OpenStack Security Group

This Terraform module creates and configures an OpenStack Security Group with either common predefined or custom-defined set of rules. It is designed to be reusable, flexible, and aligned with Terraform best practices for OpenStack deployments.

Features

• Creates an OpenStack Security Group with customizable name and description.
• Attaches an arbitrary number of rules from:

  • one of the predefined security groups

    OR

  • custom-defined rules, to said security group

Authentication

Before proceeding, if you lack OpenStack Application Credentials or do not know how to make them available in your local environment, make sure to check out the EWC documentation.

Usage

⚠️ Set exactly one of security_group_rules or predefined_security_group.

The module creates either one of the predefined EWC security groups, by name, or a custom security group, from your own list of rules.

Choose a predefined security group

💡 For a full list of available options, see the Predefined Security Groups section below.

✅ The security group is named after the predefined group (ipa in the example below), unless you also set security_group_name.

module "ipa_security_group" {
  source = "github.com/ewcloud/ewc-tf-module-openstack-security-group?ref=1.1.0"

  predefined_security_group = "ipa"
  federee                   = "ECMWF" # Defaults to EUMETSAT if not set

  tags = {
    environment       = "production"
    project           = "ewc"
    provisioning-tool = "terraform"
  }
}

OR

Define a custom security group

module "postgres_security_group" {
  source = "github.com/ewcloud/ewc-tf-module-openstack-security-group?ref=1.1.0"

  security_group_name        = "postgres"
  security_group_description = "PostgreSQL from the private subnet"

  security_group_rules = [
    {
      direction        = "ingress"
      ether_type       = "IPv4"
      protocol         = "tcp"
      port_range_min   = 5432
      port_range_max   = 5432
      remote_ip_prefix = "10.0.0.0/24"
    },
    {
      direction        = "ingress"
      ether_type       = "IPv4"
      protocol         = "tcp"
      port_range_min   = 22
      port_range_max   = 22
      remote_ip_prefix = "0.0.0.0/0"
    }
  ]

  tags = {
    environment       = "production"
    project           = "ewc"
    provisioning-tool = "terraform"
  }
}

Inputs

Predefined Security Groups

Custom Security Group Rules Input Structure

Each rule in the security_group_rules list is an object with the following attributes:

• direction: The direction of the rule (ingress or egress).
• ether_type: The ether type (IPv4 or IPv6).
• protocol: The protocol (e.g., tcp, udp, icmp, or null for any).
• port_range_min: The minimum port number (1-65535, or null for protocols like icmp).
• port_range_max: The maximum port number (1-65535, or null for protocols like icmp).
• remote_ip_prefix: The remote IP prefix in CIDR notation (e.g., 10.0.0.0/24).

Outputs

Best Practices

Resource Tagging

This module supports tagging of the security group using the tags variable. Tags are applied as a list of strings to the openstack_networking_secgroup_v2 resource.

Example:

tags = {
  environment       = "production"
  project           = "ewc"
  provisioning-tool = "terraform"
}

The above results in the security group being tagged with environment=production, project=ewc and provisioning-tool=terraform.

SW Bill of Materials (SBoM)

Third-party components used in the working environment.

The following components will be included in the working environment:

Changelog

All notable changes (i.e. fixes, features and breaking changes) are documented in the CHANGELOG.md.

Contributing

Thanks for taking the time to join our community and start contributing! Please make sure to:

• Familiarize yourself with our Code of Conduct before contributing.
• See CONTRIBUTING.md for instructions on how to request or submit changes.

Copyright and License

Copyright © EUMETSAT 2025.

The provided code and instructions are licensed under the MIT license. They are intended to automate the setup of an environment that includes third-party software components. The usage and distribution terms of the resulting environment are subject to the individual licenses of those third-party libraries.

Users are responsible for reviewing and complying with the licenses of all third-party components included in the environment.

Contact EUMETSAT for details on the usage and distribution terms.

Authors

European Weather Cloud <support@europeanweather.cloud>