frostmoln_security_group (Resource)

Manages a security group in the Frostmoln Cloud Platform.

This resource manages the GROUP ONLY, never its rules. Rules are separate frostmoln_security_group_rule resources — the same shape the AWS provider uses. Nothing in this resource describes the rules the group carries: there is no rules attribute and Read does not fetch any, so a terraform plan on this resource NEVER reports rule drift, whatever the group's rules have become.

A rule added out of band is invisible to Terraform. A rule created through the portal, the fm CLI or the API — by a colleague, a script, or an incident fix — appears in no plan, is never flagged, and is never removed by terraform apply or terraform destroy. The reverse case IS caught: a frostmoln_security_group_rule this configuration owns that is deleted out of band is detected on refresh and planned for re-creation. Reconciling added rules means listing the group outside Terraform — fm, the portal and the API all return its full rule set — and then importing each rule that should be managed with terraform import frostmoln_security_group_rule.<name> <security_group_id>/<rule_id>.

Every new security group starts with two allow-all egress rules that Terraform does not manage. Frostmoln adds no default rules of its own to a group created here, but the underlying network service unconditionally creates one "any protocol to everywhere" egress rule per address family — IPv4 and IPv6 — on every security group, each carrying an EMPTY remote prefix. They are live and permissive from the moment the group exists, they are returned by the API (so fm, the portal and the API all show them), and this provider does not manage them: they appear in no plan and survive a terraform destroy of every rule this configuration declares. Adding egress rules of your own does not narrow them either — security group rules are additive, so traffic matching any rule is allowed. A group that must not egress freely has to have those two rules removed deliberately: either delete them outside Terraform, or import each as a frostmoln_security_group_rule ONLY IN ORDER TO DESTROY IT, and remove the block from configuration again once the destroy has run. Leaving the block in place makes the next apply try to RE-CREATE the rule, and the platform refuses a rule with no remote. frostmoln_security_group_rule also has no ether_type attribute, so the IPv4 and IPv6 defaults are indistinguishable in configuration — only one of the two could ever be expressed.

Example Usage

resource "frostmoln_security_group" "web" {
  name        = "web-sg"
  description = "Security group for web servers"
  vpc_id      = frostmoln_vpc.example.id

  tags = {
    tier = "web"
  }
}

Schema

Required

• name (String) The name of the security group.

Optional

• description (String) A description of the security group.
• tags (Map of String) Tags for the security group.
• vpc_id (String) The ID of the VPC this security group belongs to.

Read-Only

• created_at (String) The creation timestamp.
• id (String) The unique identifier of the security group.
• is_default (Boolean) Whether this is the default security group.