@pulumi/aws/ec2/defaultNetworkAcl.js

A Pulumi package for creating and managing Amazon Web Services (AWS) cloud resources.

"use strict";
// *** WARNING: this file was generated by pulumi-language-nodejs. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***
Object.defineProperty(exports, "__esModule", { value: true });
exports.DefaultNetworkAcl = void 0;
const pulumi = require("@pulumi/pulumi");
const utilities = require("../utilities");
/**
 * Provides a resource to manage a VPC's default network ACL. This resource can manage the default network ACL of the default or a non-default VPC.
 *
 * > **NOTE:** This is an advanced resource with special caveats. Please read this document in its entirety before using this resource. The `aws.ec2.DefaultNetworkAcl` behaves differently from normal resources. This provider does not _create_ this resource but instead attempts to "adopt" it into management.
 *
 * Every VPC has a default network ACL that can be managed but not destroyed. When the provider first adopts the Default Network ACL, it **immediately removes all rules in the ACL**. It then proceeds to create any rules specified in the configuration. This step is required so that only the rules specified in the configuration are created.
 *
 * This resource treats its inline rules as absolute; only the rules defined inline are created, and any additions/removals external to this resource will result in diffs being shown. For these reasons, this resource is incompatible with the `aws.ec2.NetworkAclRule` resource.
 *
 * For more information about Network ACLs, see the AWS Documentation on [Network ACLs][aws-network-acls].
 *
 * ## Example Usage
 *
 * ### Basic Example
 *
 * The following config gives the Default Network ACL the same rules that AWS includes but pulls the resource under management by this provider. This means that any ACL rules added or changed will be detected as drift.
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as aws from "@pulumi/aws";
 *
 * const mainvpc = new aws.ec2.Vpc("mainvpc", {cidrBlock: "10.1.0.0/16"});
 * const _default = new aws.ec2.DefaultNetworkAcl("default", {
 *     defaultNetworkAclId: mainvpc.defaultNetworkAclId,
 *     ingress: [{
 *         protocol: "-1",
 *         ruleNo: 100,
 *         action: "allow",
 *         cidrBlock: "0.0.0.0/0",
 *         fromPort: 0,
 *         toPort: 0,
 *     }],
 *     egress: [{
 *         protocol: "-1",
 *         ruleNo: 100,
 *         action: "allow",
 *         cidrBlock: "0.0.0.0/0",
 *         fromPort: 0,
 *         toPort: 0,
 *     }],
 * });
 * ```
 *
 * ### Example: Deny All Egress Traffic, Allow Ingress
 *
 * The following denies all Egress traffic by omitting any `egress` rules, while including the default `ingress` rule to allow all traffic.
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as aws from "@pulumi/aws";
 *
 * const mainvpc = new aws.ec2.Vpc("mainvpc", {cidrBlock: "10.1.0.0/16"});
 * const _default = new aws.ec2.DefaultNetworkAcl("default", {
 *     defaultNetworkAclId: mainvpc.defaultNetworkAclId,
 *     ingress: [{
 *         protocol: "-1",
 *         ruleNo: 100,
 *         action: "allow",
 *         cidrBlock: mainvpcAwsDefaultVpc.cidrBlock,
 *         fromPort: 0,
 *         toPort: 0,
 *     }],
 * });
 * ```
 *
 * ### Example: Deny All Traffic To Any Subnet In The Default Network ACL
 *
 * This config denies all traffic in the Default ACL. This can be useful if you want to lock down the VPC to force all resources to assign a non-default ACL.
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as aws from "@pulumi/aws";
 *
 * const mainvpc = new aws.ec2.Vpc("mainvpc", {cidrBlock: "10.1.0.0/16"});
 * const _default = new aws.ec2.DefaultNetworkAcl("default", {defaultNetworkAclId: mainvpc.defaultNetworkAclId});
 * ```
 *
 * ### Managing Subnets In A Default Network ACL
 *
 * Within a VPC, all Subnets must be associated with a Network ACL. In order to "delete" the association between a Subnet and a non-default Network ACL, the association is destroyed by replacing it with an association between the Subnet and the Default ACL instead.
 *
 * When managing the Default Network ACL, you cannot "remove" Subnets. Instead, they must be reassigned to another Network ACL, or the Subnet itself must be destroyed. Because of these requirements, removing the `subnetIds` attribute from the configuration of a `aws.ec2.DefaultNetworkAcl` resource may result in a reoccurring plan, until the Subnets are reassigned to another Network ACL or are destroyed.
 *
 * Because Subnets are by default associated with the Default Network ACL, any non-explicit association will show up as a plan to remove the Subnet. For example: if you have a custom `aws.ec2.NetworkAcl` with two subnets attached, and you remove the `aws.ec2.NetworkAcl` resource, after successfully destroying this resource future plans will show a diff on the managed `aws.ec2.DefaultNetworkAcl`, as those two Subnets have been orphaned by the now destroyed network acl and thus adopted by the Default Network ACL. In order to avoid a reoccurring plan, they will need to be reassigned, destroyed, or added to the `subnetIds` attribute of the `aws.ec2.DefaultNetworkAcl` entry.
 *
 * As an alternative to the above, you can also specify the following lifecycle configuration in your `aws.ec2.DefaultNetworkAcl` resource:
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as aws from "@pulumi/aws";
 *
 * const _default = new aws.ec2.DefaultNetworkAcl("default", {});
 * ```
 *
 * ### Removing `aws.ec2.DefaultNetworkAcl` From Your Configuration
 *
 * Each AWS VPC comes with a Default Network ACL that cannot be deleted. The `aws.ec2.DefaultNetworkAcl` allows you to manage this Network ACL, but the provider cannot destroy it. Removing this resource from your configuration will remove it from your statefile and management, **but will not destroy the Network ACL.** All Subnets associations and ingress or egress rules will be left as they are at the time of removal. You can resume managing them via the AWS Console.
 *
 * ## Import
 *
 * Using `pulumi import`, import Default Network ACLs using the `id`. For example:
 *
 * ```sh
 * $ pulumi import aws:ec2/defaultNetworkAcl:DefaultNetworkAcl sample acl-7aaabd18
 * ```
 */
class DefaultNetworkAcl extends pulumi.CustomResource {
    /**
     * Get an existing DefaultNetworkAcl resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name, id, state, opts) {
        return new DefaultNetworkAcl(name, state, { ...opts, id: id });
    }
    /**
     * Returns true if the given object is an instance of DefaultNetworkAcl.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj) {
        if (obj === undefined || obj === null) {
            return false;
        }
        return obj['__pulumiType'] === DefaultNetworkAcl.__pulumiType;
    }
    constructor(name, argsOrState, opts) {
        let resourceInputs = {};
        opts = opts || {};
        if (opts.id) {
            const state = argsOrState;
            resourceInputs["arn"] = state?.arn;
            resourceInputs["defaultNetworkAclId"] = state?.defaultNetworkAclId;
            resourceInputs["egress"] = state?.egress;
            resourceInputs["ingress"] = state?.ingress;
            resourceInputs["ownerId"] = state?.ownerId;
            resourceInputs["region"] = state?.region;
            resourceInputs["subnetIds"] = state?.subnetIds;
            resourceInputs["tags"] = state?.tags;
            resourceInputs["tagsAll"] = state?.tagsAll;
            resourceInputs["vpcId"] = state?.vpcId;
        }
        else {
            const args = argsOrState;
            if (args?.defaultNetworkAclId === undefined && !opts.urn) {
                throw new Error("Missing required property 'defaultNetworkAclId'");
            }
            resourceInputs["defaultNetworkAclId"] = args?.defaultNetworkAclId;
            resourceInputs["egress"] = args?.egress;
            resourceInputs["ingress"] = args?.ingress;
            resourceInputs["region"] = args?.region;
            resourceInputs["subnetIds"] = args?.subnetIds;
            resourceInputs["tags"] = args?.tags;
            resourceInputs["arn"] = undefined /*out*/;
            resourceInputs["ownerId"] = undefined /*out*/;
            resourceInputs["tagsAll"] = undefined /*out*/;
            resourceInputs["vpcId"] = undefined /*out*/;
        }
        opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
        super(DefaultNetworkAcl.__pulumiType, name, resourceInputs, opts);
    }
}
exports.DefaultNetworkAcl = DefaultNetworkAcl;
/** @internal */
DefaultNetworkAcl.__pulumiType = 'aws:ec2/defaultNetworkAcl:DefaultNetworkAcl';
//# sourceMappingURL=defaultNetworkAcl.js.map