Security enhancement pr devel 2.x

roles/aws/aws_ami/tasks/repack.yml

@@ -23,6 +23,7 @@
           - 22
         cidr_ip: "{{ aws_ami.repack.controller_cidr }}"
         rule_desc: "Allow controller to access the {{ aws_ami.ami_name }}-repacking instance"
+    rules_egress: []
 
 - name: Create an AMI with an existing EC2 instance.
   amazon.aws.ec2_ami:

roles/aws/aws_backup_validation/tasks/testing_resources.yml

@@ -48,6 +48,7 @@
         from_port: 22
         to_port: 22
         cidr_ip: 0.0.0.0/0
+    rules_egress: []
   register: _restore_testing_sg
 
 - name: Remove restore testing query file.

roles/aws/aws_ec2_autoscale_cluster/tasks/main.yml

@@ -41,6 +41,11 @@
     rules:
       - proto: all
         group_name: "{{ aws_ec2_autoscale_cluster.name }}"
+        rule_desc: "Allow internal traffic for cluster {{ aws_ec2_autoscale_cluster.name }}"
+    rules_egress:
+      - proto: all
+        group_name: "{{ aws_ec2_autoscale_cluster.name }}"
+        rule_desc: "Allow internal traffic for cluster {{ aws_ec2_autoscale_cluster.name }}"
   register: _aws_ec2_autoscale_cluster_security_group
 
 - name: Set _aws_ec2_autoscale_cluster_security_group variable.

roles/aws/aws_vpc_subnet/tasks/subnet.yml

@@ -34,6 +34,11 @@
     rules:
       - proto: all
         group_name: "{{ subnet.name }}"
+        rule_desc: "Allow internal traffic for subnet {{ subnet.name }}"
+    rules_egress:
+      - proto: all
+        group_name: "{{ subnet.name }}"
+        rule_desc: "Allow internal traffic for subnet {{ subnet.name }}"
   when:
     - subnet.security_group is defined
     - subnet.security_group