AWS provider: separate SG rules from SGs

[patrykorwat]

The task is to allow terraformer not to inline rules and import them separately.

Ref: #275 (comment)

[iwasnobody]

I'm looking forward this feature cause part of aws resources are created manually and part of are managed terraform.
We are now trying to migrate resources created manually to terraform using terraformer.
Cause there is no good way to combine the state file created by terraformer with the our existing state file. We have to use terraform import to add state entry for each resources created by terraformer into the existing state file.
Because the terraform import command import the security group by separate sg rule while the tf config generated by terraformer has inline rules. When I do terraform plan, the separate sg rule will be deleted because they are in state file but not in tf config.
We use terraform enterprise and support engineer in terraform confirmed it is the behavior of terraform import because separate sg rule is their best practice.

[patrykorwat]

Thanks for digging that problem! The initial idea was to keep things clear and readable but there are already several people who are asking for the change.

The terraformer tool is being used in two ways:

1. To generate dump of Terraform resources, to be later used for building of custom structures - in this case it should be fine to keel inline rules, since refresh command will be used, not import
2. The case that you described, where additional import is necessary.

The best solution in this case, would be to tell terraformer to separate the rules from groups. That would be achieved in a similar manner to how we customize dump of SQS queues [1]. We can add code to keep rules out of the groups if environment variable SPLIT_SG_RULES is set to any value.

[1] https://github.com/GoogleCloudPlatform/terraformer#sqs-queues-retrieval

[bmj8409]

Should this be revisited now that Terraform has yet another way to define the rule resources.....

aws_vpc_security_group_ingress_rule

aws_vpc_security_group_egress_rule