Skip to content

Commit 1643c7e

Browse files
RaphaelMacedonioRaphaelMacedonio
authored
Merge pull request #42 from DNXLabs/feature/network_summary
🔧 Add vpc_cidr_summ variable to reduce the number of NACL rules used
2 parents d7de81f + eea214d commit 1643c7e

6 files changed

+54
-30
lines changed

‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,7 @@ module "network" {
8989
| transit\_netnum\_offset | Start with this subnet for secure ones, plus number of AZs | `number` | `15` | no |
9090
| transit\_subnet | Create a transit subnet for VPC peering (only central account) | `bool` | `false` | no |
9191
| vpc\_cidr | Network CIDR for the VPC | `any` | n/a | yes |
92+
| vpc\_cidr\_summ | Define cidr used to summarize subnets by tier | `string` | `"/0"` | no |
9293
| vpc\_cidr\_transit | Network CIDR for Transit subnets | `string` | `"10.255.255.0/24"` | no |
9394
| vpc\_endpoint\_dynamodb\_gateway | Enable or disable VPC Endpoint for DynamoDB (Gateway) | `bool` | `true` | no |
9495
| vpc\_endpoint\_dynamodb\_policy | A policy to attach to the endpoint that controls access to the service | `string` | `" {

‎_variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,12 @@ variable "newbits" {
4040
description = "Number of bits to add to the vpc cidr when building subnets"
4141
}
4242

43+
variable "vpc_cidr_summ" {
44+
type = string
45+
default = "/0"
46+
description = "Define cidr used to summarize subnets by tier"
47+
}
48+
4349
variable "tags" {
4450
type = map(string)
4551
default = {}

‎nacl-private.tf

+17-12
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
locals {
2+
private_subnet_ip = split("/", element(aws_subnet.private.*.cidr_block, length(aws_subnet.private.*.cidr_block) - 1))[0]
3+
private_subnet_summary = var.vpc_cidr_summ != "/0" ? "${cidrhost("${local.private_subnet_ip}${var.vpc_cidr_summ}", 0)}${var.vpc_cidr_summ}" : aws_vpc.default.cidr_block
4+
}
5+
16
resource "aws_network_acl" "private" {
27
vpc_id = aws_vpc.default.id
38
subnet_ids = aws_subnet.private.*.id
@@ -83,73 +88,73 @@ resource "aws_network_acl_rule" "out_private_from_world_icmp" {
8388
}
8489

8590
resource "aws_network_acl_rule" "in_private_from_private" {
86-
count = length(aws_subnet.private.*.cidr_block)
91+
count = var.vpc_cidr_summ != "/0" ? 1 : length(aws_subnet.private.*.cidr_block)
8792
network_acl_id = aws_network_acl.private.id
8893
rule_number = count.index + 301
8994
egress = false
9095
protocol = -1
9196
rule_action = "allow"
92-
cidr_block = aws_subnet.private[count.index].cidr_block
97+
cidr_block = var.vpc_cidr_summ != "/0" ? local.private_subnet_summary : aws_subnet.private[count.index].cidr_block
9398
from_port = 0
9499
to_port = 0
95100
}
96101

97102
resource "aws_network_acl_rule" "out_private_from_private" {
98-
count = length(aws_subnet.private.*.cidr_block)
103+
count = var.vpc_cidr_summ != "/0" ? 1 : length(aws_subnet.private.*.cidr_block)
99104
network_acl_id = aws_network_acl.private.id
100105
rule_number = count.index + 301
101106
egress = true
102107
protocol = -1
103108
rule_action = "allow"
104-
cidr_block = aws_subnet.private[count.index].cidr_block
109+
cidr_block = var.vpc_cidr_summ != "/0" ? local.private_subnet_summary : aws_subnet.private[count.index].cidr_block
105110
from_port = 0
106111
to_port = 0
107112
}
108113

109114
resource "aws_network_acl_rule" "in_private_from_public" {
110-
count = length(aws_subnet.public.*.cidr_block)
115+
count = var.vpc_cidr_summ != "/0" ? 1 : length(aws_subnet.public.*.cidr_block)
111116
network_acl_id = aws_network_acl.private.id
112117
rule_number = count.index + 401
113118
egress = false
114119
protocol = -1
115120
rule_action = "allow"
116-
cidr_block = aws_subnet.public[count.index].cidr_block
121+
cidr_block = var.vpc_cidr_summ != "/0" ? local.public_subnet_summary : aws_subnet.public[count.index].cidr_block
117122
from_port = 0
118123
to_port = 0
119124
}
120125

121126
resource "aws_network_acl_rule" "out_private_from_public" {
122-
count = length(aws_subnet.public.*.cidr_block)
127+
count = var.vpc_cidr_summ != "/0" ? 1 : length(aws_subnet.public.*.cidr_block)
123128
network_acl_id = aws_network_acl.private.id
124129
rule_number = count.index + 401
125130
egress = true
126131
protocol = -1
127132
rule_action = "allow"
128-
cidr_block = aws_subnet.public[count.index].cidr_block
133+
cidr_block = var.vpc_cidr_summ != "/0" ? local.public_subnet_summary : aws_subnet.public[count.index].cidr_block
129134
from_port = 0
130135
to_port = 0
131136
}
132137

133138
resource "aws_network_acl_rule" "in_private_from_secure" {
134-
count = length(aws_subnet.secure.*.cidr_block)
139+
count = var.vpc_cidr_summ != "/0" ? 1 : length(aws_subnet.secure.*.cidr_block)
135140
network_acl_id = aws_network_acl.private.id
136141
rule_number = count.index + 501
137142
egress = false
138143
protocol = -1
139144
rule_action = "allow"
140-
cidr_block = aws_subnet.secure[count.index].cidr_block
145+
cidr_block = var.vpc_cidr_summ != "/0" ? local.secure_subnet_summary : aws_subnet.secure[count.index].cidr_block
141146
from_port = 0
142147
to_port = 0
143148
}
144149

145150
resource "aws_network_acl_rule" "out_private_from_secure" {
146-
count = length(aws_subnet.secure.*.cidr_block)
151+
count = var.vpc_cidr_summ != "/0" ? 1 : length(aws_subnet.secure.*.cidr_block)
147152
network_acl_id = aws_network_acl.private.id
148153
rule_number = count.index + 501
149154
egress = true
150155
protocol = -1
151156
rule_action = "allow"
152-
cidr_block = aws_subnet.secure[count.index].cidr_block
157+
cidr_block = var.vpc_cidr_summ != "/0" ? local.secure_subnet_summary : aws_subnet.secure[count.index].cidr_block
153158
from_port = 0
154159
to_port = 0
155160
}

‎nacl-public.tf

+6-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
locals {
2+
public_subnet_ip = split("/", element(aws_subnet.public.*.cidr_block, length(aws_subnet.public.*.cidr_block) - 1))[0]
3+
public_subnet_summary = var.vpc_cidr_summ != "/0" ? "${cidrhost("${local.public_subnet_ip}${var.vpc_cidr_summ}", 0)}${var.vpc_cidr_summ}" : aws_vpc.default.cidr_block
4+
}
15
resource "aws_network_acl" "public" {
26
vpc_id = aws_vpc.default.id
37
subnet_ids = aws_subnet.public.*.id
@@ -153,13 +157,13 @@ resource "aws_network_acl_rule" "out_public_icmp" {
153157
}
154158

155159
resource "aws_network_acl_rule" "in_public_from_private" {
156-
count = length(aws_subnet.private.*.cidr_block)
160+
count = var.vpc_cidr_summ != "/0" ? 1 : length(aws_subnet.private.*.cidr_block)
157161
network_acl_id = aws_network_acl.public.id
158162
rule_number = count.index + 601
159163
egress = false
160164
protocol = -1
161165
rule_action = "allow"
162-
cidr_block = aws_subnet.private[count.index].cidr_block
166+
cidr_block = var.vpc_cidr_summ != "/0" ? local.private_subnet_summary : aws_subnet.private[count.index].cidr_block
163167
from_port = 0
164168
to_port = 0
165169
}

‎nacl-secure.tf

+16-12
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
locals {
2+
secure_subnet_ip = split("/", element(aws_subnet.secure.*.cidr_block, length(aws_subnet.secure.*.cidr_block) - 1))[0]
3+
secure_subnet_summary = var.vpc_cidr_summ != "/0" ? "${cidrhost("${local.secure_subnet_ip}${var.vpc_cidr_summ}", 0)}${var.vpc_cidr_summ}" : aws_vpc.default.cidr_block
4+
}
15
resource "aws_network_acl" "secure" {
26
vpc_id = aws_vpc.default.id
37
subnet_ids = aws_subnet.secure.*.id
@@ -13,63 +17,63 @@ resource "aws_network_acl" "secure" {
1317
}
1418

1519
resource "aws_network_acl_rule" "in_secure_from_secure" {
16-
count = length(aws_subnet.secure.*.cidr_block)
20+
count = var.vpc_cidr_summ != "/0" ? 1 : length(aws_subnet.secure.*.cidr_block)
1721
network_acl_id = aws_network_acl.secure.id
1822
rule_number = count.index + 101
1923
egress = false
2024
protocol = -1
2125
rule_action = "allow"
22-
cidr_block = aws_subnet.secure[count.index].cidr_block
26+
cidr_block = var.vpc_cidr_summ != "/0" ? local.secure_subnet_summary : aws_subnet.secure[count.index].cidr_block
2327
}
2428

2529
resource "aws_network_acl_rule" "out_secure_to_secure" {
26-
count = length(aws_subnet.secure.*.cidr_block)
30+
count = var.vpc_cidr_summ != "/0" ? 1 : length(aws_subnet.secure.*.cidr_block)
2731
network_acl_id = aws_network_acl.secure.id
2832
rule_number = count.index + 1
2933
egress = true
3034
protocol = -1
3135
rule_action = "allow"
32-
cidr_block = aws_subnet.secure[count.index].cidr_block
36+
cidr_block = var.vpc_cidr_summ != "/0" ? local.secure_subnet_summary : aws_subnet.secure[count.index].cidr_block
3337
}
3438

3539
resource "aws_network_acl_rule" "in_secure_from_private" {
36-
count = length(aws_subnet.private.*.cidr_block)
40+
count = var.vpc_cidr_summ != "/0" ? 1 : length(aws_subnet.private.*.cidr_block)
3741
network_acl_id = aws_network_acl.secure.id
3842
rule_number = count.index + 201
3943
egress = false
4044
protocol = -1
4145
rule_action = "allow"
42-
cidr_block = aws_subnet.private[count.index].cidr_block
46+
cidr_block = var.vpc_cidr_summ != "/0" ? local.private_subnet_summary : aws_subnet.private[count.index].cidr_block
4347
}
4448

4549
resource "aws_network_acl_rule" "out_secure_to_private" {
46-
count = length(aws_subnet.private.*.cidr_block)
50+
count = var.vpc_cidr_summ != "/0" ? 1 : length(aws_subnet.private.*.cidr_block)
4751
network_acl_id = aws_network_acl.secure.id
4852
rule_number = count.index + 101
4953
egress = true
5054
protocol = -1
5155
rule_action = "allow"
52-
cidr_block = aws_subnet.private[count.index].cidr_block
56+
cidr_block = var.vpc_cidr_summ != "/0" ? local.private_subnet_summary : aws_subnet.private[count.index].cidr_block
5357
}
5458

5559
resource "aws_network_acl_rule" "in_secure_from_transit" {
56-
count = var.transit_subnet ? length(aws_subnet.transit.*.cidr_block) : 0
60+
count = var.transit_subnet ? var.vpc_cidr_summ != "/0" ? 1 : length(aws_subnet.transit.*.cidr_block) : 0
5761
network_acl_id = aws_network_acl.secure.id
5862
rule_number = count.index + 301
5963
egress = false
6064
protocol = -1
6165
rule_action = "allow"
62-
cidr_block = aws_subnet.transit[count.index].cidr_block
66+
cidr_block = var.vpc_cidr_summ != "/0" ? local.transit_subnet_summary : aws_subnet.transit[count.index].cidr_block
6367
}
6468

6569
resource "aws_network_acl_rule" "out_secure_to_transit" {
66-
count = var.transit_subnet ? length(aws_subnet.transit.*.cidr_block) : 0
70+
count = var.transit_subnet ? var.vpc_cidr_summ != "/0" ? 1 : length(aws_subnet.transit.*.cidr_block) : 0
6771
network_acl_id = aws_network_acl.secure.id
6872
rule_number = count.index + 201
6973
egress = true
7074
protocol = -1
7175
rule_action = "allow"
72-
cidr_block = aws_subnet.transit[count.index].cidr_block
76+
cidr_block = var.vpc_cidr_summ != "/0" ? local.transit_subnet_summary : aws_subnet.transit[count.index].cidr_block
7377
}
7478

7579
#############

‎nacl-transit.tf

+8-4
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
locals {
2+
transit_subnet_ip = split("/", try(element(aws_subnet.transit.*.cidr_block, length(aws_subnet.transit.*.cidr_block) - 1), "0.0.0.0/0"))[0]
3+
transit_subnet_summary = var.vpc_cidr_summ != "/0" ? "${cidrhost("${local.transit_subnet_ip}${var.vpc_cidr_summ}", 0)}${var.vpc_cidr_summ}" : aws_vpc.default.cidr_block
4+
}
15
resource "aws_network_acl" "transit" {
26
count = var.transit_subnet ? 1 : 0
37
vpc_id = aws_vpc.default.id
@@ -117,25 +121,25 @@ resource "aws_network_acl_rule" "in_transit_icmp" {
117121
}
118122

119123
resource "aws_network_acl_rule" "in_transit_from_private" {
120-
count = var.transit_subnet ? length(aws_subnet.private.*.cidr_block) : 0
124+
count = var.transit_subnet ? var.vpc_cidr_summ != "/0" ? 1 : length(aws_subnet.private.*.cidr_block) : 0
121125
network_acl_id = aws_network_acl.transit[0].id
122126
rule_number = count.index + 601
123127
egress = false
124128
protocol = -1
125129
rule_action = "allow"
126-
cidr_block = aws_subnet.private.*.cidr_block[count.index]
130+
cidr_block = var.vpc_cidr_summ != "/0" ? local.private_subnet_summary : aws_subnet.private[count.index].cidr_block
127131
from_port = 0
128132
to_port = 0
129133
}
130134

131135
resource "aws_network_acl_rule" "in_transit_from_secure" {
132-
count = var.transit_subnet ? length(aws_subnet.secure.*.cidr_block) : 0
136+
count = var.transit_subnet ? var.vpc_cidr_summ != "/0" ? 1 : length(aws_subnet.secure.*.cidr_block) : 0
133137
network_acl_id = aws_network_acl.transit[0].id
134138
rule_number = count.index + 701
135139
egress = false
136140
protocol = -1
137141
rule_action = "allow"
138-
cidr_block = aws_subnet.secure.*.cidr_block[count.index]
142+
cidr_block = var.vpc_cidr_summ != "/0" ? local.secure_subnet_summary : aws_subnet.secure[count.index].cidr_block
139143
from_port = 0
140144
to_port = 0
141145
}

0 commit comments

Comments
 (0)