feat: Add list variable to override source_ips for LB (#26)

* Use list variable to set source_ips for LB Instead of hardcoding source_ip ranges into the to module, make use of variable. Create a new variable with name `allowed_ips` with the default set to `[0.0.0.0/0]`. This change allows the user to restrict access to external load balancer from only from a small set of ip addresses. * Add strict type constraint on allowed_ips var Restrict `allowed_ips` values to list of strings. Co-authored-by: Amit Kulkarni <[email protected]> Co-authored-by: Morgante Pell <[email protected]>
terraform-google-modules · Apr 7, 2020 · f640695 · f640695
1 parent 616c0df
commit f640695
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/main.tf b/main.tf
@@ -63,7 +63,7 @@ resource "google_compute_firewall" "default-lb-fw" {
     ports    = [var.service_port]
   }
 
-  source_ranges = ["0.0.0.0/0"]
+  source_ranges = var.allowed_ips
 
   target_tags = var.target_tags
 

diff --git a/variables.tf b/variables.tf
@@ -102,3 +102,10 @@ variable "ip_protocol" {
   description = "The IP protocol for the frontend forwarding rule and firewall rule. TCP, UDP, ESP, AH, SCTP or ICMP."
   default     = "TCP"
 }
+
+variable "allowed_ips" {
+  description = "The IP address ranges which can access the load balancer."
+  default     = ["0.0.0.0/0"]
+  type        = list(string)
+
+}