-
Notifications
You must be signed in to change notification settings - Fork 10
/
vpc_network_acls.tf
96 lines (85 loc) · 4.08 KB
/
vpc_network_acls.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
# acl for entire vpc
resource "aws_network_acl" "vpc_acl" {
count = local.create_network_acl
vpc_id = aws_vpc.main.id
subnet_ids = flatten([aws_subnet.sn_private_a[*].id, aws_subnet.sn_private_b[*].id, aws_subnet.sn_private_c[*].id, aws_subnet.sn_public_a[*].id, aws_subnet.sn_public_b[*].id, aws_subnet.sn_public_c[*].id])
tags = {
Name = var.network_acl_tag_name
}
}
# default allow inbound all in
resource "aws_network_acl_rule" "allow_all_ingress_in" {
count = local.create_network_acl
network_acl_id = aws_network_acl.vpc_acl[0].id
rule_number = 32766
egress = false
protocol = -1
rule_action = "allow"
cidr_block = "0.0.0.0/0"
}
# default allow outbound all out
resource "aws_network_acl_rule" "allow_all_egress_out" {
count = local.create_network_acl
network_acl_id = aws_network_acl.vpc_acl[0].id
rule_number = 32766
egress = true
protocol = -1
rule_action = "allow"
cidr_block = "0.0.0.0/0"
}
# add additional acl rules
resource "aws_network_acl_rule" "acl_rule_deny" {
count = local.create_network_acl_rules
network_acl_id = aws_network_acl.vpc_acl[0].id
rule_number = lookup(element(var.network_acl_rules, count.index), "rule_number")
egress = lookup(element(var.network_acl_rules, count.index), "egress")
protocol = lookup(element(var.network_acl_rules, count.index), "protocol")
rule_action = lookup(element(var.network_acl_rules, count.index), "rule_action")
cidr_block = lookup(element(var.network_acl_rules, count.index), "cidr_block")
from_port = lookup(element(var.network_acl_rules, count.index), "from_port")
to_port = lookup(element(var.network_acl_rules, count.index), "to_port")
}
########
# acl for private subnets only
resource "aws_network_acl" "private_subnets_acl" {
count = local.create_private_subnet_acl
vpc_id = aws_vpc.main.id
subnet_ids = flatten([aws_subnet.sn_private_a[*].id, aws_subnet.sn_private_b[*].id, aws_subnet.sn_private_c[*].id])
tags = {
Name = var.private_subnet_tag_name
}
}
# add additional private subnet acl rules
resource "aws_network_acl_rule" "private_subnet_acl_rules" {
count = local.create_private_subnet_acl_rules
network_acl_id = aws_network_acl.private_subnets_acl[0].id
rule_number = lookup(element(var.private_subnet_acl_rules, count.index), "rule_number")
egress = lookup(element(var.private_subnet_acl_rules, count.index), "egress")
protocol = lookup(element(var.private_subnet_acl_rules, count.index), "protocol")
rule_action = lookup(element(var.private_subnet_acl_rules, count.index), "rule_action")
cidr_block = lookup(element(var.private_subnet_acl_rules, count.index), "cidr_block")
from_port = lookup(element(var.private_subnet_acl_rules, count.index), "from_port")
to_port = lookup(element(var.private_subnet_acl_rules, count.index), "to_port")
}
########
# acl for public subnets only
resource "aws_network_acl" "public_subnets_acl" {
count = local.create_public_subnet_acl
vpc_id = aws_vpc.main.id
subnet_ids = flatten([aws_subnet.sn_public_a[*].id, aws_subnet.sn_public_b[*].id, aws_subnet.sn_public_c[*].id])
tags = {
Name = var.public_subnet_tag_name
}
}
# add additional public subnet acl rules
resource "aws_network_acl_rule" "public_subnet_acl_rules" {
count = local.create_public_subnet_acl_rules
network_acl_id = aws_network_acl.public_subnets_acl[0].id
rule_number = lookup(element(var.public_subnet_acl_rules, count.index), "rule_number")
egress = lookup(element(var.public_subnet_acl_rules, count.index), "egress")
protocol = lookup(element(var.public_subnet_acl_rules, count.index), "protocol")
rule_action = lookup(element(var.public_subnet_acl_rules, count.index), "rule_action")
cidr_block = lookup(element(var.public_subnet_acl_rules, count.index), "cidr_block")
from_port = lookup(element(var.public_subnet_acl_rules, count.index), "from_port")
to_port = lookup(element(var.public_subnet_acl_rules, count.index), "to_port")
}