{% set config = merged_configs.get('aws_security_group', {}) %}
{% set comments = compliance_comments.get('aws_security_group', []) %}
# ------------------------------------------------------------------------------
# Security Group
# ------------------------------------------------------------------------------
{% for comment in comments %}
# {{ comment }}
{% endfor %}

resource "aws_security_group" "this" {
  name        = "{{ config.get('name', project_id ~ '-sg') }}"
  description = "{{ config.get('description', 'Managed by ComplyForm') }}"
  vpc_id      = aws_vpc.this.id

  {% if config.get('ingress_rules') %}
  {% for rule in config.ingress_rules %}
  ingress {
    description = "{{ rule.get('description', '') }}"
    from_port   = {{ rule.get('from_port', 443) }}
    to_port     = {{ rule.get('to_port', 443) }}
    protocol    = "{{ rule.get('protocol', 'tcp') }}"
    cidr_blocks = {{ rule.get('cidr_blocks', '[]') }}
  }
  {% endfor %}
  {% endif %}

  egress {
    description = "{{ config.get('egress_description', 'Allow HTTPS outbound') }}"
    from_port   = {{ config.get('egress_from_port', 443) }}
    to_port     = {{ config.get('egress_to_port', 443) }}
    protocol    = "{{ config.get('egress_protocol', 'tcp') }}"
    cidr_blocks = {{ config.get('egress_cidr_blocks', '["0.0.0.0/0"]') }}
  }

  tags = {
    Name      = "{{ config.get('name', project_id ~ '-sg') }}"
    ManagedBy = "complyform"
  }
}
