Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Network ACLs #238

Merged
merged 15 commits into from
Mar 22, 2019
Merged

Network ACLs #238

merged 15 commits into from
Mar 22, 2019

Conversation

antonbabenko
Copy link
Member

This PR is heavily based on #174 by @kinghuang

Added functionalities:

  • Possible to enable/disable creation of each NACL (eg, intra_dedicated_network_acl = true)
  • Possible to manage default ACL and rules (specify manage_default_network_acl = true)
  • Possible to specify and override tags for all NACL
  • Updated outputs, readme, examples
  • Is backward-compatible

Known limitations:

  • IPv6 is not supported in NACL rules

kinghuang and others added 15 commits February 25, 2019 11:31
Add variables for specifying network ACLs for public, private, and
intra subnets. The ACLs are defined in a list, with sets of seven
elements for the rule number, rule action, from port, to port,
protocol, and cidr block.
Add variables to specify additional tags for public, private, and intra
network ACL resources.
Add aws_network_acl and aws_network_acl_rule resources to specify
inbound and outbound network ACL rules for public, private, and intra
subnets.
Add a aws_default_network_acl resource to adopt the default network ACL
in the VPC.
Remove the empty lines after comment blocks for network ACLs to match
the style of the rest of this module.
Copy the simple-vpc example and adapt it to demonstrate the
configuration of network ACLs. A set of inbound and outbound ACLs are
specified in main.tf.
Clarify the variables for specifying ACL rules by renaming them from
*_acls to *_acl_rules. The values are used to create rules, not create
ACLs.
Add aws_network_acl and aws_network_acl_rule resources for database,
redshift, and elasticache subnets, along with corresponding variables.
This provides network ACL coverage to all subnet types produced by this
module.
For each subnet type, only create ACL resources if there are subnets
defined. For example, if database_subnets is empty, then don't create
ACL resources for database subnets.
Add the missing variable declarations for database_acl_tags,
redshift_acl_tags, and elasticache_acl_tags.
A single ACL is created for each of the subnet types. Update the
variable descriptions to reflect this.
Convert the NACL rule specifications from a list of lists to a list of
maps, as suggested by @jczerniak. This improves the readability of
rules.
Restructure the network ACL rules in the network-acls example to use
local variables to specify the rules, split between default and custom
rules.
@antonbabenko antonbabenko merged commit 65b893a into master Mar 22, 2019
@antonbabenko antonbabenko deleted the pr/174 branch March 22, 2019 13:40
@antonbabenko
Copy link
Member Author

v1.60.0 has been released!

Huge thanks to @kinghuang for the great contribution!

@iveskins
Copy link

Thanks for this.
If anyone else was using the old "list of list" format. here is some regex I used to convert things to a list of maps.
"100", "allow", 80, 80, "tcp", "100.100.100.10/32", "Allows inbound HTTP traffic from my IPv4 address"

^\s."(\d+)",\s+("allow"|"deny"),\s+(\d+),\s+(\d+),\s+("tcp"|"udp"),\s+("([0-9]{1,3}\.){3}[0-9]{1,3}(\/([1-2][0-9]|3[0-2]|[0-9]))?"),\s+(".*")([,]*)

{\n description = $10\n rule_number = $1\n rule_action = $2\n from_port = $3\n to_port = $4\n protocol = $5\n cidr_block = $6\n}$11

{
description = "Allows inbound HTTP traffic from my IPv4 address"
rule_number = 100
rule_action = "allow"
from_port = 80
to_port = 80
protocol = "tcp"
cidr_block = "100.100.100.10/32"
},

Copy link

@bigpapabear805 bigpapabear805 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mvv

guneriu added a commit to Yilu-Archive/terraform-aws-vpc that referenced this pull request May 14, 2021
* Fixing typo overriden -> overridden (terraform-aws-modules#150)

just a typo in the docs and in the
public_subnet_tags in the simple example

* Provide separate route tables for db/elasticache/redshift (terraform-aws-modules#155)

* Provide separate route tables for db/elasticache/redshift

* Added example for saperate routes

* Updated PR with suggestions

* Make redshift to use separate subnet route table also

* More cleanup and updates

* Fixed one more spelling mistake

* Add minimum support for IPv6 to VPC (terraform-aws-modules#156)

* Added support for IPv6 to VPC

* Removed IPv6 from outputs (fixed terraform-aws-modules#157) (terraform-aws-modules#158)

* Add secondary CIDR block support (terraform-aws-modules#163)

* Add secondary CIDR block support using a local variable to derive the vpc id to ensure the CIDR block operations are applied before the CIDR operations

* Add secondary cidr block outputs to module output

* Add the wonderful examples from matthiasr's PR located at terraform-aws-modules#162 all credit goes to them for this wonderful example

* From copy and paste accidentally used variable name that differed from these variables

* Resolve typo in secondary_cidr_blocks

* Fixed README formatting

* Followups for terraform-aws-modules#161

* Added local.vpc_id with description

* add vars for custom subnet and route table names (terraform-aws-modules#168)

* add vars for custom subnet and route table names

* revert db suffix to "db"

* Added cloudcraft.co as a sponsor for this module

* Added cloudcraft.co as a sponsor for this module

* Removed comments starting from # to fix README

* Updated link to cloudcraft

* Updated link to cloudcraft

* Reordering tag merging (terraform-aws-modules#148)

* Added amazon_side_asn to vpn_gateway (terraform-aws-modules#159)

* Added amazon_side_asn to vpn_gateway

* change to Amazon default ASN (as per API) (terraform-aws-modules#176)

https://docs.aws.amazon.com/cli/latest/reference/ec2/create-vpn-gateway.html

* Updated README.md after merge

* Fixed terraform-aws-modules#177 - public_subnets should not always be validated

* Fix for the error: module.vpc.aws_redshift_subnet_group.redshift: only lowercase alphanumeric characters and hyphens allowed in name

Read more: terraform-aws-modules#180

* Updated pre-commit version with new terraform-docs script

* Added IGW route for DB subnets (based on terraform-aws-modules#179)

* Reverted complete-example

* Added azs to outputs which is an argument

* Added possibility to control creation of elasticache and redshift subnet groups

* Added SSM and EC2 VPC endpoints (fixes terraform-aws-modules#195, terraform-aws-modules#194)

* adding option to create a route to nat gateway in database subnets

* Reordered vars in count for database_nat_gateway route

* add endpoints ec2messages, ssmmessages as those are required by Systems Manager in addition to ec2 and ssm.

* fix typo

* add additional endpoints to examples

* add files updated by pre-commit

* switch to terraform-docs v0.6.0

* Added option to create ECR api and dkr endpoints

* Added subnet ids to ecr endpoints

* Fixed formatting after terraform-aws-modules#205

* Fixed formatting after terraform-aws-modules#213

* Added intra subnet suffix. (terraform-aws-modules#220)

* Added intra subnet suffix.

* Fixed duplicate intra

* Fixed tag

* Added CHANGELOG.md (terraform-aws-modules#221)

* Bump version

* API gateway Endpoint (terraform-aws-modules#225)

* Updated changelog

* docs: Update comment in docs (terraform-aws-modules#226)

* Redshift public subnets (terraform-aws-modules#222)

* add public subnet for redshift to enable access for kinesis

* fix redshift subnet group name

* fix redshift public association

* add public redshift to documentation

* fix doc typo

* update code after review

* Redshift public subnets (terraform-aws-modules#222)

* Resolved conflicts after merge

* Updated changelog

* Network ACLs (terraform-aws-modules#238)

* Add variables for network ACLs

Add variables for specifying network ACLs for public, private, and
intra subnets. The ACLs are defined in a list, with sets of seven
elements for the rule number, rule action, from port, to port,
protocol, and cidr block.

* Add variables for network ACL tags

Add variables to specify additional tags for public, private, and intra
network ACL resources.

* Add resources for network ACLs

Add aws_network_acl and aws_network_acl_rule resources to specify
inbound and outbound network ACL rules for public, private, and intra
subnets.

* Add resource for default network ACL

Add a aws_default_network_acl resource to adopt the default network ACL
in the VPC.

* Adjust spacing to match code style

Remove the empty lines after comment blocks for network ACLs to match
the style of the rest of this module.

* Copy simple-vpc example as network-acls

Copy the simple-vpc example and adapt it to demonstrate the
configuration of network ACLs. A set of inbound and outbound ACLs are
specified in main.tf.

* Rename variables from _acls to _acl_rules

Clarify the variables for specifying ACL rules by renaming them from
*_acls to *_acl_rules. The values are used to create rules, not create
ACLs.

* Add nacl resources and variables for other subnets

Add aws_network_acl and aws_network_acl_rule resources for database,
redshift, and elasticache subnets, along with corresponding variables.
This provides network ACL coverage to all subnet types produced by this
module.

* Create ACLs only if there are subnets

For each subnet type, only create ACL resources if there are subnets
defined. For example, if database_subnets is empty, then don't create
ACL resources for database subnets.

* Add missing variables for ACL tags

Add the missing variable declarations for database_acl_tags,
redshift_acl_tags, and elasticache_acl_tags.

* Make ACL singular in description for _acl_tags

A single ACL is created for each of the subnet types. Update the
variable descriptions to reflect this.

* Convert rules to nested list of maps

Convert the NACL rule specifications from a list of lists to a list of
maps, as suggested by @jczerniak. This improves the readability of
rules.

* Restructure example config to use locals

Restructure the network ACL rules in the network-acls example to use
local variables to specify the rules, split between default and custom
rules.

* Follow-up for terraform-aws-modules#174

* Updated CHANGELOG

* Added missing VPC endpoints outputs (resolves terraform-aws-modules#246) (terraform-aws-modules#247)

* Updated CHANGELOG

* Add support for KMS VPC endpoint creation (terraform-aws-modules#243)

* Updated CHANGELOG

* Added ARN of VPC in module output (terraform-aws-modules#245)

I need in my policy generator the arn of vpc so I would like to include this

* Fixed formatting

* Updated CHANGELOG

* Add Output Of Subnet ARNs (terraform-aws-modules#242)

* Add Output Of Subnet ARNs

Facilitates resource access manager, subnet sharing across accounts

* Update Readme For Subnet ARN Output

* Fixed formatting

* Updated CHANGELOG

* Improving DHCP options docs (terraform-aws-modules#260)

* Improving DHCP options docs

* generating README from variables description

* Updated CHANGELOG

* ECS endpoint (terraform-aws-modules#261)

* add ecs vpc endpoints

* add ecs vpcendpoints outputs

* add ecs vpc endpoints to readme inputs/outputs table

* add ecs vpc endpoints to readme endpoint list

* Added VPC endpoints for SQS (closes terraform-aws-modules#248)

* Updated CHANGELOG

* Finally, Terraform 0.12 support (terraform-aws-modules#266)

* run terraform 0.12upgrade

* Cleanup for Terraform 0.12 (closes terraform-aws-modules#265, terraform-aws-modules#228)

* Fixed merge conflicts

* Updated CHANGELOG

* Upgrade Docker Image to fix CI (terraform-aws-modules#270)

* Added VPC Endpoints for SNS, Cloudtrail, ELB, Cloudwatch (terraform-aws-modules#269)

* Updated CHANGELOG

* Updated Terraform versions in README

* Updated CHANGELOG

* Fixed opportunity to create the vpc, vpn gateway routes (bug during upgrade to 0.12)

* Updated CHANGELOG

* Fixed broken 2.3.0

* Updated CHANGELOG

* Updated CHANGELOG

* Update tflint to 0.8.2 for circleci task (terraform-aws-modules#280)

* Updated VPC endpoint example (fixed terraform-aws-modules#249)

* Updated CHANGELOG

* Updated pre-commit-terraform to support terraform-docs and Terraform 0.12 (terraform-aws-modules#288)

* Updated CHANGELOG

* Enable backwards compatibility

* KAN-380 terraform 0.12 upgrade

* enable backwards compatibility

Co-authored-by: Tristan Escalada <tristan@escalada.us>
Co-authored-by: Anton Babenko <anton@antonbabenko.com>
Co-authored-by: Rupert Broad <rupert.broad@exact.com>
Co-authored-by: Scott Crooks <sc250024@users.noreply.github.com>
Co-authored-by: Mayur Nagekar <mayur@meetbeam.com>
Co-authored-by: ebarault <eric.barault@gmail.com>
Co-authored-by: tbugfinder <github@online.ms>
Co-authored-by: Michiel Dhadamus <michiel.dhadamus@dataminded.be>
Co-authored-by: Kinnaird McQuade <kmcquade@users.noreply.github.com>
Co-authored-by: tharun-allu <tharun-allu@users.noreply.github.com>
Co-authored-by: Kyle <1kylecameron@gmail.com>
Co-authored-by: bmihaescu <bmihaescu@gmail.com>
Co-authored-by: Nikos Loutas <nloutas@gmail.com>
Co-authored-by: Rafael Bernardo <rafaelbernardo@protonmail.com>
Co-authored-by: Blaine Schanfeldt <git@blaines.me>
Co-authored-by: Andreas Wittig <andreas@widdix.de>
Co-authored-by: Ilia Lazebnik <Ilia.lazebnik@gmail.com>
Co-authored-by: Niklas Wagner <Skaro@Skaronator.com>
Co-authored-by: Sebastian Geidies <sebastian.geidies@bcgdv.com>
Co-authored-by: ugur.guneri <ugur.guneri@yiluhub.com>
@github-actions
Copy link

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Oct 31, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants