You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Sponsored by [Cloudcraft - the best way to draw AWS diagrams](https://cloudcraft.co/?utm_source=terraform-aws-vpc)
26
28
@@ -165,6 +167,14 @@ Sometimes it is handy to have public access to RDS instances (it is not recommen
165
167
enable_dns_support = true
166
168
```
167
169
170
+
## Network Access Control Lists (ACL or NACL)
171
+
172
+
This module can manage network ACL and rules. Once VPC is created, AWS creates the default network ACL, which can be controlled using this module (`manage_default_network_acl = true`).
173
+
174
+
Also, each type of subnet may have its own network ACL with custom rules per subnet. Eg, set `public_dedicated_network_acl = true` to use dedicated network ACL for the public subnets; set values of `public_inbound_acl_rules` and `public_outbound_acl_rules` to specify all the NACL rules you need to have on public subnets (see `variables.tf` for default values and structures).
175
+
176
+
By default, all subnets are associated with the default network ACL.
177
+
168
178
## Terraform version
169
179
170
180
Terraform version 0.10.3 or newer is required for this module to work.
@@ -174,6 +184,7 @@ Terraform version 0.10.3 or newer is required for this module to work.
* Few tests and edge cases examples: [#46](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/issue-46-no-private-subnets), [#44](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/issue-44-asymmetric-private-subnets), [#108](https://github.com/terraform-aws-modules/terraform-aws-vpc/tree/master/examples/issue-108-route-already-exists)
178
189
179
190
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
@@ -194,11 +205,19 @@ Terraform version 0.10.3 or newer is required for this module to work.
194
205
| create\_redshift\_subnet\_group | Controls if redshift subnet group should be created | string |`"true"`| no |
195
206
| create\_redshift\_subnet\_route\_table | Controls if separate route table for redshift should be created | string |`"false"`| no |
196
207
| create\_vpc | Controls if VPC should be created (it affects almost all resources) | string |`"true"`| no |
208
+
| database\_acl\_tags | Additional tags for the database subnets network ACL | map |`{}`| no |
209
+
| database\_dedicated\_network\_acl | Whether to use dedicated network ACL (not default) and custom rules for database subnets | string |`"false"`| no |
| database\_route\_table\_tags | Additional tags for the database route tables | map |`{}`| no |
198
213
| database\_subnet\_group\_tags | Additional tags for the database subnet group | map |`{}`| no |
199
214
| database\_subnet\_suffix | Suffix to append to database subnets name | string |`"db"`| no |
200
215
| database\_subnet\_tags | Additional tags for the database subnets | map |`{}`| no |
201
216
| database\_subnets | A list of database subnets | list |`[]`| no |
217
+
| default\_network\_acl\_egress | List of maps of egress rules to set on the Default Network ACL | list |`[ { "action": "allow", "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_no": 100, "to_port": 0 }, { "action": "allow", "from_port": 0, "ipv6_cidr_block": "::/0", "protocol": "-1", "rule_no": 101, "to_port": 0 } ]`| no |
218
+
| default\_network\_acl\_ingress | List of maps of ingress rules to set on the Default Network ACL | list |`[ { "action": "allow", "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_no": 100, "to_port": 0 }, { "action": "allow", "from_port": 0, "ipv6_cidr_block": "::/0", "protocol": "-1", "rule_no": 101, "to_port": 0 } ]`| no |
219
+
| default\_network\_acl\_name | Name to be used on the Default Network ACL | string |`""`| no |
220
+
| default\_network\_acl\_tags | Additional tags for the Default Network ACL | map |`{}`| no |
202
221
| default\_vpc\_enable\_classiclink | Should be true to enable ClassicLink in the Default VPC | string |`"false"`| no |
203
222
| default\_vpc\_enable\_dns\_hostnames | Should be true to enable DNS hostnames in the Default VPC | string |`"false"`| no |
204
223
| default\_vpc\_enable\_dns\_support | Should be true to enable DNS support in the Default VPC | string |`"true"`| no |
@@ -222,6 +241,10 @@ Terraform version 0.10.3 or newer is required for this module to work.
222
241
| ecr\_dkr\_endpoint\_private\_dns\_enabled | Whether or not to associate a private hosted zone with the specified VPC for ECR DKR endpoint | string |`"false"`| no |
223
242
| ecr\_dkr\_endpoint\_security\_group\_ids | The ID of one or more security groups to associate with the network interface for ECR DKR endpoint | list |`[]`| no |
224
243
| ecr\_dkr\_endpoint\_subnet\_ids | The ID of one or more subnets in which to create a network interface for ECR dkr endpoint. If omitted, private subnets will be used. | list |`[]`| no |
244
+
| elasticache\_acl\_tags | Additional tags for the elasticache subnets network ACL | map |`{}`| no |
245
+
| elasticache\_dedicated\_network\_acl | Whether to use dedicated network ACL (not default) and custom rules for elasticache subnets | string |`"false"`| no |
| elasticache\_route\_table\_tags | Additional tags for the elasticache route tables | map |`{}`| no |
226
249
| elasticache\_subnet\_suffix | Suffix to append to elasticache subnets name | string |`"elasticache"`| no |
227
250
| elasticache\_subnet\_tags | Additional tags for the elasticache subnets | map |`{}`| no |
@@ -242,25 +265,43 @@ Terraform version 0.10.3 or newer is required for this module to work.
242
265
| external\_nat\_ip\_ids | List of EIP IDs to be assigned to the NAT Gateways (used in combination with reuse_nat_ips) | list |`[]`| no |
243
266
| igw\_tags | Additional tags for the internet gateway | map |`{}`| no |
244
267
| instance\_tenancy | A tenancy option for instances launched into the VPC | string |`"default"`| no |
268
+
| intra\_acl\_tags | Additional tags for the intra subnets network ACL | map |`{}`| no |
269
+
| intra\_dedicated\_network\_acl | Whether to use dedicated network ACL (not default) and custom rules for intra subnets | string |`"false"`| no |
270
+
| intra\_inbound\_acl\_rules | Intra subnets inbound network ACLs | list |`[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ]`| no |
271
+
| intra\_outbound\_acl\_rules | Intra subnets outbound network ACLs | list |`[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ]`| no |
245
272
| intra\_route\_table\_tags | Additional tags for the intra route tables | map |`{}`| no |
273
+
| intra\_subnet\_suffix | Suffix to append to intra subnets name | string |`"intra"`| no |
246
274
| intra\_subnet\_tags | Additional tags for the intra subnets | map |`{}`| no |
247
275
| intra\_subnets | A list of intra subnets | list |`[]`| no |
276
+
| manage\_default\_network\_acl | Should be true to adopt and manage Default Network ACL | string |`"false"`| no |
248
277
| manage\_default\_vpc | Should be true to adopt and manage Default VPC | string |`"false"`| no |
249
278
| map\_public\_ip\_on\_launch | Should be false if you do not want to auto-assign public IP on launch | string |`"true"`| no |
250
279
| name | Name to be used on all the resources as identifier | string |`""`| no |
251
280
| nat\_eip\_tags | Additional tags for the NAT EIP | map |`{}`| no |
252
281
| nat\_gateway\_tags | Additional tags for the NAT gateways | map |`{}`| no |
253
282
| one\_nat\_gateway\_per\_az | Should be true if you want only one NAT Gateway per availability zone. Requires `var.azs` to be set, and the number of `public_subnets` created to be greater than or equal to the number of availability zones specified in `var.azs`. | string |`"false"`| no |
283
+
| private\_acl\_tags | Additional tags for the private subnets network ACL | map |`{}`| no |
284
+
| private\_dedicated\_network\_acl | Whether to use dedicated network ACL (not default) and custom rules for private subnets | string |`"false"`| no |
| private\_route\_table\_tags | Additional tags for the private route tables | map |`{}`| no |
255
288
| private\_subnet\_suffix | Suffix to append to private subnets name | string |`"private"`| no |
256
289
| private\_subnet\_tags | Additional tags for the private subnets | map |`{}`| no |
257
290
| private\_subnets | A list of private subnets inside the VPC | list |`[]`| no |
258
291
| propagate\_private\_route\_tables\_vgw | Should be true if you want route table propagation | string |`"false"`| no |
259
292
| propagate\_public\_route\_tables\_vgw | Should be true if you want route table propagation | string |`"false"`| no |
293
+
| public\_acl\_tags | Additional tags for the public subnets network ACL | map |`{}`| no |
294
+
| public\_dedicated\_network\_acl | Whether to use dedicated network ACL (not default) and custom rules for public subnets | string |`"false"`| no |
295
+
| public\_inbound\_acl\_rules | Public subnets inbound network ACLs | list |`[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ]`| no |
296
+
| public\_outbound\_acl\_rules | Public subnets outbound network ACLs | list |`[ { "cidr_block": "0.0.0.0/0", "from_port": 0, "protocol": "-1", "rule_action": "allow", "rule_number": 100, "to_port": 0 } ]`| no |
260
297
| public\_route\_table\_tags | Additional tags for the public route tables | map |`{}`| no |
261
298
| public\_subnet\_suffix | Suffix to append to public subnets name | string |`"public"`| no |
262
299
| public\_subnet\_tags | Additional tags for the public subnets | map |`{}`| no |
263
300
| public\_subnets | A list of public subnets inside the VPC | list |`[]`| no |
301
+
| redshift\_acl\_tags | Additional tags for the redshift subnets network ACL | map |`{}`| no |
302
+
| redshift\_dedicated\_network\_acl | Whether to use dedicated network ACL (not default) and custom rules for redshift subnets | string |`"false"`| no |
Copy file name to clipboardExpand all lines: examples/network-acls/README.md
+15-7Lines changed: 15 additions & 7 deletions
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,12 @@
2
2
3
3
Configuration in this directory creates set of VPC resources along with network ACLs for public subnets.
4
4
5
-
There is a public and private subnet created per availability zone in addition to single NAT Gateway shared between all 3 availability zones. Network ACL rules for inbound and outbound traffic are defined.
5
+
There is a public and private subnet created per availability zone in addition to single NAT Gateway shared between all 3 availability zones.
6
+
7
+
Network ACL rules for inbound and outbound traffic are defined as the following:
8
+
1. Public subnets will have network ACL rules provided
9
+
1. Private subnets will be associated with the default network ACL rules (IPV4-only ingress and egress is open for all)
10
+
1. Elasticache subnets will use the default network ACL (created and managed by AWS)
6
11
7
12
## Usage
8
13
@@ -17,15 +22,18 @@ $ terraform apply
17
22
Note that this example may create resources which can cost money (AWS Elastic IP, for example). Run `terraform destroy` when you don't need these resources.
18
23
19
24
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
20
-
21
25
## Outputs
22
26
23
27
| Name | Description |
24
28
|------|-------------|
25
-
| nat_public_ips | NAT gateways |
26
-
| private_subnets | Subnets |
27
-
| public_subnets | List of IDs of public subnets |
28
-
| vpc_cidr_block | CIDR blocks |
29
-
| vpc_id | VPC |
29
+
| default\_network\_acl\_id | The ID of the default network ACL |
30
+
| elasticache\_network\_acl\_id | ID of the elasticache network ACL |
31
+
| nat\_public\_ips | List of public Elastic IPs created for AWS NAT Gateway |
32
+
| private\_network\_acl\_id | ID of the private network ACL |
33
+
| private\_subnets | List of IDs of private subnets |
34
+
| public\_network\_acl\_id | ID of the public network ACL |
35
+
| public\_subnets | List of IDs of public subnets |
0 commit comments