Attach Separate AWS Security Group To AWS MSK's ZooKeeper instances

msk-zookeeper-sg.tf

resource aws_security_group "msk_nodes" {...}

resource aws_msk_cluster "cluster" {
  broker_node_group_info {
    security_groups = [aws_security_group.msk_nodes.id]
    ...
  }
}


/*
  Create a new Security Group for Zookeeper instances
*/
resource "aws_security_group" "zookeeper" {
  name        = "msk-${local.cluster_name}-broker-access-sg"
  description = "SG for MSK ${local.cluster_name} Zookeeper instance access."
  vpc_id      = data.aws_cloudformation_export.vpc_id.value
}

/*
  Grant all resources with the aws_security_group.msk_nodes attached to them access to Zookeeper.
*/
resource "aws_security_group_rule" "zookeeper-broker-access" {
  security_group_id        = aws_security_group.zookeeper.id
  description              = "Allow MSK brokers to access Zookeeper"
  type                     = "ingress"
  protocol                 = "tcp"
  from_port                = 2181
  to_port                  = 2182
  source_security_group_id = aws_security_group.msk_nodes.id
}

/*
  Attach Zookeeper Security Group to ENIs of Zookeeper Instances
*/
// Look up IP addresses for Zookeeper instances
data "dns_a_record_set" "zookeeper" {
  for_each = toset([for url in split(",", aws_msk_cluster.cluster.zookeeper_connect_string) : split(":", url)[0]])
  host     = each.value
}

// Select Zookeeper ENIs using the found IP addresses
data "aws_network_interfaces" "zookeeper" {
  filter {
    name   = "addresses.private-ip-address"
    values = flatten([for a_record in data.dns_a_record_set.zookeeper : a_record.addrs])
  }
}

// Attach the security group to the retrieved ENIs
resource "aws_network_interface_sg_attachment" "zookeeper_sg" {
  for_each             = toset(data.aws_network_interfaces.zookeeper.ids)
  network_interface_id = each.value
  security_group_id    = aws_security_group.zookeeper.id
}