From d3d30131b8cbd188186bc7bb7d398460f41bcab7 Mon Sep 17 00:00:00 2001
From: guybarak <guybarak@checkpoint.com>
Date: Wed, 24 Dec 2025 16:01:26 +0000
Subject: [PATCH] fix(VSECPC-12470): Adding support for security_groups in
 autoscale_gwlb module

---
 modules/autoscale_gwlb/main.tf | 50 ++++++++++++++++++++++++++--------
 1 file changed, 39 insertions(+), 11 deletions(-)

diff --git a/modules/autoscale_gwlb/main.tf b/modules/autoscale_gwlb/main.tf
index 0bdf1c9..2a9e909 100755
--- a/modules/autoscale_gwlb/main.tf
+++ b/modules/autoscale_gwlb/main.tf
@@ -8,22 +8,50 @@ resource "aws_security_group" "permissive_sg" {
   name_prefix = format("%s_PermissiveSecurityGroup", local.asg_name)
   description = "Permissive security group"
   vpc_id = var.vpc_id
-  tags = {
-    Name = format("%s_PermissiveSecurityGroup", local.asg_name)
+
+  dynamic "ingress" {
+    for_each = [for rule in var.security_rules : rule if rule.direction == "ingress"]
+    content {
+      from_port   = ingress.value.from_port
+      to_port     = ingress.value.to_port
+      protocol    = ingress.value.protocol
+      cidr_blocks = ingress.value.cidr_blocks
     }
-  }  
+  }
 
-resource "aws_vpc_security_group_ingress_rule" "ingress_rule_ipv4" {
-  security_group_id = aws_security_group.permissive_sg.id
-  cidr_ipv4         = "0.0.0.0/0"
-  ip_protocol       = "-1"
+  dynamic ingress {
+    for_each = length([for rule in var.security_rules : rule if rule.direction == "ingress"]) == 0 ? [1] : []
+    content{
+        from_port    = 0
+        to_port      = 0
+        protocol     = "-1"
+        cidr_blocks  = ["0.0.0.0/0"]
     }
+  }
 
-resource "aws_vpc_security_group_egress_rule" "egress_rule_ipv4" {
-  security_group_id = aws_security_group.permissive_sg.id
-  cidr_ipv4         = "0.0.0.0/0"
-  ip_protocol       = "-1"
+  dynamic "egress" {
+    for_each = [for rule in var.security_rules : rule if rule.direction == "egress"]
+    content {
+      from_port   = egress.value.from_port
+      to_port     = egress.value.to_port
+      protocol    = egress.value.protocol
+      cidr_blocks = egress.value.cidr_blocks
+    }
+  }
+
+  dynamic egress {
+    for_each = length([for rule in var.security_rules : rule if rule.direction == "egress"]) == 0 ? [1] : []
+    content{
+        from_port    = 0
+        to_port      = 0
+        protocol     = "-1"
+        cidr_blocks  = ["0.0.0.0/0"]
+    }
   }
+  tags = {
+    Name = format("%s_PermissiveSecurityGroup", local.asg_name)
+  }
+}
 
 resource "aws_vpc_security_group_ingress_rule" "ingress_rule_ipv6" {
   count = var.enable_ipv6 ? 1 : 0