locals {
  cidr_blocks = concat(data.terraform_remote_state.mop_core.outputs.vpc_subnets_private_cidr_blocks, formatlist("%s/32", [data.terraform_remote_state.mop_core.outputs.bastion_ip]))
}

resource "aws_security_group" "customer_management_service_mysql" {
    name = "${local.workspace["service_name"]}-mysql"
    description = "Security Group ${local.workspace["service_name"]}-mysql"
    vpc_id = data.terraform_remote_state.mop_core.outputs.vpc_id
    tags = {
        Name = "${local.workspace["service_name"]}-mysql"
    }

    // NOTE: I am pretty sure
    // allows traffic from the SG itself for tcp
  ingress {
    from_port = 0
    to_port = 65535
    protocol = "tcp"
    self = true
  }

    // allows traffic from the SG itself for udp
  ingress {
    from_port = 0
    to_port = 65535
    protocol = "udp"
    self = true
  }

  // allows traffic from the legacy SG
  ingress {
    from_port = 0
    to_port = 65535
    protocol = "tcp"
    security_groups = [data.terraform_remote_state.mop_core.outputs.sg_mysql_id]
  }

  ingress {
    from_port = 0
    to_port = 65535
    protocol = "udp"
    security_groups = [data.terraform_remote_state.mop_core.outputs.sg_mysql_id]
  }


  // allow traffic for TCP 22
  ingress {
    from_port = 22
    to_port = 22
    protocol = "tcp"
    cidr_blocks = local.cidr_blocks
  }

  // allow traffic for TCP 3306
  ingress {
    from_port = 3306
    to_port = 3306
    protocol = "tcp"
    cidr_blocks = local.cidr_blocks
  }

  egress {
    from_port       = 0
    to_port         = 0
    protocol        = "-1"
    cidr_blocks     = ["0.0.0.0/0"]
  }
}