# nacl

Creates Network ACLs with ingress and egress rules and subnet associations.

Provisions NACLs with numbered ingress and egress rules as separate managed resources, associates them with specified subnets, and supports all protocols including ICMP with type/code granularity.

## Usage

```hcl
module "nacl" {
  source  = "hcassc.jfrog.io/iac-tf-modules-virtual__networking/nacl/aws"
  version = "0.1.0"

  vpc_id = module.vpc.id

  network_acls = {
    private = {
      name       = "private-nacl"
      subnet_ids = module.vpc.private_subnet_id_list
      ingress_rules = [
        { rule_number = 100, action = "allow", protocol = "-1", cidr_block = "10.0.0.0/8" },
        { rule_number = 32766, action = "deny", protocol = "-1", cidr_block = "0.0.0.0/0" },
      ]
      egress_rules = [
        { rule_number = 100, action = "allow", protocol = "-1", cidr_block = "0.0.0.0/0" },
      ]
    }
  }
}
```

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->

## Requirements

| Name                                                                     | Version            |
| ------------------------------------------------------------------------ | ------------------ |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | >= 1.15.0, < 2.0.0 |
| <a name="requirement_aws"></a> [aws](#requirement_aws)                   | >= 6.0, < 7.0      |

## Providers

| Name                                             | Version       |
| ------------------------------------------------ | ------------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | >= 6.0, < 7.0 |

## Resources

| Name                                                                                                                         | Type     |
| ---------------------------------------------------------------------------------------------------------------------------- | -------- |
| [aws_network_acl.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl)              | resource |
| [aws_network_acl_rule.egress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule)  | resource |
| [aws_network_acl_rule.ingress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl_rule) | resource |

## Inputs

| Name                                                                  | Description                                                                                                                                           | Type                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Default | Required |
| --------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | :------: |
| <a name="input_name_prefix"></a> [name_prefix](#input_name_prefix)    | Prefix prepended to resource names created by this module                                                                                             | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | n/a     |   yes    |
| <a name="input_vpc_id"></a> [vpc_id](#input_vpc_id)                   | ID of the VPC to associate NACLs with                                                                                                                 | `string`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | n/a     |   yes    |
| <a name="input_network_acls"></a> [network_acls](#input_network_acls) | Map of NACLs to create. Each entry defines a NACL with its subnet associations and ingress/egress rules. The NACL name is generated from name_prefix. | <pre>map(object({<br/> subnet_ids = list(string)<br/> ingress_rules = list(object({<br/> rule_number = number<br/> action = string # allow or deny<br/> protocol = string # -1 for all, 6 for TCP, 17 for UDP, 1 for ICMP<br/> from_port = optional(number, 0)<br/> to_port = optional(number, 65535)<br/> cidr_block = optional(string, null)<br/> icmp_type = optional(number, null) # only when protocol = "1"<br/> icmp_code = optional(number, null) # only when protocol = "1"<br/> }))<br/> egress_rules = list(object({<br/> rule_number = number<br/> action = string # allow or deny<br/> protocol = string # -1 for all, 6 for TCP, 17 for UDP, 1 for ICMP<br/> from_port = optional(number, 0)<br/> to_port = optional(number, 65535)<br/> cidr_block = optional(string, null)<br/> icmp_type = optional(number, null) # only when protocol = "1"<br/> icmp_code = optional(number, null) # only when protocol = "1"<br/> }))<br/> }))</pre> | `{}`    |    no    |
| <a name="input_tags"></a> [tags](#input_tags)                         | Resource tags to apply to all resources                                                                                                               | `map(string)`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `{}`    |    no    |

## Outputs

| Name                                                           | Description                    |
| -------------------------------------------------------------- | ------------------------------ |
| <a name="output_nacl_arns"></a> [nacl_arns](#output_nacl_arns) | Map of NACL logical key to ARN |
| <a name="output_nacl_ids"></a> [nacl_ids](#output_nacl_ids)    | Map of NACL logical key to ID  |

<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->