy.

What it shows: Any server with the web group can reach port 5432. Nothing else can, not even other servers in the VPC.

Example 4: Test the firewall from outside

Do not just trust the console. Test from your laptop: port 80 should connect once nginx runs, port 22 should time out.

1. After part 3, take the public IP.
2. Test port 80 and port 22 with nc.

IP=$(terraform state show aws_instance.web | awk '/^ *public_ip /{print $3}' | tr -d '"')
nc -vz -w 5 $IP 80
nc -vz -w 5 $IP 22

Output

Connection to 203.0.113.25 port 80 [tcp/http] succeeded!
nc: connect to 203.0.113.25 port 22 (tcp) timed out: Operation now in progress

What it shows: A timeout means the security group dropped the packet. A refused message would mean the port was open but nothing listened.

Command cheat sheet

Verify: did it work?

1. No SSH rule

   aws ec2 describe-security-group-rules --filters Name=group-id,Values=$SG --query "SecurityGroupRules[?FromPort==`22`]" --output text
   

   Output

2. HTTP rule present

   aws ec2 describe-security-group-rules --filters Name=group-id,Values=$SG --query "SecurityGroupRules[?FromPort==`80`].CidrIpv4" --output text
   

   Output

   0.0.0.0/0
   

When it is red 1

Error: InvalidPermission.Duplicate: the specified rule already exists

Cause. The same rule is defined inline and as a separate resource, or twice.

Fix, step by step

1. Search the code for port 80.
2. Keep only one definition.
3. Plan again.

When it is red 2

curl: (28) Connection timed out after 5000 milliseconds

Cause. Port 80 is not allowed, or the subnet has no internet route.

Fix, step by step

1. Check the ingress rule.
2. Check the route table from part 1.
3. Check the instance has a public IP.

When it is red 3

Error: DependencyViolation: resource sg-0abc has a dependent object (on destroy)

Cause. An ENI or another group still uses this group.

Fix, step by step

1. Run destroy for the whole lab, not one group.
2. If a hand-made ENI exists, remove it in the console.
3. Run destroy again.

Cleanup

terraform destroy -auto-approve

Practice tasks

Homework: try at home

Recap

• Security groups allow traffic; everything else is dropped.
• They are stateful, so replies flow back.
• One rule per resource changes safely.
• Reference groups instead of IPs for internal traffic.
• No SSH: use Session Manager.

FAQ

Do I need an egress rule?

A group made by Terraform has no egress by default, so the lab adds one to allow updates.

Can I block one IP with a security group?

No, groups only allow. Use a network ACL or WAF to deny.

Why description on every rule?

Auditors and teammates see why a port is open.

Does changing a rule restart the server?

No. Rules change live.

How many groups can an instance have?

Up to five per interface by default.

Interview questions

1. Security group versus network ACL?

   Groups are stateful and allow only; ACLs are stateless, ordered and can deny.

2. Why separate rule resources?

   Each rule changes alone, without rewriting the group.

3. How do you allow app to database traffic?

   Ingress on the db group referencing the app group on the db port.

4. How do you give shell access without SSH?

   Session Manager with the SSM policy on the instance role.

5. Timeout versus refused?

   Timeout means dropped by a firewall; refused means reachable but nothing listening.

Samajla ka?

Ravi Sir's Cards for this lesson

Revision cardInterview card

मराठी cards