import boto3

# Specify the region where the MS SQL Server instance is located
region_name = 'us-west-2'

# Specify the name of the security group associated with the MS SQL Server instance
security_group_name = 'ms-sql-sg'

# Specify the IP address of the client machine from where the MS SQL Server connection is initiated
client_ip_address = '10.0.0.1/32'

# Create a new security group rule that allows incoming traffic from the client machine IP address to the MS SQL Server instance on port 1433
ec2 = boto3.client('ec2', region_name=region_name)
response = ec2.authorize_security_group_ingress(
    GroupName=security_group_name,
    IpPermissions=[
        {
            'IpProtocol': 'tcp',
            'FromPort': 1433,
            'ToPort': 1433,
            'IpRanges': [
                {
                    'CidrIp': client_ip_address,
                    'Description': 'Allow MS SQL Server access from client IP address'
                },
            ],
        },
    ],
)

# Remove the existing security group rule that allows unrestricted access to the MS SQL Server instance
response = ec2.revoke_security_group_ingress(
    GroupName=security_group_name,
    IpPermissions=[
        {
            'IpProtocol': 'tcp',
            'FromPort': 1433,
            'ToPort': 1433,
            'IpRanges': [
                {
                    'CidrIp': '0.0.0.0/0',
                },
            ],
        },
    ],
)

resource "aws_security_group" "mssql_sg" {
  name        = "mssql-sg"
  description = "Security group for MSSQL that does NOT allow unrestricted public access"
  vpc_id      = AWS_VPC_ID  # replace with your VPC ID, e.g. aws_vpc.main.id

  # REMOVE any ingress blocks that allow:
  # - from_port = 1433 / to_port = 1433 / protocol = "tcp"
  #   with cidr_blocks      = ["0.0.0.0/0"]
  #   or ipv6_cidr_blocks   = ["::/0"]

  # Example of a more restrictive replacement (optional):
  ingress {
    description = "MSSQL from trusted IPv4 range"
    from_port   = 1433
    to_port     = 1433
    protocol    = "tcp"
    cidr_blocks = [
      "TRUSTED_IPV4_CIDR", # e.g. "203.0.113.0/24"
    ]
  }

  # Example restrictive IPv6 rule if needed:
  # ingress {
  #   description      = "MSSQL from trusted IPv6 range"
  #   from_port        = 1433
  #   to_port          = 1433
  #   protocol         = "tcp"
  #   ipv6_cidr_blocks = ["TRUSTED_IPV6_CIDR"] # e.g. "2001:db8::/48"
  # }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "mssql-sg"
  }
}