Skip to main content

dtcloud_security_group (Resource)

Manages a security group -- the set of firewall rules applied to a machine's network interfaces.

The group is only a name and a description. The rules inside it are separate dtcloud_security_group_rule resources, so adding or removing one rule leaves the group and every other rule untouched.

Example Usage​

resource "dtcloud_security_group" "web" {
  name        = "web-tier"
  description = "HTTPS from anywhere, SSH from the office"
}

# Rules are separate resources, so adding or removing one leaves the group and
# every other rule untouched.
resource "dtcloud_security_group_rule" "https" {
  security_group_id = dtcloud_security_group.web.id
  direction         = "ingress"
  protocol          = "tcp"
  port_range_min    = 443
  port_range_max    = 443
  remote_ip_prefix  = "0.0.0.0/0"
}
note

Reference the group by .id from the machines that use it. That tells Terraform the machine depends on the group, so terraform destroy removes the machine first. A group written as a copied id has no such dependency, and deleting it fails while something still uses it.

Schema​

Required​

  • name (String) Name of the security group. Can be changed in place. Names are not required to be unique.

Optional​

  • description (String) Description of the security group. Can be changed in place, and removing it clears it.
  • timeouts (Block, Optional) (see below for nested schema)

Read-Only​

  • id (String) The ID of this resource.
  • inbound_rule (List of Object) Inbound rules as the platform displays them. Read-only; manage rules with dtcloud_security_group_rule. (see below for nested schema)
  • outbound_rule (List of Object) Outbound rules as the platform displays them. A new group starts with two, added by the platform: allow-all IPv4 and IPv6 egress. (see below for nested schema)

Nested Schema for timeouts​

Optional:

  • create (String)
  • delete (String)
  • update (String)

Nested Schema for inbound_rule​

Read-Only:

  • id (String)
  • port_range (String)
  • protocol (String)
  • source (String)

Nested Schema for outbound_rule​

Read-Only:

  • id (String)
  • port_range (String)
  • protocol (String)
  • source (String)

Behaviour worth knowing​

  • Nothing here forces replacement. Both arguments change in place, and removing description from the configuration clears it. That matters because the platform refuses to delete a group that is still in use, so a rebuild could never complete.
  • inbound_rule and outbound_rule are a display snapshot. The details endpoint reports rules the way the web panel shows them: a protocol display name, the port range as text, and a referenced group by its name rather than its id. None of that can be turned back into a rule, which is why rules are their own resource and are read from a different endpoint. The snapshot is from this resource's last read, so rules created in the same apply appear after the next refresh.
  • A new group is not empty. The platform adds two allow-all egress rules, one for IPv4 and one for IPv6. Terraform does not own them. To remove one, import it as a dtcloud_security_group_rule, then delete that resource from the configuration.
  • A group in use cannot be deleted. The platform's refusal is passed through as it is. Destroy or detach whatever uses the group first.

Timeouts​

create, update and delete each default to 5 minutes. These calls are synchronous, so the timeouts bound a hung request rather than a wait. Override them with a timeouts block:

resource "dtcloud_security_group" "web" {
  # ...

  timeouts {
    create = "10m"
  }
}

Import​

terraform import dtcloud_security_group.web 7f9c1e40-1c3d-4b6a-9a2f-5f1c9d0e3b11

name and description are read back. The rules are not part of the import: each one is its own dtcloud_security_group_rule and is imported separately, the two the platform created included.