Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Resource aws_default_network_acl orphaned subnet_ids #530

Merged
merged 3 commits into from
Oct 21, 2020
Merged

fix: Resource aws_default_network_acl orphaned subnet_ids #530

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3c464cd
Adding mechanism to set subnet_ids on default network ACL to prevent …
Oct 20, 2020
6b8c2a3
Adding manage_default_network_acl specified as true to network_acls e…
Oct 20, 2020
a628509
Updated example a bit
antonbabenko Oct 21, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions examples/network-acls/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,11 @@ module "vpc" {
local.network_acls["elasticache_outbound"],
)

private_dedicated_network_acl = true
private_dedicated_network_acl = false
elasticache_dedicated_network_acl = true

manage_default_network_acl = true

enable_ipv6 = true

enable_nat_gateway = false
Expand Down Expand Up @@ -200,4 +202,3 @@ locals {
]
}
}

21 changes: 21 additions & 0 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -534,6 +534,27 @@ resource "aws_default_network_acl" "this" {

default_network_acl_id = element(concat(aws_vpc.this.*.default_network_acl_id, [""]), 0)

# The value of subnet_ids should be any subnet IDs that are not set as subnet_ids
# for any of the non-default network ACLs
subnet_ids = setsubtract(
compact(flatten([
aws_subnet.public.*.id,
aws_subnet.private.*.id,
aws_subnet.intra.*.id,
aws_subnet.database.*.id,
aws_subnet.redshift.*.id,
aws_subnet.elasticache.*.id,
])),
compact(flatten([
aws_network_acl.public.*.subnet_ids,
aws_network_acl.private.*.subnet_ids,
aws_network_acl.intra.*.subnet_ids,
aws_network_acl.database.*.subnet_ids,
aws_network_acl.redshift.*.subnet_ids,
aws_network_acl.elasticache.*.subnet_ids,
]))
)

dynamic "ingress" {
for_each = var.default_network_acl_ingress
content {
Expand Down