A Security Group Whose Members Cannot Reach Each Other Unless Told
inner_access_policy defaults to Accept, so every instance in a group talks to every other on every port and one compromised web node is a route to the database beside it; SSH from 0.0.0.0/0 is the first rule offered; and the group is attached by the instance, which it cannot see. Members isolated unless told otherwise, SSH from anywhere refused unless accepted, egress open until rules narrow it.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "security_group" {
source = "www.iac-bazaar.com/iac-bazaar/alicloud-security-group/alicloud"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads static-verified because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/alicloud-security-group?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, static-verified on IaC Bazaar: [A Security Group Whose Members Cannot Reach Each Other Unless Told](https://www.iac-bazaar.com/catalog/alicloud-security-group?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "security_group" {
source = "www.iac-bazaar.com/iac-bazaar/alicloud-security-group/alicloud"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
alicloud-security-group
An Alibaba Cloud security group whose rules name their sources, whose
members cannot reach each other unless told, and that says what it does
not filter. Works with Terraform and OpenTofu (>= 1.6), alicloud
provider >= 1.0, < 2.0.
Members of a group reach each other by default. Drop here;
members_reach_each_other turns it back on.
No rules means nothing inbound and everything outbound; outbound rules narrow egress only when given.
SSH from 0.0.0.0/0 needs accept_ssh_from_anywhere.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
alicloud-bastion
A Bastionhost instance, its exposure and the directory its operators come from. Public access with an empty allow list is refused: that is a login page for production. Without AD or LDAP every account is local and outlives the person who left. Destroying it needs Alibaba to white-list the account first, which is documented provider behaviour and reported as an output.
alicloud-ram-role
A RAM role assumable by the services or accounts you name and nothing else (a wildcard principal is refused), with a custom policy written from your statements, the system policies you name attached (AdministratorAccess and any *FullAccess policy by name), and a session ceiling of an hour.
alicloud-security-posture
Security Center defence rules and baseline checks. A rule naming no servers defends nothing while Alibaba's default keeps running, so it is refused. The block-forever value is 52560000 minutes sitting at the end of a list of ordinary numbers, so the module takes words. SQL Server interception is off by default, which is where the interesting passwords are.
alicloud-network-firewall
Address books and control policies with their evaluation order declared, since the list is read top down and a broad accept above a narrow drop silently disables it. The intrusion prevention engine ships in observation mode, where it inspects, logs and blocks nothing while every dashboard looks right; block is the default here. Rules whose action is log are counted and reported.
alicloud-waf
WAF 3.0 in front of a domain on the pay-as-you-go instance the account has (adopted, not purchased), listening on HTTPS only with your certificate (plain HTTP by name), TLS 1.2 and 1.3 with a modern cipher suite, HTTP/2 and IPv6, the client address trusted from the first X-Forwarded-For hop, and origins reached over HTTPS with SNI, keepalive and retries.
do-firewall
A firewall with no droplets and no tags applies to nothing while the console shows it active; SSH from 0.0.0.0/0 is the first rule the console offers; and with no outbound rule nothing leaves, DNS included. Droplets or tags expected, port 22 from everywhere refused unless accepted, and an outbound default that allows what a server needs.