Skip to content

Commit ec228e0

Browse files
baszoetekouwantonbabenko
baszoetekouw
authored and
antonbabenko
committed
Added support for ipv6_cidr_block in network acls (terraform-aws-modules#329)
Add support for `ipv6_cidr_block` in `*_{in|out}bound_acl_rules`. As a conseqeunce, the (ipv4) `cidr_block` is made optional.
1 parent 4a91495 commit ec228e0

File tree

1 file changed

+120
-108
lines changed

1 file changed

+120
-108
lines changed

‎main.tf

Lines changed: 120 additions & 108 deletions
Original file line numberDiff line numberDiff line change
@@ -547,31 +547,33 @@ resource "aws_network_acl_rule" "public_inbound" {
547547

548548
network_acl_id = aws_network_acl.public[0].id
549549

550-
egress = false
551-
rule_number = var.public_inbound_acl_rules[count.index]["rule_number"]
552-
rule_action = var.public_inbound_acl_rules[count.index]["rule_action"]
553-
from_port = lookup(var.public_inbound_acl_rules[count.index], "from_port", null)
554-
to_port = lookup(var.public_inbound_acl_rules[count.index], "to_port", null)
555-
icmp_code = lookup(var.public_inbound_acl_rules[count.index], "icmp_code", null)
556-
icmp_type = lookup(var.public_inbound_acl_rules[count.index], "icmp_type", null)
557-
protocol = var.public_inbound_acl_rules[count.index]["protocol"]
558-
cidr_block = var.public_inbound_acl_rules[count.index]["cidr_block"]
550+
egress = false
551+
rule_number = var.public_inbound_acl_rules[count.index]["rule_number"]
552+
rule_action = var.public_inbound_acl_rules[count.index]["rule_action"]
553+
from_port = lookup(var.public_inbound_acl_rules[count.index], "from_port", null)
554+
to_port = lookup(var.public_inbound_acl_rules[count.index], "to_port", null)
555+
icmp_code = lookup(var.public_inbound_acl_rules[count.index], "icmp_code", null)
556+
icmp_type = lookup(var.public_inbound_acl_rules[count.index], "icmp_type", null)
557+
protocol = var.public_inbound_acl_rules[count.index]["protocol"]
558+
cidr_block = lookup(var.public_inbound_acl_rules[count.index], "cidr_block", null)
559+
ipv6_cidr_block = lookup(var.public_inbound_acl_rules[count.index], "ipv6_cidr_block", null)
559560
}
560561

561562
resource "aws_network_acl_rule" "public_outbound" {
562563
count = var.create_vpc && var.public_dedicated_network_acl && length(var.public_subnets) > 0 ? length(var.public_outbound_acl_rules) : 0
563564

564565
network_acl_id = aws_network_acl.public[0].id
565566

566-
egress = true
567-
rule_number = var.public_outbound_acl_rules[count.index]["rule_number"]
568-
rule_action = var.public_outbound_acl_rules[count.index]["rule_action"]
569-
from_port = lookup(var.public_outbound_acl_rules[count.index], "from_port", null)
570-
to_port = lookup(var.public_outbound_acl_rules[count.index], "to_port", null)
571-
icmp_code = lookup(var.public_outbound_acl_rules[count.index], "icmp_code", null)
572-
icmp_type = lookup(var.public_outbound_acl_rules[count.index], "icmp_type", null)
573-
protocol = var.public_outbound_acl_rules[count.index]["protocol"]
574-
cidr_block = var.public_outbound_acl_rules[count.index]["cidr_block"]
567+
egress = true
568+
rule_number = var.public_outbound_acl_rules[count.index]["rule_number"]
569+
rule_action = var.public_outbound_acl_rules[count.index]["rule_action"]
570+
from_port = lookup(var.public_outbound_acl_rules[count.index], "from_port", null)
571+
to_port = lookup(var.public_outbound_acl_rules[count.index], "to_port", null)
572+
icmp_code = lookup(var.public_outbound_acl_rules[count.index], "icmp_code", null)
573+
icmp_type = lookup(var.public_outbound_acl_rules[count.index], "icmp_type", null)
574+
protocol = var.public_outbound_acl_rules[count.index]["protocol"]
575+
cidr_block = lookup(var.public_outbound_acl_rules[count.index], "cidr_block", null)
576+
ipv6_cidr_block = lookup(var.public_outbound_acl_rules[count.index], "ipv6_cidr_block", null)
575577
}
576578

577579
#######################
@@ -597,31 +599,33 @@ resource "aws_network_acl_rule" "private_inbound" {
597599

598600
network_acl_id = aws_network_acl.private[0].id
599601

600-
egress = false
601-
rule_number = var.private_inbound_acl_rules[count.index]["rule_number"]
602-
rule_action = var.private_inbound_acl_rules[count.index]["rule_action"]
603-
from_port = lookup(var.private_inbound_acl_rules[count.index], "from_port", null)
604-
to_port = lookup(var.private_inbound_acl_rules[count.index], "to_port", null)
605-
icmp_code = lookup(var.private_inbound_acl_rules[count.index], "icmp_code", null)
606-
icmp_type = lookup(var.private_inbound_acl_rules[count.index], "icmp_type", null)
607-
protocol = var.private_inbound_acl_rules[count.index]["protocol"]
608-
cidr_block = var.private_inbound_acl_rules[count.index]["cidr_block"]
602+
egress = false
603+
rule_number = var.private_inbound_acl_rules[count.index]["rule_number"]
604+
rule_action = var.private_inbound_acl_rules[count.index]["rule_action"]
605+
from_port = lookup(var.private_inbound_acl_rules[count.index], "from_port", null)
606+
to_port = lookup(var.private_inbound_acl_rules[count.index], "to_port", null)
607+
icmp_code = lookup(var.private_inbound_acl_rules[count.index], "icmp_code", null)
608+
icmp_type = lookup(var.private_inbound_acl_rules[count.index], "icmp_type", null)
609+
protocol = var.private_inbound_acl_rules[count.index]["protocol"]
610+
cidr_block = lookup(var.private_inbound_acl_rules[count.index], "cidr_block", null)
611+
ipv6_cidr_block = lookup(var.private_inbound_acl_rules[count.index], "ipv6_cidr_block", null)
609612
}
610613

611614
resource "aws_network_acl_rule" "private_outbound" {
612615
count = var.create_vpc && var.private_dedicated_network_acl && length(var.private_subnets) > 0 ? length(var.private_outbound_acl_rules) : 0
613616

614617
network_acl_id = aws_network_acl.private[0].id
615618

616-
egress = true
617-
rule_number = var.private_outbound_acl_rules[count.index]["rule_number"]
618-
rule_action = var.private_outbound_acl_rules[count.index]["rule_action"]
619-
from_port = lookup(var.private_outbound_acl_rules[count.index], "from_port", null)
620-
to_port = lookup(var.private_outbound_acl_rules[count.index], "to_port", null)
621-
icmp_code = lookup(var.private_outbound_acl_rules[count.index], "icmp_code", null)
622-
icmp_type = lookup(var.private_outbound_acl_rules[count.index], "icmp_type", null)
623-
protocol = var.private_outbound_acl_rules[count.index]["protocol"]
624-
cidr_block = var.private_outbound_acl_rules[count.index]["cidr_block"]
619+
egress = true
620+
rule_number = var.private_outbound_acl_rules[count.index]["rule_number"]
621+
rule_action = var.private_outbound_acl_rules[count.index]["rule_action"]
622+
from_port = lookup(var.private_outbound_acl_rules[count.index], "from_port", null)
623+
to_port = lookup(var.private_outbound_acl_rules[count.index], "to_port", null)
624+
icmp_code = lookup(var.private_outbound_acl_rules[count.index], "icmp_code", null)
625+
icmp_type = lookup(var.private_outbound_acl_rules[count.index], "icmp_type", null)
626+
protocol = var.private_outbound_acl_rules[count.index]["protocol"]
627+
cidr_block = lookup(var.private_outbound_acl_rules[count.index], "cidr_block", null)
628+
ipv6_cidr_block = lookup(var.private_outbound_acl_rules[count.index], "ipv6_cidr_block", null)
625629
}
626630

627631
########################
@@ -647,31 +651,33 @@ resource "aws_network_acl_rule" "intra_inbound" {
647651

648652
network_acl_id = aws_network_acl.intra[0].id
649653

650-
egress = false
651-
rule_number = var.intra_inbound_acl_rules[count.index]["rule_number"]
652-
rule_action = var.intra_inbound_acl_rules[count.index]["rule_action"]
653-
from_port = lookup(var.intra_inbound_acl_rules[count.index], "from_port", null)
654-
to_port = lookup(var.intra_inbound_acl_rules[count.index], "to_port", null)
655-
icmp_code = lookup(var.intra_inbound_acl_rules[count.index], "icmp_code", null)
656-
icmp_type = lookup(var.intra_inbound_acl_rules[count.index], "icmp_type", null)
657-
protocol = var.intra_inbound_acl_rules[count.index]["protocol"]
658-
cidr_block = var.intra_inbound_acl_rules[count.index]["cidr_block"]
654+
egress = false
655+
rule_number = var.intra_inbound_acl_rules[count.index]["rule_number"]
656+
rule_action = var.intra_inbound_acl_rules[count.index]["rule_action"]
657+
from_port = lookup(var.intra_inbound_acl_rules[count.index], "from_port", null)
658+
to_port = lookup(var.intra_inbound_acl_rules[count.index], "to_port", null)
659+
icmp_code = lookup(var.intra_inbound_acl_rules[count.index], "icmp_code", null)
660+
icmp_type = lookup(var.intra_inbound_acl_rules[count.index], "icmp_type", null)
661+
protocol = var.intra_inbound_acl_rules[count.index]["protocol"]
662+
cidr_block = lookup(var.intra_inbound_acl_rules[count.index], "cidr_block", null)
663+
ipv6_cidr_block = lookup(var.intra_inbound_acl_rules[count.index], "ipv6_cidr_block", null)
659664
}
660665

661666
resource "aws_network_acl_rule" "intra_outbound" {
662667
count = var.create_vpc && var.intra_dedicated_network_acl && length(var.intra_subnets) > 0 ? length(var.intra_outbound_acl_rules) : 0
663668

664669
network_acl_id = aws_network_acl.intra[0].id
665670

666-
egress = true
667-
rule_number = var.intra_outbound_acl_rules[count.index]["rule_number"]
668-
rule_action = var.intra_outbound_acl_rules[count.index]["rule_action"]
669-
from_port = lookup(var.intra_outbound_acl_rules[count.index], "from_port", null)
670-
to_port = lookup(var.intra_outbound_acl_rules[count.index], "to_port", null)
671-
icmp_code = lookup(var.intra_outbound_acl_rules[count.index], "icmp_code", null)
672-
icmp_type = lookup(var.intra_outbound_acl_rules[count.index], "icmp_type", null)
673-
protocol = var.intra_outbound_acl_rules[count.index]["protocol"]
674-
cidr_block = var.intra_outbound_acl_rules[count.index]["cidr_block"]
671+
egress = true
672+
rule_number = var.intra_outbound_acl_rules[count.index]["rule_number"]
673+
rule_action = var.intra_outbound_acl_rules[count.index]["rule_action"]
674+
from_port = lookup(var.intra_outbound_acl_rules[count.index], "from_port", null)
675+
to_port = lookup(var.intra_outbound_acl_rules[count.index], "to_port", null)
676+
icmp_code = lookup(var.intra_outbound_acl_rules[count.index], "icmp_code", null)
677+
icmp_type = lookup(var.intra_outbound_acl_rules[count.index], "icmp_type", null)
678+
protocol = var.intra_outbound_acl_rules[count.index]["protocol"]
679+
cidr_block = lookup(var.intra_outbound_acl_rules[count.index], "cidr_block", null)
680+
ipv6_cidr_block = lookup(var.intra_outbound_acl_rules[count.index], "ipv6_cidr_block", null)
675681
}
676682

677683
########################
@@ -697,31 +703,33 @@ resource "aws_network_acl_rule" "database_inbound" {
697703

698704
network_acl_id = aws_network_acl.database[0].id
699705

700-
egress = false
701-
rule_number = var.database_inbound_acl_rules[count.index]["rule_number"]
702-
rule_action = var.database_inbound_acl_rules[count.index]["rule_action"]
703-
from_port = lookup(var.database_inbound_acl_rules[count.index], "from_port", null)
704-
to_port = lookup(var.database_inbound_acl_rules[count.index], "to_port", null)
705-
icmp_code = lookup(var.database_inbound_acl_rules[count.index], "icmp_code", null)
706-
icmp_type = lookup(var.database_inbound_acl_rules[count.index], "icmp_type", null)
707-
protocol = var.database_inbound_acl_rules[count.index]["protocol"]
708-
cidr_block = var.database_inbound_acl_rules[count.index]["cidr_block"]
706+
egress = false
707+
rule_number = var.database_inbound_acl_rules[count.index]["rule_number"]
708+
rule_action = var.database_inbound_acl_rules[count.index]["rule_action"]
709+
from_port = lookup(var.database_inbound_acl_rules[count.index], "from_port", null)
710+
to_port = lookup(var.database_inbound_acl_rules[count.index], "to_port", null)
711+
icmp_code = lookup(var.database_inbound_acl_rules[count.index], "icmp_code", null)
712+
icmp_type = lookup(var.database_inbound_acl_rules[count.index], "icmp_type", null)
713+
protocol = var.database_inbound_acl_rules[count.index]["protocol"]
714+
cidr_block = lookup(var.database_inbound_acl_rules[count.index], "cidr_block", null)
715+
ipv6_cidr_block = lookup(var.database_inbound_acl_rules[count.index], "ipv6_cidr_block", null)
709716
}
710717

711718
resource "aws_network_acl_rule" "database_outbound" {
712719
count = var.create_vpc && var.database_dedicated_network_acl && length(var.database_subnets) > 0 ? length(var.database_outbound_acl_rules) : 0
713720

714721
network_acl_id = aws_network_acl.database[0].id
715722

716-
egress = true
717-
rule_number = var.database_outbound_acl_rules[count.index]["rule_number"]
718-
rule_action = var.database_outbound_acl_rules[count.index]["rule_action"]
719-
from_port = lookup(var.database_outbound_acl_rules[count.index], "from_port", null)
720-
to_port = lookup(var.database_outbound_acl_rules[count.index], "to_port", null)
721-
icmp_code = lookup(var.database_outbound_acl_rules[count.index], "icmp_code", null)
722-
icmp_type = lookup(var.database_outbound_acl_rules[count.index], "icmp_type", null)
723-
protocol = var.database_outbound_acl_rules[count.index]["protocol"]
724-
cidr_block = var.database_outbound_acl_rules[count.index]["cidr_block"]
723+
egress = true
724+
rule_number = var.database_outbound_acl_rules[count.index]["rule_number"]
725+
rule_action = var.database_outbound_acl_rules[count.index]["rule_action"]
726+
from_port = lookup(var.database_outbound_acl_rules[count.index], "from_port", null)
727+
to_port = lookup(var.database_outbound_acl_rules[count.index], "to_port", null)
728+
icmp_code = lookup(var.database_outbound_acl_rules[count.index], "icmp_code", null)
729+
icmp_type = lookup(var.database_outbound_acl_rules[count.index], "icmp_type", null)
730+
protocol = var.database_outbound_acl_rules[count.index]["protocol"]
731+
cidr_block = lookup(var.database_outbound_acl_rules[count.index], "cidr_block", null)
732+
ipv6_cidr_block = lookup(var.database_outbound_acl_rules[count.index], "ipv6_cidr_block", null)
725733
}
726734

727735
########################
@@ -747,31 +755,33 @@ resource "aws_network_acl_rule" "redshift_inbound" {
747755

748756
network_acl_id = aws_network_acl.redshift[0].id
749757

750-
egress = false
751-
rule_number = var.redshift_inbound_acl_rules[count.index]["rule_number"]
752-
rule_action = var.redshift_inbound_acl_rules[count.index]["rule_action"]
753-
from_port = lookup(var.redshift_inbound_acl_rules[count.index], "from_port", null)
754-
to_port = lookup(var.redshift_inbound_acl_rules[count.index], "to_port", null)
755-
icmp_code = lookup(var.redshift_inbound_acl_rules[count.index], "icmp_code", null)
756-
icmp_type = lookup(var.redshift_inbound_acl_rules[count.index], "icmp_type", null)
757-
protocol = var.redshift_inbound_acl_rules[count.index]["protocol"]
758-
cidr_block = var.redshift_inbound_acl_rules[count.index]["cidr_block"]
758+
egress = false
759+
rule_number = var.redshift_inbound_acl_rules[count.index]["rule_number"]
760+
rule_action = var.redshift_inbound_acl_rules[count.index]["rule_action"]
761+
from_port = lookup(var.redshift_inbound_acl_rules[count.index], "from_port", null)
762+
to_port = lookup(var.redshift_inbound_acl_rules[count.index], "to_port", null)
763+
icmp_code = lookup(var.redshift_inbound_acl_rules[count.index], "icmp_code", null)
764+
icmp_type = lookup(var.redshift_inbound_acl_rules[count.index], "icmp_type", null)
765+
protocol = var.redshift_inbound_acl_rules[count.index]["protocol"]
766+
cidr_block = lookup(var.redshift_inbound_acl_rules[count.index], "cidr_block", null)
767+
ipv6_cidr_block = lookup(var.redshift_inbound_acl_rules[count.index], "ipv6_cidr_block", null)
759768
}
760769

761770
resource "aws_network_acl_rule" "redshift_outbound" {
762771
count = var.create_vpc && var.redshift_dedicated_network_acl && length(var.redshift_subnets) > 0 ? length(var.redshift_outbound_acl_rules) : 0
763772

764773
network_acl_id = aws_network_acl.redshift[0].id
765774

766-
egress = true
767-
rule_number = var.redshift_outbound_acl_rules[count.index]["rule_number"]
768-
rule_action = var.redshift_outbound_acl_rules[count.index]["rule_action"]
769-
from_port = lookup(var.redshift_outbound_acl_rules[count.index], "from_port", null)
770-
to_port = lookup(var.redshift_outbound_acl_rules[count.index], "to_port", null)
771-
icmp_code = lookup(var.redshift_outbound_acl_rules[count.index], "icmp_code", null)
772-
icmp_type = lookup(var.redshift_outbound_acl_rules[count.index], "icmp_type", null)
773-
protocol = var.redshift_outbound_acl_rules[count.index]["protocol"]
774-
cidr_block = var.redshift_outbound_acl_rules[count.index]["cidr_block"]
775+
egress = true
776+
rule_number = var.redshift_outbound_acl_rules[count.index]["rule_number"]
777+
rule_action = var.redshift_outbound_acl_rules[count.index]["rule_action"]
778+
from_port = lookup(var.redshift_outbound_acl_rules[count.index], "from_port", null)
779+
to_port = lookup(var.redshift_outbound_acl_rules[count.index], "to_port", null)
780+
icmp_code = lookup(var.redshift_outbound_acl_rules[count.index], "icmp_code", null)
781+
icmp_type = lookup(var.redshift_outbound_acl_rules[count.index], "icmp_type", null)
782+
protocol = var.redshift_outbound_acl_rules[count.index]["protocol"]
783+
cidr_block = lookup(var.redshift_outbound_acl_rules[count.index], "cidr_block", null)
784+
ipv6_cidr_block = lookup(var.redshift_outbound_acl_rules[count.index], "ipv6_cidr_block", null)
775785
}
776786

777787
###########################
@@ -797,31 +807,33 @@ resource "aws_network_acl_rule" "elasticache_inbound" {
797807

798808
network_acl_id = aws_network_acl.elasticache[0].id
799809

800-
egress = false
801-
rule_number = var.elasticache_inbound_acl_rules[count.index]["rule_number"]
802-
rule_action = var.elasticache_inbound_acl_rules[count.index]["rule_action"]
803-
from_port = lookup(var.elasticache_inbound_acl_rules[count.index], "from_port", null)
804-
to_port = lookup(var.elasticache_inbound_acl_rules[count.index], "to_port", null)
805-
icmp_code = lookup(var.elasticache_inbound_acl_rules[count.index], "icmp_code", null)
806-
icmp_type = lookup(var.elasticache_inbound_acl_rules[count.index], "icmp_type", null)
807-
protocol = var.elasticache_inbound_acl_rules[count.index]["protocol"]
808-
cidr_block = var.elasticache_inbound_acl_rules[count.index]["cidr_block"]
810+
egress = false
811+
rule_number = var.elasticache_inbound_acl_rules[count.index]["rule_number"]
812+
rule_action = var.elasticache_inbound_acl_rules[count.index]["rule_action"]
813+
from_port = lookup(var.elasticache_inbound_acl_rules[count.index], "from_port", null)
814+
to_port = lookup(var.elasticache_inbound_acl_rules[count.index], "to_port", null)
815+
icmp_code = lookup(var.elasticache_inbound_acl_rules[count.index], "icmp_code", null)
816+
icmp_type = lookup(var.elasticache_inbound_acl_rules[count.index], "icmp_type", null)
817+
protocol = var.elasticache_inbound_acl_rules[count.index]["protocol"]
818+
cidr_block = lookup(var.elasticache_inbound_acl_rules[count.index], "cidr_block", null)
819+
ipv6_cidr_block = lookup(var.elasticache_inbound_acl_rules[count.index], "ipv6_cidr_block", null)
809820
}
810821

811822
resource "aws_network_acl_rule" "elasticache_outbound" {
812823
count = var.create_vpc && var.elasticache_dedicated_network_acl && length(var.elasticache_subnets) > 0 ? length(var.elasticache_outbound_acl_rules) : 0
813824

814825
network_acl_id = aws_network_acl.elasticache[0].id
815826

816-
egress = true
817-
rule_number = var.elasticache_outbound_acl_rules[count.index]["rule_number"]
818-
rule_action = var.elasticache_outbound_acl_rules[count.index]["rule_action"]
819-
from_port = lookup(var.elasticache_outbound_acl_rules[count.index], "from_port", null)
820-
to_port = lookup(var.elasticache_outbound_acl_rules[count.index], "to_port", null)
821-
icmp_code = lookup(var.elasticache_outbound_acl_rules[count.index], "icmp_code", null)
822-
icmp_type = lookup(var.elasticache_outbound_acl_rules[count.index], "icmp_type", null)
823-
protocol = var.elasticache_outbound_acl_rules[count.index]["protocol"]
824-
cidr_block = var.elasticache_outbound_acl_rules[count.index]["cidr_block"]
827+
egress = true
828+
rule_number = var.elasticache_outbound_acl_rules[count.index]["rule_number"]
829+
rule_action = var.elasticache_outbound_acl_rules[count.index]["rule_action"]
830+
from_port = lookup(var.elasticache_outbound_acl_rules[count.index], "from_port", null)
831+
to_port = lookup(var.elasticache_outbound_acl_rules[count.index], "to_port", null)
832+
icmp_code = lookup(var.elasticache_outbound_acl_rules[count.index], "icmp_code", null)
833+
icmp_type = lookup(var.elasticache_outbound_acl_rules[count.index], "icmp_type", null)
834+
protocol = var.elasticache_outbound_acl_rules[count.index]["protocol"]
835+
cidr_block = lookup(var.elasticache_outbound_acl_rules[count.index], "cidr_block", null)
836+
ipv6_cidr_block = lookup(var.elasticache_outbound_acl_rules[count.index], "ipv6_cidr_block", null)
825837
}
826838

827839
##############

0 commit comments

Comments
 (0)