terraform {
  required_version = ">= 1.7, < 2.0"
  required_providers {
    aws = { source = "hashicorp/aws", version = "~> 6.0" }
  }
}

variable "region" {
  type = string
}
variable "account_id" {
  type = string
}
variable "vpc_id" {
  type = string
}

provider "aws" {
  region              = var.region
  allowed_account_ids = [var.account_id]
}

# Intentionally broken: each group's creation requires the other group's ID.
# Do not apply this fixture to an existing environment.
resource "aws_security_group" "api" {
  name_prefix = "cycle-lab-api-"
  description = "Orders API TLS"
  vpc_id      = var.vpc_id

  ingress {
    from_port       = 8443
    to_port         = 8443
    protocol        = "tcp"
    security_groups = [aws_security_group.worker.id]
  }
}

resource "aws_security_group" "worker" {
  name_prefix = "cycle-lab-worker-"
  description = "Orders worker callback TLS"
  vpc_id      = var.vpc_id

  ingress {
    from_port       = 8443
    to_port         = 8443
    protocol        = "tcp"
    security_groups = [aws_security_group.api.id]
  }
}