Enable adding VPN SG explicitly

main.tf

@@ -16,7 +16,7 @@ resource "aws_elasticache_replication_group" "redis" {
   port                          = var.redis_port
   parameter_group_name          = aws_elasticache_parameter_group.redis_parameter_group.id
   subnet_group_name             = aws_elasticache_subnet_group.redis_subnet_group.id
-  security_group_ids            = [aws_security_group.redis_security_group.id]
+  security_group_ids            = compact([aws_security_group.redis_security_group.id, var.enable_vpn_sg ? var.vpn_sg_id : ""])
   apply_immediately             = var.apply_immediately
   maintenance_window            = var.redis_maintenance_window
   snapshot_window               = var.redis_snapshot_window

variables.tf

@@ -32,6 +32,18 @@ variable "allowed_security_groups" {
   default     = []
 }
 
+variable "enable_vpn_sg" {
+  description = "Specifies whether to explicitly reference VPC SG for the Redis Instance"
+  type        = bool
+  default     = false
+}
+
+variable "vpn_sg_id" {
+  description = "VPC SG id to explicitly reference under Network & Security for the Redis Instance"
+  type        = string
+  default     = ""
+}
+
 variable "env" {
   description = "env to deploy into, should typically dev/staging/prod"
   type        = string