创建安全资源

# Security Groups
resource "aws_security_group" "nfs" {
  name_prefix = "${var.namespace}-nfs-"
  vpc_id      = aws_vpc.default.id

  ingress {
    description = "Allow any NFS traffic from private subnets"  # 允许来自私有子网的NFS流量
    cidr_blocks = concat(values(aws_subnet.private)[*].cidr_block, values(aws_subnet.private_ingress)[*].cidr_block)
    from_port   = 2049  # NFS默认端口
    to_port     = 2049
    protocol    = "tcp"
  }

  egress {
    description      = "Allow all outbound traffic"  # 允许所有出站流量
    cidr_blocks      = ["0.0.0.0/0"]  # IPv4任意地址
    ipv6_cidr_blocks = ["::/0"]       # IPv6任意地址
    from_port        = 0
    to_port          = 0
    protocol         = "-1"  # 所有协议
  }
}

resource "aws_security_group" "app" {
  name_prefix = "${var.namespace}-app-"  # 应用安全组名称前缀
  vpc_id      = aws_vpc.default.id

  ingress {
    description = "Allow HTTPS from any IP"  # 允许来自任意IP的HTTPS流量
    cidr_blocks = ["0.0.0.0/0"]
    from_port   = 443  # HTTPS端口
    to_port     = 443
    protocol    = "tcp"
  }

  ingress {
    description = "Allow HTTP from any IP"  # 允许来自任意IP的HTTP流量
    cidr_blocks = ["0.0.0.0/0"]
    from_port   = 80  # HTTP端口
    to_port     = 80
    protocol    = "tcp"
  }

  egress {
    description      = "Allow all outbound traffic"  # 允许所有出站流量
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
    from_port        = 0
    to_port          = 0
    protocol         = "-1"
  }
}

resource "aws_security_group" "db" {
  name_prefix = "${var.namespace}-db-"  # 数据库安全组名称前缀
  vpc_id      = aws_vpc.default.id

  ingress {
    description = "Allow incoming traffic for MySQL"  # 允许MySQL入站流量
    from_port   = 3306  # MySQL默认端口
    to_port     = 3306
    protocol    = "tcp"
    cidr_blocks = concat(values(aws_subnet.private)[*].cidr_block, values(aws_subnet.private_ingress)[*].cidr_block)  # 仅允许来自私有子网的访问
  }

  egress {
    description      = "Allow all outbound traffic"  # 允许所有出站流量
    from_port        = 0
    to_port          = 0
    protocol         = "-1"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }
}

resource "aws_security_group" "any" {
  name_prefix = "${var.namespace}-any-"  # 通用安全组名称前缀
  vpc_id      = aws_vpc.default.id

  ingress {
    description      = "Allow any incoming traffic "  # 允许任意入站流量
    from_port        = 0
    to_port          = 0
    protocol         = -1  # 所有协议
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  egress {
    description      = "Allow all outbound traffic"  # 允许所有出站流量
    from_port        = 0
    to_port          = 0
    protocol         = "-1"
    cidr_blocks      = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }
}

# Create VPC endpoints
resource "aws_vpc_endpoint" "interface" {
  for_each = toset(["ssm", "ssmmessages", "ec2messages", "secretsmanager"])  # 创建4个接口类型的VPC端点

  vpc_id              = aws_vpc.default.id
  service_name        = "com.amazonaws.${data.aws_region.current.name}.${each.key}"  # AWS服务端点名称
  vpc_endpoint_type   = "Interface"  # 接口类型端点
  private_dns_enabled = true         # 启用私有DNS

  subnet_ids         = values(aws_subnet.private_ingress)[*].id  # 部署在私有入口子网
  security_group_ids = [aws_security_group.any.id]              # 使用通用安全组

  tags = {
    Name = "${var.namespace}-endpoint-${each.key}"  # 端点名称标签
  }
}

resource "aws_vpc_endpoint" "gateway" {
  for_each = toset(["s3"])  # 创建S3网关类型端点

  vpc_id       = aws_vpc.default.id
  service_name = "com.amazonaws.${data.aws_region.current.name}.${each.key}"  # S3服务端点名称

  tags = {
    Name = "${var.namespace}-endpoint-${each.key}"  # 端点名称标签
  }
}