InvalidParameterValue: Invalid security group: can't attach the eks SGrule to RDS - amazon-web-services

Question

I am trying to provision RDS instance with private subnets using terraform template and my template looks like this
following attributes/restrictions while creating rds:
Not publicly Accessible. Security group to be opened only for eks
cluster, not public.
cat modules/rds/rds.tf
resource "aws_db_instance" "rds_instance" {
allocated_storage = 50
identifier = "rds-vaya"
storage_type = "gp2"
engine = "mysql"
engine_version = "8.0.23"
instance_class = "db.t2.micro"
db_name = "vaya"
username = "admin"
password = aws_secretsmanager_secret_version.password.secret_string
publicly_accessible = false
multi_az = true
db_subnet_group_name = aws_db_subnet_group.rdssubnet.id
vpc_security_group_ids = var.eks-sg
tags = {
Name = "OpsyRDSServerInstance"
}
}
cat modules/rds/security.tf
#make rds subnet group
resource "aws_db_subnet_group" "rdssubnet" {
name = "database-subnet"
subnet_ids = var.private_subnet_ids
}
cat modules/eks/security.tf
resource "aws_security_group" "main" {
name = "eks-sg-${var.env}"
vpc_id = var.vpc_id
}
resource "aws_security_group_rule" "ingress_rules" {
count = length(var.ingress_rule)
type = "ingress"
from_port = var.ingress_rule[count.index][0]
to_port = var.ingress_rule[count.index][1]
protocol = var.ingress_rule[count.index][2]
security_group_id = aws_security_group.main.id
source_security_group_id = aws_security_group.main.id
}
cat modules/eks/output.tf
output "eks-sg" {
value = aws_security_group_rule.ingress_rules.*.id
}
cat main.tf
module "eks_cluster" {
source = "./modules/eks"
eks_cluster_name = var.eks_cluster_name
vpc_id = module.vpc.vpc_id
subnet_ids = module.vpc.subnet_ids
eks_cluster_role_arn = module.iam.eks_cluster_role_arn
eks_cluster_create_depends_on = module.iam.id
instance_count = var.instance_count
instance_type = var.instance_type
ingress_rule = var.ingress_rule
env = var.env
}
module "rds" {
source = "./modules/rds"
vpc_id = module.vpc.vpc_id
private_subnet_ids = module.vpc.private_subnet_ids
eks-sg = module.eks_cluster.eks-sg
env = var.env
}
Below is the terraform plan/apply:
# module.rds.aws_db_instance.rds_instance will be created
+ resource "aws_db_instance" "rds_instance" {
+ address = (known after apply)
+ allocated_storage = 50
+ apply_immediately = (known after apply)
+ arn = (known after apply)
+ auto_minor_version_upgrade = true
+ availability_zone = (known after apply)
+ backup_retention_period = (known after apply)
+ backup_window = (known after apply)
+ ca_cert_identifier = (known after apply)
+ character_set_name = (known after apply)
+ copy_tags_to_snapshot = false
+ db_name = "vaya"
+ db_subnet_group_name = "database-subnet"
+ delete_automated_backups = true
+ endpoint = (known after apply)
+ engine = "mysql"
+ engine_version = "8.0.23"
+ engine_version_actual = (known after apply)
+ hosted_zone_id = (known after apply)
+ id = (known after apply)
+ identifier = "rds-vaya"
+ identifier_prefix = (known after apply)
+ instance_class = "db.t2.micro"
+ kms_key_id = (known after apply)
+ latest_restorable_time = (known after apply)
+ license_model = (known after apply)
+ maintenance_window = (known after apply)
+ monitoring_interval = 0
+ monitoring_role_arn = (known after apply)
+ multi_az = true
+ name = (known after apply)
+ nchar_character_set_name = (known after apply)
+ network_type = (known after apply)
+ option_group_name = (known after apply)
+ parameter_group_name = (known after apply)
+ password = (sensitive value)
+ performance_insights_enabled = false
+ performance_insights_kms_key_id = (known after apply)
+ performance_insights_retention_period = (known after apply)
+ port = (known after apply)
+ publicly_accessible = false
+ replica_mode = (known after apply)
+ replicas = (known after apply)
+ resource_id = (known after apply)
+ skip_final_snapshot = false
+ snapshot_identifier = (known after apply)
+ status = (known after apply)
+ storage_type = "gp2"
+ tags = {
+ "Name" = "OpsyRDSServerInstance"
}
+ tags_all = {
+ "Name" = "OpsyRDSServerInstance"
}
+ timezone = (known after apply)
+ username = "admin"
+ vpc_security_group_ids = [
+ "sgrule-2349526507",
+ "sgrule-2500829248",
+ "sgrule-2855048482",
+ "sgrule-4188522375",
]
}
Plan: 1 to add, 0 to change, 0 to destroy.
Changes to Outputs:
+ eks-sg = [
+ "sgrule-2500829248",
+ "sgrule-2349526507",
+ "sgrule-2855048482",
+ "sgrule-4188522375",
]
Do you want to perform these actions in workspace "dev"?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.
Enter a value: yes
module.rds.aws_db_instance.rds_instance: Creating...
╷
│ Error: creating RDS DB Instance (rds-vaya): InvalidParameterValue: Invalid security group , groupId= sgrule-2349526507, sgrule-2500829248, sgrule-2855048482, sgrule-4188522375, groupName=.
│ status code: 400, request id: fb505df1-9202-4986-9d54-7e4af4fcbc91
│
│ with module.rds.aws_db_instance.rds_instance,
│ on modules/rds/rds.tf line 2, in resource "aws_db_instance" "rds_instance":
│ 2: resource "aws_db_instance" "rds_instance" {
│
i've no idea what the problem and how to fix this issue.

Answer 1

You are outputting the SG rule IDs while you want SG IDs. You need to use the attributes of the SG itself:
resource "aws_security_group" "main" {
name = "eks-sg-${var.env}"
vpc_id = var.vpc_id
}
And the output should be (modules/eks/output.tf):
output "eks-sg" {
value = aws_security_group.main.id
}