frostmoln_security_group_rule (Resource)

Manages a security group rule in the Frostmoln Cloud Platform.

One resource is one rule. The parent frostmoln_security_group manages the group only and has no rules attribute, so the rules a group carries are exactly the frostmoln_security_group_rule resources declared for it — plus whatever else exists on the group, which Terraform neither sees nor removes.

What drift this resource does and does not catch. Read looks this rule up by id in the parent group's rule list, so a rule THIS configuration owns that is deleted out of band is detected on refresh and planned for re-creation. A rule ADDED out of band is invisible: no resource holds its id, nothing looks for it, and it appears in no plan and is removed by no apply. Terraform cannot tell you a group has gained a rule; only listing the group outside Terraform (fm, the portal or the API) can. Bring such a rule under management with terraform import frostmoln_security_group_rule.<name> <security_group_id>/<rule_id>.

Two allow-all egress rules exist on every group before any of these resources are created. Frostmoln adds no default rules to a security group you create, but the underlying network service unconditionally creates one "any protocol to everywhere" egress rule per address family — IPv4 and IPv6 — on every security group, each with an EMPTY remote prefix. Declaring egress rules here does not replace or narrow them: rules are additive, so traffic matching any rule is allowed, and those two keep allowing all outbound traffic until they are deleted. They are unmanaged by Terraform, so removing them is a deliberate act — either delete them outside Terraform, or import them ONLY IN ORDER TO DESTROY THEM, and remove the block from configuration again once the destroy has run. Leaving the block in place makes the next apply try to RE-CREATE the rule, and the platform refuses a rule with no remote (remote_cidr and remote_group_id both unset). This resource also has no ether_type attribute, so the IPv4 and IPv6 defaults are indistinguishable in configuration — only one of the two could ever be expressed.

Every attribute forces replacement: rules are immutable, and a change destroys and re-creates the rule rather than updating it.

A rule on a security group Frostmoln provisioned for a managed service cannot be managed here. The parent groups for a managed database, cache, webserver, messaging instance, Kubernetes cluster or Application Gateway are visible in your account, so their rules can be declared — but creating or deleting a rule on one is refused with 409 / resource_in_use, permanently, and no attribute predicts it. Every attribute here forces replacement, so any change to a declared rule is a destroy-and-create and fails on both halves. The apply keeps failing until the block is removed (and terraform state rm used for anything already imported). Point these resources only at groups you created.

Authoritative scope — who owns what on this resource, declared in internal/scopedecl and machine-checked against the schema.

Create-immutable — description, direction, port_range_max, port_range_min, protocol, remote_cidr, remote_group_id, security_group_id: a rule has no in-place update — the platform registers POST and DELETE and nothing else — so a change destroys and re-creates it.

Example Usage

resource "frostmoln_security_group_rule" "https_ingress" {
  security_group_id = frostmoln_security_group.web.id
  direction         = "ingress"
  protocol          = "tcp"
  port_range_min    = 443
  port_range_max    = 443
  remote_cidr       = "0.0.0.0/0"
  description       = "Allow HTTPS from anywhere"
}

resource "frostmoln_security_group_rule" "ssh_ingress" {
  security_group_id = frostmoln_security_group.web.id
  direction         = "ingress"
  protocol          = "tcp"
  port_range_min    = 22
  port_range_max    = 22
  remote_cidr       = "10.0.0.0/8"
  description       = "Allow SSH from internal network"
}

Schema

Required

• direction (String) The direction of the rule: ingress or egress.
• protocol (String) The protocol: tcp, udp, icmp, or any.
• security_group_id (String) The ID of the security group this rule belongs to.

Optional

• description (String) A description of the rule.
• port_range_max (Number) The maximum port number.
• port_range_min (Number) The minimum port number.
• remote_cidr (String) The remote CIDR block.
• remote_group_id (String) The remote security group ID.
• timeouts (Block, Optional) (see below for nested schema)

Read-Only

• id (String) The unique identifier of the rule.

Nested Schema for timeouts

Optional:

• create (String) How long the provider waits for the create operation to converge before giving up (e.g. "45m", "2h").
• delete (String) How long the provider waits for the delete to complete before giving up (e.g. "30m").
• update (String) How long the provider waits for an update (resize, in-place change) to converge before giving up (e.g. "30m").

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# Import a security group rule by {security_group_id}/{rule_id}.
terraform import frostmoln_security_group_rule.web_https "sg-abc123/sgr-def456"

# This is how a rule Terraform does not already own is brought under management —
# one added through the portal, the fm CLI or the API, or one of the two allow-all
# egress rules (IPv4 + IPv6) that exist on every security group from the moment it
# is created. Terraform reports no drift for such a rule and removes none of them,
# so list the group outside Terraform (fm, the portal or the API return its full
# rule set) to find the rule ids to import.