Terraform AWS EC2 instance with security groups example — Complete Guide

A practical, in-depth guide to Terraform AWS EC2 instance with security groups example with examples.

INTRO

Provisioning an EC2 instance without a reproducible, version‑controlled definition is a recipe for drift. In fast‑moving teams, you’ll see security groups manually tweaked in the console, IP ranges added ad‑hoc, and instances launched with the wrong AMI. The result? Security audits that raise red flags, unexpected outages, and a nightmare when you try to replicate the environment for staging or disaster recovery.

Terraform gives you a single source of truth for both the compute resource and its network fence. By describing the EC2 instance and its security groups in code, you lock down the attack surface, make changes auditable, and let the same configuration spin up identical machines across accounts or regions. The guide linked below walks you through the exact steps to avoid the typical pitfalls—like hard‑coding CIDR blocks or forgetting to attach the security group to the instance.

WHAT YOU'LL LEARN

• How to declare an AWS provider block with proper credentials and region handling.
• The anatomy of a reusable aws_security_group resource, including inbound/outbound rules and dynamic ports.
• Wiring the security group to an aws_instance resource without hard‑coded IDs.
• Using Terraform variables and locals to keep CIDR blocks, instance types, and AMI IDs configurable.
• Running terraform fmt, validate, and plan to catch errors before any API call.
• Best‑practice patterns for state storage (S3 backend) and secret management (SSM Parameter Store).

A SHORT CODE SNIPPET

resource "aws_security_group" "web_sg" {
name = "web-sg"
description = "Allow HTTP and SSH"

ingress {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = var.allowed_ssh_cidrs
}

ingress {
from_port = 80
to_port = 80
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}

egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}

The snippet shows a minimal security group that permits SSH from a configurable list of CIDRs and HTTP from anywhere—exactly the kind of reusable building block you’ll see expanded in the full guide.

KEY TAKEAWAYS

• Infrastructure as code eliminates drift – every change is captured in version control and can be reviewed before it hits AWS.
• Security groups belong in the same Terraform module as the EC2 instance to guarantee proper attachment and avoid orphaned rules.
• Parameterizing CIDR blocks and AMIs makes the same configuration safe for dev, test, and prod environments.
• Automated formatting, validation, and planning catch syntax errors and unintended permission changes early in the CI pipeline.

👉 Read the complete guide with step-by-step examples, common mistakes, and production tips:

Terraform AWS EC2 instance with security groups example — Complete Guide