Merge pull request #10 from clouddrove/issue_25

Issue 25

Author: Nikita Dugar

_example/variables.tf

@@ -129,7 +129,9 @@ resource "aws_ec2_client_vpn_endpoint" "default" {
   description            = module.labels.id
   server_certificate_arn = join("", aws_acm_certificate.server.*.arn)
   client_cidr_block      = var.cidr_block
+  security_group_ids     = var.security_group_ids
   split_tunnel           = var.split_tunnel_enable
+  vpc_id                 = var.vpc_id
 
   authentication_options {
     type                            = var.type
@@ -145,6 +147,12 @@ resource "aws_ec2_client_vpn_endpoint" "default" {
   }
 
   tags = module.labels.tags
+  lifecycle {
+    ignore_changes = [
+      authentication_options
+    ]
+  }
+
 }
 
 resource "aws_ec2_client_vpn_network_association" "default" {
@@ -173,6 +181,15 @@ resource "aws_ec2_client_vpn_authorization_rule" "vpn_auth" {
   authorize_all_groups   = true
 }
 
+
+resource "aws_ec2_client_vpn_authorization_rule" "vpn_group_auth" {
+  count                  = length(var.group_ids)
+  client_vpn_endpoint_id = join("", aws_ec2_client_vpn_endpoint.default.*.id)
+  target_network_cidr    = "0.0.0.0/0"
+  access_group_id        = element(var.group_ids, count.index)
+}
+
+
 resource "aws_ec2_client_vpn_route" "vpn_route" {
   count                  = length(var.route_cidr)
   client_vpn_endpoint_id = join("", aws_ec2_client_vpn_endpoint.default.*.id)

main.tf

@@ -119,3 +119,21 @@ variable "self_saml_arn" {
   description = "The ARN of the IAM SAML identity provider for the self service portal. "
 }
 
+
+variable "security_group_ids" {
+  type    = list(any)
+  default = []
+  description = "The IDs of one or more security groups to apply to the target network. You must also specify the ID of the VPC that contains the security groups."
+}
+
+variable "vpc_id" {
+  type        = string
+  default     = ""
+  description = "The ID of the VPC to associate with the Client VPN endpoint. If no security group IDs are specified in the request, the default security group for the VPC is applied."
+}
+
+variable "group_ids" {
+  type        = list
+  default     = []
+  description = "The ID of the group to which the authorization rule grants access."
+}