-
-
Notifications
You must be signed in to change notification settings - Fork 4.5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Add variables for network ACLs Add variables for specifying network ACLs for public, private, and intra subnets. The ACLs are defined in a list, with sets of seven elements for the rule number, rule action, from port, to port, protocol, and cidr block. * Add variables for network ACL tags Add variables to specify additional tags for public, private, and intra network ACL resources. * Add resources for network ACLs Add aws_network_acl and aws_network_acl_rule resources to specify inbound and outbound network ACL rules for public, private, and intra subnets. * Add resource for default network ACL Add a aws_default_network_acl resource to adopt the default network ACL in the VPC. * Adjust spacing to match code style Remove the empty lines after comment blocks for network ACLs to match the style of the rest of this module. * Copy simple-vpc example as network-acls Copy the simple-vpc example and adapt it to demonstrate the configuration of network ACLs. A set of inbound and outbound ACLs are specified in main.tf. * Rename variables from _acls to _acl_rules Clarify the variables for specifying ACL rules by renaming them from *_acls to *_acl_rules. The values are used to create rules, not create ACLs. * Add nacl resources and variables for other subnets Add aws_network_acl and aws_network_acl_rule resources for database, redshift, and elasticache subnets, along with corresponding variables. This provides network ACL coverage to all subnet types produced by this module. * Create ACLs only if there are subnets For each subnet type, only create ACL resources if there are subnets defined. For example, if database_subnets is empty, then don't create ACL resources for database subnets. * Add missing variables for ACL tags Add the missing variable declarations for database_acl_tags, redshift_acl_tags, and elasticache_acl_tags. * Make ACL singular in description for _acl_tags A single ACL is created for each of the subnet types. Update the variable descriptions to reflect this. * Convert rules to nested list of maps Convert the NACL rule specifications from a list of lists to a list of maps, as suggested by @jczerniak. This improves the readability of rules. * Restructure example config to use locals Restructure the network ACL rules in the network-acls example to use local variables to specify the rules, split between default and custom rules. * Follow-up for #174
- Loading branch information
1 parent
b5b23cd
commit 65b893a
Showing
7 changed files
with
862 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| # Simple VPC with Network ACLs | ||
|
|
||
| Configuration in this directory creates set of VPC resources along with network ACLs for public subnets. | ||
|
|
||
| There is a public and private subnet created per availability zone in addition to single NAT Gateway shared between all 3 availability zones. | ||
|
|
||
| Network ACL rules for inbound and outbound traffic are defined as the following: | ||
| 1. Public subnets will have network ACL rules provided | ||
| 1. Private subnets will be associated with the default network ACL rules (IPV4-only ingress and egress is open for all) | ||
| 1. Elasticache subnets will use the default network ACL (created and managed by AWS) | ||
|
|
||
| ## Usage | ||
|
|
||
| To run this example you need to execute: | ||
|
|
||
| ```bash | ||
| $ terraform init | ||
| $ terraform plan | ||
| $ terraform apply | ||
| ``` | ||
|
|
||
| Note that this example may create resources which can cost money (AWS Elastic IP, for example). Run `terraform destroy` when you don't need these resources. | ||
|
|
||
| <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --> | ||
| ## Outputs | ||
|
|
||
| | Name | Description | | ||
| |------|-------------| | ||
| | default\_network\_acl\_id | The ID of the default network ACL | | ||
| | elasticache\_network\_acl\_id | ID of the elasticache network ACL | | ||
| | nat\_public\_ips | List of public Elastic IPs created for AWS NAT Gateway | | ||
| | private\_network\_acl\_id | ID of the private network ACL | | ||
| | private\_subnets | List of IDs of private subnets | | ||
| | public\_network\_acl\_id | ID of the public network ACL | | ||
| | public\_subnets | List of IDs of public subnets | | ||
| | vpc\_cidr\_block | The CIDR block of the VPC | | ||
| | vpc\_id | The ID of the VPC | | ||
|
|
||
| <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --> |
Oops, something went wrong.