feat: expose egress_enabled to tighten security group egress (#98)

* Add `egress_enabled` variable

* chore: bump stack-config/yaml remote-state to 2.0.0

The aws-account-map repo (cloned by CI for the iam-roles relative-path
module) was recently updated to stack-config/yaml v2, which requires
cloudposse/utils >= 2.0.0. This component still pinned stack-config 1.8.0,
which requires utils < 2.0.0, making the provider graph unsatisfiable.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Add `egress_enabled` variable

* test(fixtures): switch vendored deps to standalone repos with stack-config v2

The vendored account-map came from cloudposse/terraform-aws-components
1.520.0, which uses cloudposse/stack-config/yaml v1.5.0 (constraint
utils >= 1.7.1, != 1.4.0, < 2.0.0). After bumping the component's own
remote-state to stack-config v2 (utils >= 2.0.0), this old account-map
made the resolved utils graph unsatisfiable during atmos deploys.

Switch to the standalone aws-account-map@v1.537.2 (uses stack-config v2)
and bring vpc + dns-delegated up to the versions used by elasticache-redis.
Drop dns-primary; the test suite only depends on vpc and dns-delegated.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(fixtures): bump TestServerless engine to Aurora Postgres 17.9

AWS no longer offers Aurora Postgres 13.21 (the version the fixture was
pinned to), so cluster creation fails with InvalidParameterCombination.
Bump to 17.9, the current latest Aurora Postgres release, and update
cluster_family to aurora-postgresql17 to match.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: aknysh

README.md

@@ -5,7 +5,7 @@
 # https://www.terraform.io/docs/providers/aws/r/rds_cluster.html
 module "aurora_postgres_cluster" {
   source  = "cloudposse/rds-cluster/aws"
-  version = "2.4.0"
+  version = "2.6.0"
 
   cluster_type               = "regional"
   engine                     = var.engine
@@ -29,6 +29,7 @@ module "aurora_postgres_cluster" {
   reader_dns_name                      = local.reader_dns_name
   security_groups                      = local.allowed_security_groups
   intra_security_group_traffic_enabled = var.intra_security_group_traffic_enabled
+  egress_enabled                       = var.egress_enabled
   allowed_cidr_blocks                  = local.allowed_cidr_blocks
   iam_database_authentication_enabled  = var.iam_database_authentication_enabled
   storage_encrypted                    = var.storage_encrypted

src/README.md

@@ -1,6 +1,6 @@
 module "vpc" {
   source  = "cloudposse/stack-config/yaml//modules/remote-state"
-  version = "1.8.0"
+  version = "2.0.0"
 
   component = var.vpc_component_name
 
@@ -9,7 +9,7 @@ module "vpc" {
 
 module "vpc_ingress" {
   source  = "cloudposse/stack-config/yaml//modules/remote-state"
-  version = "1.8.0"
+  version = "2.0.0"
 
   for_each = {
     for i, account in var.allow_ingress_from_vpc_accounts :
@@ -27,18 +27,17 @@ module "vpc_ingress" {
 
 module "eks" {
   source  = "cloudposse/stack-config/yaml//modules/remote-state"
-  version = "1.8.0"
+  version = "2.0.0"
 
   for_each  = local.eks_security_group_enabled ? var.eks_component_names : toset([])
   component = each.value
 
   context = module.cluster.context
 }
 
-
 module "dns_gbl_delegated" {
   source  = "cloudposse/stack-config/yaml//modules/remote-state"
-  version = "1.8.0"
+  version = "2.0.0"
 
   component   = "dns-delegated"
   environment = var.dns_gbl_delegated_environment_name

src/cluster-regional.tf

@@ -388,6 +388,16 @@ variable "intra_security_group_traffic_enabled" {
   description = "Whether to allow traffic between resources inside the database's security group."
 }
 
+variable "egress_enabled" {
+  type        = bool
+  default     = true
+  description = <<-EOT
+    If `true`, the created security group will allow egress on all ports and protocols to all IP addresses.
+    If `false`, no egress rules will be created by this module; egress must be configured via other means
+    (e.g. additional security group rules) or all outbound traffic will be denied.
+    EOT
+}
+
 variable "cluster_parameters" {
   type = list(object({
     apply_method = string

src/remote-state.tf

@@ -1,15 +1,18 @@
 package test
 
 import (
+	"context"
 	"fmt"
 	"strings"
 	"testing"
 
+	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	"github.com/cloudposse/test-helpers/pkg/atmos"
 	helper "github.com/cloudposse/test-helpers/pkg/atmos/component-helper"
 	"github.com/gruntwork-io/terratest/modules/aws"
-	"github.com/stretchr/testify/assert"
 	"github.com/gruntwork-io/terratest/modules/random"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 type ComponentSuite struct {
@@ -31,7 +34,8 @@ func (s *ComponentSuite) TestBasic() {
 		"database_port":       5432,
 		"publicly_accessible": true,
 		"allowed_cidr_blocks": []string{"0.0.0.0/0"},
-		"cluster_name": clusterName,
+		"cluster_name":        clusterName,
+		"egress_enabled":      false,
 	}
 	componentInstance, _ := s.DeployAtmosComponent(s.T(), component, stack, &inputs)
 	assert.NotNil(s.T(), componentInstance)
@@ -63,6 +67,17 @@ func (s *ComponentSuite) TestBasic() {
 	allowedSecurityGroups := atmos.OutputList(s.T(), componentInstance, "allowed_security_groups")
 	assert.Equal(s.T(), 0, len(allowedSecurityGroups))
 
+	securityGroupID := atmos.Output(s.T(), componentInstance, "security_group_id")
+	assert.NotEmpty(s.T(), securityGroupID)
+
+	ec2Client := aws.NewEc2Client(s.T(), awsRegion)
+	sgOut, err := ec2Client.DescribeSecurityGroups(context.Background(), &ec2.DescribeSecurityGroupsInput{
+		GroupIds: []string{securityGroupID},
+	})
+	require.NoError(s.T(), err)
+	require.Len(s.T(), sgOut.SecurityGroups, 1)
+	assert.Empty(s.T(), sgOut.SecurityGroups[0].IpPermissionsEgress, "egress rules should be empty when egress_enabled=false")
+
 	clusterIdentifier := atmos.Output(s.T(), componentInstance, "cluster_identifier")
 
 	configMap := map[string]interface{}{}
@@ -115,7 +130,7 @@ func (s *ComponentSuite) TestServerless() {
 		"database_port":       5432,
 		"publicly_accessible": true,
 		"allowed_cidr_blocks": []string{"0.0.0.0/0"},
-		"cluster_name": clusterName,
+		"cluster_name":        clusterName,
 	}
 	componentInstance, _ := s.DeployAtmosComponent(s.T(), component, stack, &inputs)
 	assert.NotNil(s.T(), componentInstance)

src/variables.tf

@@ -20,8 +20,8 @@ components:
         # Serverless v2 configuration
         engine_mode: provisioned
         instance_type: "db.serverless" # serverless engine_mode ignores `var.instance_type`
-        engine_version: "13.21" # Latest supported version as of 08/28/2023
-        cluster_family: aurora-postgresql13
+        engine_version: "17.9"
+        cluster_family: aurora-postgresql17
         cluster_size: 1
          # serverless
         serverlessv2_scaling_configuration: