frostmoln_security_group_rule (Resource)

Manages a security group rule in the Frostmoln Cloud Platform.

One resource is one rule. The parent frostmoln_security_group manages the group only and has no rules attribute, so the rules a group carries are exactly the frostmoln_security_group_rule resources declared for it — plus whatever else exists on the group, which Terraform neither sees nor removes.

What drift this resource does and does not catch. Read looks this rule up by id in the parent group's rule list, so a rule THIS configuration owns that is deleted out of band is detected on refresh and planned for re-creation. A rule ADDED out of band is invisible: no resource holds its id, nothing looks for it, and it appears in no plan and is removed by no apply. Terraform cannot tell you a group has gained a rule; only listing the group outside Terraform (fm, the portal or the API) can. Bring such a rule under management with terraform import frostmoln_security_group_rule.<name> <security_group_id>/<rule_id>.

Two allow-all egress rules exist on every group before any of these resources are created. Frostmoln adds no default rules to a security group you create, but the underlying network service unconditionally creates one "any protocol to everywhere" egress rule per address family — IPv4 and IPv6 — on every security group, each with an EMPTY remote prefix. Declaring egress rules here does not replace or narrow them: rules are additive, so traffic matching any rule is allowed, and those two keep allowing all outbound traffic until they are deleted. They are unmanaged by Terraform, so removing them is a deliberate act — either delete them outside Terraform, or import them ONLY IN ORDER TO DESTROY THEM, and remove the block from configuration again once the destroy has run. Leaving the block in place makes the next apply try to RE-CREATE the rule, and the platform refuses a rule with no remote (remote_cidr and remote_group_id both unset). This resource also has no ether_type attribute, so the IPv4 and IPv6 defaults are indistinguishable in configuration — only one of the two could ever be expressed.

Every attribute forces replacement: rules are immutable, and a change destroys and re-creates the rule rather than updating it.

Example Usage

resource "frostmoln_security_group_rule" "https_ingress" {
  security_group_id = frostmoln_security_group.web.id
  direction         = "ingress"
  protocol          = "tcp"
  port_range_min    = 443
  port_range_max    = 443
  remote_cidr       = "0.0.0.0/0"
  description       = "Allow HTTPS from anywhere"
}

resource "frostmoln_security_group_rule" "ssh_ingress" {
  security_group_id = frostmoln_security_group.web.id
  direction         = "ingress"
  protocol          = "tcp"
  port_range_min    = 22
  port_range_max    = 22
  remote_cidr       = "10.0.0.0/8"
  description       = "Allow SSH from internal network"
}

Schema

Required

• direction (String) The direction of the rule: ingress or egress.
• protocol (String) The protocol: tcp, udp, icmp, or any.
• security_group_id (String) The ID of the security group this rule belongs to.

Optional

• description (String) A description of the rule.
• port_range_max (Number) The maximum port number.
• port_range_min (Number) The minimum port number.
• remote_cidr (String) The remote CIDR block.
• remote_group_id (String) The remote security group ID.

Read-Only

• id (String) The unique identifier of the rule.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# Import a security group rule by {security_group_id}/{rule_id}.
terraform import frostmoln_security_group_rule.web_https "sg-abc123/sgr-def456"

# This is how a rule Terraform does not already own is brought under management —
# one added through the portal, the fm CLI or the API, or one of the two allow-all
# egress rules (IPv4 + IPv6) that exist on every security group from the moment it
# is created. Terraform reports no drift for such a rule and removes none of them,
# so list the group outside Terraform (fm, the portal or the API return its full
# rule set) to find the rule ids to import.