We have the network and the server, but we still need to protect it with a firewall (Security Group) and, optionally, give it a fixed IP address (Elastic IP). Remember the concepts from Chapter 4 (subchapters 4.2 and 4.4); now we write them in Terraform and complete our first functional infrastructure.

The Security Group (subchapter 4.2) controls what traffic enters and leaves the instance. For a web server, we want to allow HTTP, HTTPS, and, in a limited way, SSH for administration.

Let's review the decisions, which apply what we've learned about security:

• HTTP (80) and HTTPS (443) from 0.0.0.0/0: correct, because we want anyone to be able to see the public website.
• SSH (22) only from your IP (/32): critical! Remember the beginner's mistake from subchapter 4.2. NEVER set SSH open to 0.0.0.0/0. Here we limit it to a specific IP (the /32 means "exactly this IP"). Replace 203.0.113.25 with your real IP.
• Open egress: allows the server to access the internet (to download software from user_data). Remember that Security Groups are stateful (subchapter 6.4), so responses to incoming connections are automatically allowed.

Now the instance from subchapter 12.2 already finds its Security Group, because it referenced it with vpc_security_group_ids = [aws_security_group.web.id]. The pieces fit together.

Remember the problem of changing IPs (subchapter 4.4): the public IP of an instance changes if you stop and start it. If you want a fixed IP, use an Elastic IP:

This reserves an Elastic IP and associates it with our instance. From now on, the server has a stable public address.

Remember the cost warning (subchapter 4.4): AWS charges for unused Elastic IPs and for public IPv4 addresses in general. For a single test instance it's fine, but in real architectures it's common to put a load balancer in front (Chapter 13) instead of one Elastic IP per server. For this first project, the Elastic IP is perfect to have a stable address.

We now have a functional infrastructure! Let's summarize everything we've built in the chapter so far:

If you run terraform apply (typing yes), Terraform creates everything in the correct order and, in a couple of minutes, your server will be serving the web page "Hello from my first server on AWS with Terraform!" on its public IP.

• The Security Group is defined with ingress (incoming) and egress (outgoing) rules, each with ports, protocol, and sources (cidr_blocks).
• Apply real security: HTTP/HTTPS open to the public, but SSH only to your IP (/32), never to 0.0.0.0/0.
• Since it's stateful, you don't need to manually open response traffic.
• An Elastic IP (aws_eip) gives a fixed public address to the instance; remember its cost and that in production a load balancer is usually preferred.
• With this you have your first functional infrastructure: network + web server + firewall + fixed IP, all in code.

In the next subchapter you'll learn how to extract useful information from your infrastructure (like the server's IP) with outputs and better understand references between resources.