Skip to content

Commit 7bf8360

Browse files
t11nantonbabenko
t11n
authored and
antonbabenko
committed
Added support for ICMP rules in Network ACL (#286)
* Added icmp_code and icmp_type values to non default acl rules. * Added support for both ICMP and non-ICMP rules in NACL
1 parent fa1eb90 commit 7bf8360

File tree

4 files changed

+95
-30
lines changed

4 files changed

+95
-30
lines changed

‎examples/network-acls/README.md

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,10 @@
11
# Simple VPC with Network ACLs
22

3-
Configuration in this directory creates set of VPC resources along with network ACLs for public subnets.
4-
5-
There is a public and private subnet created per availability zone in addition to single NAT Gateway shared between all 3 availability zones.
3+
Configuration in this directory creates set of VPC resources along with network ACLs for several subnets.
64

75
Network ACL rules for inbound and outbound traffic are defined as the following:
8-
1. Public subnets will have network ACL rules provided
6+
1. Public and elasticache subnets will have network ACL rules provided
97
1. Private subnets will be associated with the default network ACL rules (IPV4-only ingress and egress is open for all)
10-
1. Elasticache subnets will use the default network ACL (created and managed by AWS)
118

129
## Usage
1310

@@ -28,6 +25,7 @@ Note that this example may create resources which can cost money (AWS Elastic IP
2825
|------|-------------|
2926
| default\_network\_acl\_id | The ID of the default network ACL |
3027
| elasticache\_network\_acl\_id | ID of the elasticache network ACL |
28+
| module\_vpc | Module VPC |
3129
| nat\_public\_ips | List of public Elastic IPs created for AWS NAT Gateway |
3230
| private\_network\_acl\_id | ID of the private network ACL |
3331
| private\_subnets | List of IDs of private subnets |

‎examples/network-acls/main.tf

Lines changed: 40 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,13 @@ module "vpc" {
2323
local.network_acls["default_outbound"],
2424
local.network_acls["public_outbound"],
2525
)
26+
elasticache_outbound_acl_rules = concat(
27+
local.network_acls["default_outbound"],
28+
local.network_acls["elasticache_outbound"],
29+
)
2630

27-
private_dedicated_network_acl = true
31+
private_dedicated_network_acl = true
32+
elasticache_dedicated_network_acl = true
2833

2934
enable_ipv6 = true
3035

@@ -134,6 +139,40 @@ locals {
134139
protocol = "tcp"
135140
cidr_block = "10.0.100.0/22"
136141
},
142+
{
143+
rule_number = 140
144+
rule_action = "allow"
145+
icmp_code = -1
146+
icmp_type = 8
147+
protocol = "icmp"
148+
cidr_block = "10.0.0.0/22"
149+
},
150+
]
151+
elasticache_outbound = [
152+
{
153+
rule_number = 100
154+
rule_action = "allow"
155+
from_port = 80
156+
to_port = 80
157+
protocol = "tcp"
158+
cidr_block = "0.0.0.0/0"
159+
},
160+
{
161+
rule_number = 110
162+
rule_action = "allow"
163+
from_port = 443
164+
to_port = 443
165+
protocol = "tcp"
166+
cidr_block = "0.0.0.0/0"
167+
},
168+
{
169+
rule_number = 140
170+
rule_action = "allow"
171+
icmp_code = -1
172+
icmp_type = 12
173+
protocol = "icmp"
174+
cidr_block = "10.0.0.0/22"
175+
},
137176
]
138177
}
139178
}

‎examples/network-acls/outputs.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,3 +53,7 @@ output "default_network_acl_id" {
5353
value = module.vpc.default_network_acl_id
5454
}
5555

56+
output "module_vpc" {
57+
description = "Module VPC"
58+
value = module.vpc
59+
}

‎main.tf

Lines changed: 48 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -548,8 +548,10 @@ resource "aws_network_acl_rule" "public_inbound" {
548548
egress = false
549549
rule_number = var.public_inbound_acl_rules[count.index]["rule_number"]
550550
rule_action = var.public_inbound_acl_rules[count.index]["rule_action"]
551-
from_port = var.public_inbound_acl_rules[count.index]["from_port"]
552-
to_port = var.public_inbound_acl_rules[count.index]["to_port"]
551+
from_port = lookup(var.public_inbound_acl_rules[count.index], "from_port", null)
552+
to_port = lookup(var.public_inbound_acl_rules[count.index], "to_port", null)
553+
icmp_code = lookup(var.public_inbound_acl_rules[count.index], "icmp_code", null)
554+
icmp_type = lookup(var.public_inbound_acl_rules[count.index], "icmp_type", null)
553555
protocol = var.public_inbound_acl_rules[count.index]["protocol"]
554556
cidr_block = var.public_inbound_acl_rules[count.index]["cidr_block"]
555557
}
@@ -562,8 +564,10 @@ resource "aws_network_acl_rule" "public_outbound" {
562564
egress = true
563565
rule_number = var.public_outbound_acl_rules[count.index]["rule_number"]
564566
rule_action = var.public_outbound_acl_rules[count.index]["rule_action"]
565-
from_port = var.public_outbound_acl_rules[count.index]["from_port"]
566-
to_port = var.public_outbound_acl_rules[count.index]["to_port"]
567+
from_port = lookup(var.public_outbound_acl_rules[count.index], "from_port", null)
568+
to_port = lookup(var.public_outbound_acl_rules[count.index], "to_port", null)
569+
icmp_code = lookup(var.public_outbound_acl_rules[count.index], "icmp_code", null)
570+
icmp_type = lookup(var.public_outbound_acl_rules[count.index], "icmp_type", null)
567571
protocol = var.public_outbound_acl_rules[count.index]["protocol"]
568572
cidr_block = var.public_outbound_acl_rules[count.index]["cidr_block"]
569573
}
@@ -594,8 +598,10 @@ resource "aws_network_acl_rule" "private_inbound" {
594598
egress = false
595599
rule_number = var.private_inbound_acl_rules[count.index]["rule_number"]
596600
rule_action = var.private_inbound_acl_rules[count.index]["rule_action"]
597-
from_port = var.private_inbound_acl_rules[count.index]["from_port"]
598-
to_port = var.private_inbound_acl_rules[count.index]["to_port"]
601+
from_port = lookup(var.private_inbound_acl_rules[count.index], "from_port", null)
602+
to_port = lookup(var.private_inbound_acl_rules[count.index], "to_port", null)
603+
icmp_code = lookup(var.private_inbound_acl_rules[count.index], "icmp_code", null)
604+
icmp_type = lookup(var.private_inbound_acl_rules[count.index], "icmp_type", null)
599605
protocol = var.private_inbound_acl_rules[count.index]["protocol"]
600606
cidr_block = var.private_inbound_acl_rules[count.index]["cidr_block"]
601607
}
@@ -608,8 +614,10 @@ resource "aws_network_acl_rule" "private_outbound" {
608614
egress = true
609615
rule_number = var.private_outbound_acl_rules[count.index]["rule_number"]
610616
rule_action = var.private_outbound_acl_rules[count.index]["rule_action"]
611-
from_port = var.private_outbound_acl_rules[count.index]["from_port"]
612-
to_port = var.private_outbound_acl_rules[count.index]["to_port"]
617+
from_port = lookup(var.private_outbound_acl_rules[count.index], "from_port", null)
618+
to_port = lookup(var.private_outbound_acl_rules[count.index], "to_port", null)
619+
icmp_code = lookup(var.private_outbound_acl_rules[count.index], "icmp_code", null)
620+
icmp_type = lookup(var.private_outbound_acl_rules[count.index], "icmp_type", null)
613621
protocol = var.private_outbound_acl_rules[count.index]["protocol"]
614622
cidr_block = var.private_outbound_acl_rules[count.index]["cidr_block"]
615623
}
@@ -640,8 +648,10 @@ resource "aws_network_acl_rule" "intra_inbound" {
640648
egress = false
641649
rule_number = var.intra_inbound_acl_rules[count.index]["rule_number"]
642650
rule_action = var.intra_inbound_acl_rules[count.index]["rule_action"]
643-
from_port = var.intra_inbound_acl_rules[count.index]["from_port"]
644-
to_port = var.intra_inbound_acl_rules[count.index]["to_port"]
651+
from_port = lookup(var.intra_inbound_acl_rules[count.index], "from_port", null)
652+
to_port = lookup(var.intra_inbound_acl_rules[count.index], "to_port", null)
653+
icmp_code = lookup(var.intra_inbound_acl_rules[count.index], "icmp_code", null)
654+
icmp_type = lookup(var.intra_inbound_acl_rules[count.index], "icmp_type", null)
645655
protocol = var.intra_inbound_acl_rules[count.index]["protocol"]
646656
cidr_block = var.intra_inbound_acl_rules[count.index]["cidr_block"]
647657
}
@@ -654,8 +664,10 @@ resource "aws_network_acl_rule" "intra_outbound" {
654664
egress = true
655665
rule_number = var.intra_outbound_acl_rules[count.index]["rule_number"]
656666
rule_action = var.intra_outbound_acl_rules[count.index]["rule_action"]
657-
from_port = var.intra_outbound_acl_rules[count.index]["from_port"]
658-
to_port = var.intra_outbound_acl_rules[count.index]["to_port"]
667+
from_port = lookup(var.intra_outbound_acl_rules[count.index], "from_port", null)
668+
to_port = lookup(var.intra_outbound_acl_rules[count.index], "to_port", null)
669+
icmp_code = lookup(var.intra_outbound_acl_rules[count.index], "icmp_code", null)
670+
icmp_type = lookup(var.intra_outbound_acl_rules[count.index], "icmp_type", null)
659671
protocol = var.intra_outbound_acl_rules[count.index]["protocol"]
660672
cidr_block = var.intra_outbound_acl_rules[count.index]["cidr_block"]
661673
}
@@ -686,8 +698,10 @@ resource "aws_network_acl_rule" "database_inbound" {
686698
egress = false
687699
rule_number = var.database_inbound_acl_rules[count.index]["rule_number"]
688700
rule_action = var.database_inbound_acl_rules[count.index]["rule_action"]
689-
from_port = var.database_inbound_acl_rules[count.index]["from_port"]
690-
to_port = var.database_inbound_acl_rules[count.index]["to_port"]
701+
from_port = lookup(var.database_inbound_acl_rules[count.index], "from_port", null)
702+
to_port = lookup(var.database_inbound_acl_rules[count.index], "to_port", null)
703+
icmp_code = lookup(var.database_inbound_acl_rules[count.index], "icmp_code", null)
704+
icmp_type = lookup(var.database_inbound_acl_rules[count.index], "icmp_type", null)
691705
protocol = var.database_inbound_acl_rules[count.index]["protocol"]
692706
cidr_block = var.database_inbound_acl_rules[count.index]["cidr_block"]
693707
}
@@ -700,8 +714,10 @@ resource "aws_network_acl_rule" "database_outbound" {
700714
egress = true
701715
rule_number = var.database_outbound_acl_rules[count.index]["rule_number"]
702716
rule_action = var.database_outbound_acl_rules[count.index]["rule_action"]
703-
from_port = var.database_outbound_acl_rules[count.index]["from_port"]
704-
to_port = var.database_outbound_acl_rules[count.index]["to_port"]
717+
from_port = lookup(var.database_outbound_acl_rules[count.index], "from_port", null)
718+
to_port = lookup(var.database_outbound_acl_rules[count.index], "to_port", null)
719+
icmp_code = lookup(var.database_outbound_acl_rules[count.index], "icmp_code", null)
720+
icmp_type = lookup(var.database_outbound_acl_rules[count.index], "icmp_type", null)
705721
protocol = var.database_outbound_acl_rules[count.index]["protocol"]
706722
cidr_block = var.database_outbound_acl_rules[count.index]["cidr_block"]
707723
}
@@ -732,8 +748,10 @@ resource "aws_network_acl_rule" "redshift_inbound" {
732748
egress = false
733749
rule_number = var.redshift_inbound_acl_rules[count.index]["rule_number"]
734750
rule_action = var.redshift_inbound_acl_rules[count.index]["rule_action"]
735-
from_port = var.redshift_inbound_acl_rules[count.index]["from_port"]
736-
to_port = var.redshift_inbound_acl_rules[count.index]["to_port"]
751+
from_port = lookup(var.redshift_inbound_acl_rules[count.index], "from_port", null)
752+
to_port = lookup(var.redshift_inbound_acl_rules[count.index], "to_port", null)
753+
icmp_code = lookup(var.redshift_inbound_acl_rules[count.index], "icmp_code", null)
754+
icmp_type = lookup(var.redshift_inbound_acl_rules[count.index], "icmp_type", null)
737755
protocol = var.redshift_inbound_acl_rules[count.index]["protocol"]
738756
cidr_block = var.redshift_inbound_acl_rules[count.index]["cidr_block"]
739757
}
@@ -746,8 +764,10 @@ resource "aws_network_acl_rule" "redshift_outbound" {
746764
egress = true
747765
rule_number = var.redshift_outbound_acl_rules[count.index]["rule_number"]
748766
rule_action = var.redshift_outbound_acl_rules[count.index]["rule_action"]
749-
from_port = var.redshift_outbound_acl_rules[count.index]["from_port"]
750-
to_port = var.redshift_outbound_acl_rules[count.index]["to_port"]
767+
from_port = lookup(var.redshift_outbound_acl_rules[count.index], "from_port", null)
768+
to_port = lookup(var.redshift_outbound_acl_rules[count.index], "to_port", null)
769+
icmp_code = lookup(var.redshift_outbound_acl_rules[count.index], "icmp_code", null)
770+
icmp_type = lookup(var.redshift_outbound_acl_rules[count.index], "icmp_type", null)
751771
protocol = var.redshift_outbound_acl_rules[count.index]["protocol"]
752772
cidr_block = var.redshift_outbound_acl_rules[count.index]["cidr_block"]
753773
}
@@ -778,8 +798,10 @@ resource "aws_network_acl_rule" "elasticache_inbound" {
778798
egress = false
779799
rule_number = var.elasticache_inbound_acl_rules[count.index]["rule_number"]
780800
rule_action = var.elasticache_inbound_acl_rules[count.index]["rule_action"]
781-
from_port = var.elasticache_inbound_acl_rules[count.index]["from_port"]
782-
to_port = var.elasticache_inbound_acl_rules[count.index]["to_port"]
801+
from_port = lookup(var.elasticache_inbound_acl_rules[count.index], "from_port", null)
802+
to_port = lookup(var.elasticache_inbound_acl_rules[count.index], "to_port", null)
803+
icmp_code = lookup(var.elasticache_inbound_acl_rules[count.index], "icmp_code", null)
804+
icmp_type = lookup(var.elasticache_inbound_acl_rules[count.index], "icmp_type", null)
783805
protocol = var.elasticache_inbound_acl_rules[count.index]["protocol"]
784806
cidr_block = var.elasticache_inbound_acl_rules[count.index]["cidr_block"]
785807
}
@@ -792,8 +814,10 @@ resource "aws_network_acl_rule" "elasticache_outbound" {
792814
egress = true
793815
rule_number = var.elasticache_outbound_acl_rules[count.index]["rule_number"]
794816
rule_action = var.elasticache_outbound_acl_rules[count.index]["rule_action"]
795-
from_port = var.elasticache_outbound_acl_rules[count.index]["from_port"]
796-
to_port = var.elasticache_outbound_acl_rules[count.index]["to_port"]
817+
from_port = lookup(var.elasticache_outbound_acl_rules[count.index], "from_port", null)
818+
to_port = lookup(var.elasticache_outbound_acl_rules[count.index], "to_port", null)
819+
icmp_code = lookup(var.elasticache_outbound_acl_rules[count.index], "icmp_code", null)
820+
icmp_type = lookup(var.elasticache_outbound_acl_rules[count.index], "icmp_type", null)
797821
protocol = var.elasticache_outbound_acl_rules[count.index]["protocol"]
798822
cidr_block = var.elasticache_outbound_acl_rules[count.index]["cidr_block"]
799823
}

0 commit comments

Comments
 (0)