nacl

Creates Network ACLs with ingress and egress rules and subnet associations.

Provisions NACLs with numbered ingress and egress rules as separate managed resources, associates them with specified subnets, and supports all protocols including ICMP with type/code granularity.

Usage

module "nacl" {
  source  = "hcassc.jfrog.io/iac-tf-modules-virtual__networking/nacl/aws"
  version = "0.1.0"

  vpc_id = module.vpc.id

  network_acls = {
    private = {
      name       = "private-nacl"
      subnet_ids = module.vpc.private_subnet_id_list
      ingress_rules = [
        { rule_number = 100, action = "allow", protocol = "-1", cidr_block = "10.0.0.0/8" },
        { rule_number = 32766, action = "deny", protocol = "-1", cidr_block = "0.0.0.0/0" },
      ]
      egress_rules = [
        { rule_number = 100, action = "allow", protocol = "-1", cidr_block = "0.0.0.0/0" },
      ]
    }
  }
}

Requirements

Name	Version
terraform	>= 1.15.0, < 2.0.0
aws	>= 6.0, < 7.0

Providers

Name	Version
aws	>= 6.0, < 7.0

Resources

Name	Type
aws_network_acl.this	resource
aws_network_acl_rule.egress	resource
aws_network_acl_rule.ingress	resource

Inputs

Name	Description	Type	Default	Required
name_prefix	Prefix prepended to resource names created by this module	string	n/a	yes
vpc_id	ID of the VPC to associate NACLs with	string	n/a	yes
network_acls	Map of NACLs to create. Each entry defines a NACL with its subnet associations and ingress/egress rules. The NACL name is generated from name_prefix.	map(object({ subnet_ids = list(string) ingress_rules = list(object({ rule_number = number action = string # allow or deny protocol = string # -1 for all, 6 for TCP, 17 for UDP, 1 for ICMP from_port = optional(number, 0) to_port = optional(number, 65535) cidr_block = optional(string, null) icmp_type = optional(number, null) # only when protocol = "1" icmp_code = optional(number, null) # only when protocol = "1" })) egress_rules = list(object({ rule_number = number action = string # allow or deny protocol = string # -1 for all, 6 for TCP, 17 for UDP, 1 for ICMP from_port = optional(number, 0) to_port = optional(number, 65535) cidr_block = optional(string, null) icmp_type = optional(number, null) # only when protocol = "1" icmp_code = optional(number, null) # only when protocol = "1" })) }))	{}	no
tags	Resource tags to apply to all resources	map(string)	{}	no

Outputs

Name	Description
nacl_arns	Map of NACL logical key to ARN
nacl_ids	Map of NACL logical key to ID