mirror of https://github.com/ansible/ansible.git
ec2_vpc_nacl and ec2_vpc_nacl_info migrate to AnsibleAWSModule and add tests (#63163)
* Move EC2 networking objects into network-policy.json * ec2_vpc_nacl: Add integration tests * ec2_vpc_nacl: Migrate tests to use module_defaults * ec2_vpc_nacl: (integration tests) Add missing AWS permissions * ec2_vpc_nacl: (integration tests) Update tests for ipv6 support * ec2_vpc_nacl: Migrate to AnsibleAWSModule * Fix sanity tests for ec2_vpc_nacl and ec2_vpc_nacl_info * ec2_vpc_nacl_info: Migrate to AnsibleAWSModule * ec2_vpc_nacl_info: (integration tests) Rename from ec2_vpc_nacl_facts to ec2_vpc_nacl_info and add a test using a filter (by tag) * Pick availability zones dynamically Rather than assuming that AZa and AZb always exist (they don't), query to find out which AZs we have available first * Test that the NACLs we get back are actually the *saml* NACL rather than duplicates/delete remove * Cleanup IPv6 tests a little. Note: IPv6 support for ec2_vpc_nacl not complete yet. This provides the initial framework, and should ensure things don't start exploding when support is added. * Removing subnets by name from a NACL *is* now supported * Fix ec2_vpc_nacl return documentationpull/63259/head
Mark Chappell
5 years ago
committed by
Jill R
parent
811127d64d
commit
dbc9444572
@ -0,0 +1,3 @@
|
|||||||
|
ec2_vpc_nacl_info
|
||||||
|
cloud/aws
|
||||||
|
shippable/aws/group2
|
||||||
@ -0,0 +1,3 @@
|
|||||||
|
dependencies:
|
||||||
|
- prepare_tests
|
||||||
|
- setup_ec2
|
||||||
@ -0,0 +1,162 @@
|
|||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: create ingress and egress rules using subnet IDs
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
subnets: "{{ subnet_ids }}"
|
||||||
|
tags:
|
||||||
|
Created_by: "Ansible test {{ resource_prefix }}"
|
||||||
|
ingress:
|
||||||
|
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
|
||||||
|
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
|
||||||
|
- [300, 'icmp', 'allow', '0.0.0.0/0', 0, 8]
|
||||||
|
egress:
|
||||||
|
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
|
||||||
|
state: 'present'
|
||||||
|
register: nacl
|
||||||
|
|
||||||
|
- name: assert the network acl was created
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl.changed
|
||||||
|
- nacl.nacl_id.startswith('acl-')
|
||||||
|
|
||||||
|
- name: get network ACL facts
|
||||||
|
ec2_vpc_nacl_info:
|
||||||
|
nacl_ids:
|
||||||
|
- "{{ nacl.nacl_id }}"
|
||||||
|
register: nacl_facts
|
||||||
|
|
||||||
|
- name: assert the nacl has the correct attributes
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl_facts.nacls | length == 1
|
||||||
|
- nacl_facts.nacls[0].ingress | length == 3
|
||||||
|
- nacl_facts.nacls[0].egress | length == 1
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: remove an ingress rule
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
subnets: "{{ subnet_ids }}"
|
||||||
|
tags:
|
||||||
|
Created_by: "Ansible test {{ resource_prefix }}"
|
||||||
|
ingress:
|
||||||
|
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
|
||||||
|
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
|
||||||
|
egress:
|
||||||
|
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
|
||||||
|
state: 'present'
|
||||||
|
register: nacl
|
||||||
|
|
||||||
|
- name: assert the network acl changed
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl.changed
|
||||||
|
- nacl.nacl_id.startswith('acl-')
|
||||||
|
|
||||||
|
- name: get network ACL facts
|
||||||
|
ec2_vpc_nacl_info:
|
||||||
|
nacl_ids:
|
||||||
|
- "{{ nacl.nacl_id }}"
|
||||||
|
register: nacl_facts
|
||||||
|
|
||||||
|
- name: assert the nacl has the correct attributes
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl_facts.nacls | length == 1
|
||||||
|
- nacl_facts.nacls[0].ingress | length == 2
|
||||||
|
- nacl_facts.nacls[0].egress | length == 1
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: remove the egress rule
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
subnets: "{{ subnet_ids }}"
|
||||||
|
tags:
|
||||||
|
Created_by: "Ansible test {{ resource_prefix }}"
|
||||||
|
ingress:
|
||||||
|
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
|
||||||
|
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
|
||||||
|
egress: []
|
||||||
|
state: 'present'
|
||||||
|
register: nacl
|
||||||
|
|
||||||
|
- name: assert the network acl changed
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl.changed
|
||||||
|
- nacl.nacl_id.startswith('acl-')
|
||||||
|
|
||||||
|
- name: get network ACL facts
|
||||||
|
ec2_vpc_nacl_info:
|
||||||
|
nacl_ids:
|
||||||
|
- "{{ nacl.nacl_id }}"
|
||||||
|
register: nacl_facts
|
||||||
|
|
||||||
|
- name: assert the nacl has the correct attributes
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl_facts.nacls | length == 1
|
||||||
|
- nacl_facts.nacls[0].ingress | length == 2
|
||||||
|
- nacl_facts.nacls[0].egress | length == 0
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: add egress rules
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
subnets: "{{ subnet_ids }}"
|
||||||
|
tags:
|
||||||
|
Created_by: "Ansible test {{ resource_prefix }}"
|
||||||
|
ingress:
|
||||||
|
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
|
||||||
|
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
|
||||||
|
egress:
|
||||||
|
- [100, 'tcp', 'allow', '10.0.0.0/24', null, null, 22, 22]
|
||||||
|
- [200, 'udp', 'allow', '10.0.0.0/24', null, null, 22, 22]
|
||||||
|
state: 'present'
|
||||||
|
register: nacl
|
||||||
|
|
||||||
|
- name: assert the network acl changed
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl.changed
|
||||||
|
- nacl.nacl_id.startswith('acl-')
|
||||||
|
|
||||||
|
- name: get network ACL facts
|
||||||
|
ec2_vpc_nacl_info:
|
||||||
|
nacl_ids:
|
||||||
|
- "{{ nacl.nacl_id }}"
|
||||||
|
register: nacl_facts
|
||||||
|
|
||||||
|
- name: assert the nacl has the correct attributes
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl_facts.nacls | length == 1
|
||||||
|
- nacl_facts.nacls[0].ingress | length == 2
|
||||||
|
- nacl_facts.nacls[0].egress | length == 2
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: remove the network ACL
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
state: absent
|
||||||
|
register: nacl
|
||||||
|
until: nacl is success
|
||||||
|
ignore_errors: yes
|
||||||
|
retries: 5
|
||||||
|
delay: 5
|
||||||
|
|
||||||
|
- name: assert nacl was removed
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl.changed
|
||||||
@ -0,0 +1,178 @@
|
|||||||
|
- block:
|
||||||
|
- name: create a VPC
|
||||||
|
ec2_vpc_net:
|
||||||
|
cidr_block: 10.230.231.0/24
|
||||||
|
name: "{{ resource_prefix }}-ipv6"
|
||||||
|
state: present
|
||||||
|
ipv6_cidr: yes
|
||||||
|
register: vpc_result
|
||||||
|
|
||||||
|
- set_fact:
|
||||||
|
vpc_ipv6_cidr: "{{ vpc_result.vpc.ipv6_cidr_block_association_set[0].ipv6_cidr_block }}"
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
- name: create subnet with IPv6 (expected changed=true)
|
||||||
|
ec2_vpc_subnet:
|
||||||
|
cidr: 10.230.231.0/26
|
||||||
|
vpc_id: "{{ vpc_result.vpc.id }}"
|
||||||
|
ipv6_cidr: "{{ vpc_ipv6_cidr | regex_replace('::/56', '::/64') }}"
|
||||||
|
state: present
|
||||||
|
tags:
|
||||||
|
Name: "{{ resource_prefix }}-ipv6-subnet-1"
|
||||||
|
register: vpc_subnet_ipv6
|
||||||
|
|
||||||
|
- name: assert creation with IPv6 happened (expected changed=true)
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- "vpc_subnet_ipv6.subnet.ipv6_cidr_block == '{{ vpc_ipv6_cidr | regex_replace('::/56', '::/64') }}'"
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: create ingress and egress rules using subnet names
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_result.vpc.id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
subnets:
|
||||||
|
- "{{ resource_prefix }}-ipv6-subnet-1"
|
||||||
|
tags:
|
||||||
|
Created_by: "Ansible test {{ resource_prefix }}"
|
||||||
|
ingress:
|
||||||
|
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
|
||||||
|
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
|
||||||
|
- [300, 'icmp', 'allow', '0.0.0.0/0', 0, 8]
|
||||||
|
egress:
|
||||||
|
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
|
||||||
|
state: 'present'
|
||||||
|
register: nacl
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- nacl.nacl_id
|
||||||
|
|
||||||
|
- set_fact:
|
||||||
|
nacl_id: "{{ nacl.nacl_id }}"
|
||||||
|
|
||||||
|
- name: add ipv6 entries
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_result.vpc.id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
subnets:
|
||||||
|
- "{{ resource_prefix }}-ipv6-subnet-1"
|
||||||
|
tags:
|
||||||
|
Created_by: "Ansible test {{ resource_prefix }}"
|
||||||
|
ingress:
|
||||||
|
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
|
||||||
|
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
|
||||||
|
- [205, 'ipv6-tcp', 'allow', '::/0', null, null, 80, 80]
|
||||||
|
- [300, 'icmp', 'allow', '0.0.0.0/0', 0, 8]
|
||||||
|
- [305, 'ipv6-icmp', 'allow', '::/0', 0, 8]
|
||||||
|
egress:
|
||||||
|
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
|
||||||
|
- [105, 'all', 'allow', '::/0', null, null, null, null]
|
||||||
|
state: 'present'
|
||||||
|
register: nacl
|
||||||
|
# FIXME: Currently IPv6 rules are not supported - uncomment assertion when
|
||||||
|
# fixed (and add some nacl_info tests)
|
||||||
|
ignore_errors: yes
|
||||||
|
- name: get network ACL facts (test that it works with ipv6 entries)
|
||||||
|
ec2_vpc_nacl_info:
|
||||||
|
nacl_ids:
|
||||||
|
- "{{ nacl_id }}"
|
||||||
|
register: nacl_facts
|
||||||
|
|
||||||
|
|
||||||
|
#- assert:
|
||||||
|
# that:
|
||||||
|
# - nacl.changed
|
||||||
|
# - nacl.nacl_id == nacl_id
|
||||||
|
|
||||||
|
- name: purge ingress entries
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_result.vpc.id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
subnets:
|
||||||
|
- "{{ resource_prefix }}-ipv6-subnet-1"
|
||||||
|
tags:
|
||||||
|
Created_by: "Ansible test {{ resource_prefix }}"
|
||||||
|
ingress: []
|
||||||
|
egress:
|
||||||
|
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
|
||||||
|
- [105, 'all', 'allow', '::/0', null, null, null, null]
|
||||||
|
state: 'present'
|
||||||
|
register: nacl
|
||||||
|
# FIXME: Currently IPv6 rules are not supported - uncomment assertion when
|
||||||
|
# fixed (and add some nacl_info tests)
|
||||||
|
ignore_errors: yes
|
||||||
|
|
||||||
|
#- assert:
|
||||||
|
# that:
|
||||||
|
# - nacl.changed
|
||||||
|
# - nacl.nacl_id == nacl_id
|
||||||
|
|
||||||
|
- name: purge egress entries
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_result.vpc.id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
subnets:
|
||||||
|
- "{{ resource_prefix }}-ipv6-subnet-1"
|
||||||
|
tags:
|
||||||
|
Created_by: "Ansible test {{ resource_prefix }}"
|
||||||
|
ingress: []
|
||||||
|
egress: []
|
||||||
|
state: 'present'
|
||||||
|
register: nacl
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- nacl.changed
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
- name: remove subnet ipv6 cidr (expected changed=true)
|
||||||
|
ec2_vpc_subnet:
|
||||||
|
cidr: 10.230.231.0/26
|
||||||
|
vpc_id: "{{ vpc_result.vpc.id }}"
|
||||||
|
state: absent
|
||||||
|
register: vpc_remove_ipv6_cidr
|
||||||
|
|
||||||
|
- name: assert subnet ipv6 cidr removed (expected changed=true)
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- 'vpc_remove_ipv6_cidr.changed'
|
||||||
|
|
||||||
|
always:
|
||||||
|
|
||||||
|
################################################
|
||||||
|
# TEARDOWN STARTS HERE
|
||||||
|
################################################
|
||||||
|
|
||||||
|
- name: remove network ACL
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_result.vpc.id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
state: absent
|
||||||
|
register: removed_acl
|
||||||
|
until: removed_acl is success
|
||||||
|
retries: 5
|
||||||
|
delay: 5
|
||||||
|
ignore_errors: yes
|
||||||
|
|
||||||
|
- name: tidy up subnet
|
||||||
|
ec2_vpc_subnet:
|
||||||
|
cidr: 10.230.231.0/26
|
||||||
|
vpc_id: "{{ vpc_result.vpc.id }}"
|
||||||
|
state: absent
|
||||||
|
register: removed_subnet
|
||||||
|
until: removed_subnet is success
|
||||||
|
retries: 5
|
||||||
|
delay: 5
|
||||||
|
ignore_errors: yes
|
||||||
|
|
||||||
|
- name: tidy up VPC
|
||||||
|
ec2_vpc_net:
|
||||||
|
name: "{{ resource_prefix }}-ipv6"
|
||||||
|
state: absent
|
||||||
|
cidr_block: 10.230.231.0/24
|
||||||
|
register: removed_vpc
|
||||||
|
until: removed_vpc is success
|
||||||
|
retries: 5
|
||||||
|
delay: 5
|
||||||
|
ignore_errors: yes
|
||||||
@ -0,0 +1,170 @@
|
|||||||
|
---
|
||||||
|
- module_defaults:
|
||||||
|
group/aws:
|
||||||
|
aws_access_key: "{{ aws_access_key }}"
|
||||||
|
aws_secret_key: "{{ aws_secret_key }}"
|
||||||
|
security_token: "{{ security_token | default(omit) }}"
|
||||||
|
region: "{{ aws_region }}"
|
||||||
|
block:
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: test without any parameters
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
register: result
|
||||||
|
ignore_errors: yes
|
||||||
|
|
||||||
|
- name: assert required parameters
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- result.failed
|
||||||
|
- "result.msg == 'one of the following is required: name, nacl_id'"
|
||||||
|
|
||||||
|
- name: get network ACL info without any parameters
|
||||||
|
ec2_vpc_nacl_info:
|
||||||
|
register: nacl_facts
|
||||||
|
|
||||||
|
- name: assert we don't error
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl_facts is succeeded
|
||||||
|
|
||||||
|
- name: get network ACL info with invalid ID
|
||||||
|
ec2_vpc_nacl_info:
|
||||||
|
nacl_ids:
|
||||||
|
- 'acl-000000000000'
|
||||||
|
register: nacl_facts
|
||||||
|
ignore_errors: yes
|
||||||
|
|
||||||
|
- name: assert message mentions missing ACLs
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl_facts is failed
|
||||||
|
- '"does not exist" in nacl_facts.msg'
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: fetch AZ availability
|
||||||
|
aws_az_info:
|
||||||
|
register: az_info
|
||||||
|
|
||||||
|
- name: Assert that we have multiple AZs available to us
|
||||||
|
assert:
|
||||||
|
that: az_info.availability_zones | length >= 2
|
||||||
|
|
||||||
|
- name: pick AZs
|
||||||
|
set_fact:
|
||||||
|
az_one: '{{ az_info.availability_zones[0].zone_name }}'
|
||||||
|
az_two: '{{ az_info.availability_zones[1].zone_name }}'
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: create a VPC
|
||||||
|
ec2_vpc_net:
|
||||||
|
cidr_block: 10.230.230.0/24
|
||||||
|
name: "{{ resource_prefix }}"
|
||||||
|
state: present
|
||||||
|
register: vpc
|
||||||
|
|
||||||
|
- name: create subnets
|
||||||
|
ec2_vpc_subnet:
|
||||||
|
cidr: "{{ item.cidr }}"
|
||||||
|
az: "{{ item.az }}"
|
||||||
|
vpc_id: "{{ vpc.vpc.id }}"
|
||||||
|
state: present
|
||||||
|
tags:
|
||||||
|
Name: "{{ item.name }}"
|
||||||
|
with_items:
|
||||||
|
- cidr: 10.230.230.0/26
|
||||||
|
az: "{{ az_one }}"
|
||||||
|
name: "{{ resource_prefix }}-subnet-1"
|
||||||
|
- cidr: 10.230.230.64/26
|
||||||
|
az: "{{ az_two }}"
|
||||||
|
name: "{{ resource_prefix }}-subnet-2"
|
||||||
|
- cidr: 10.230.230.128/26
|
||||||
|
az: "{{ az_one }}"
|
||||||
|
name: "{{ resource_prefix }}-subnet-3"
|
||||||
|
- cidr: 10.230.230.192/26
|
||||||
|
az: "{{ az_two }}"
|
||||||
|
name: "{{ resource_prefix }}-subnet-4"
|
||||||
|
register: subnets
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- include_tasks: tasks/subnet_ids.yml
|
||||||
|
vars:
|
||||||
|
vpc_id: "{{ vpc.vpc.id }}"
|
||||||
|
subnet_ids: "{{ subnets | json_query('results[*].subnet.id') }}"
|
||||||
|
|
||||||
|
- include_tasks: tasks/subnet_names.yml
|
||||||
|
vars:
|
||||||
|
vpc_id: "{{ vpc.vpc.id }}"
|
||||||
|
subnet_names: "{{ subnets | json_query('results[*].subnet.tags.Name') }}"
|
||||||
|
|
||||||
|
- include_tasks: tasks/tags.yml
|
||||||
|
vars:
|
||||||
|
vpc_id: "{{ vpc.vpc.id }}"
|
||||||
|
subnet_ids: "{{ subnets | json_query('results[*].subnet.id') }}"
|
||||||
|
|
||||||
|
- include_tasks: tasks/ingress_and_egress.yml
|
||||||
|
vars:
|
||||||
|
vpc_id: "{{ vpc.vpc.id }}"
|
||||||
|
subnet_ids: "{{ subnets | json_query('results[*].subnet.id') }}"
|
||||||
|
|
||||||
|
- include_tasks: tasks/ipv6.yml
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
always:
|
||||||
|
|
||||||
|
- name: remove network ACL
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc.vpc.id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
state: absent
|
||||||
|
register: removed_acl
|
||||||
|
until: removed_acl is success
|
||||||
|
retries: 5
|
||||||
|
delay: 5
|
||||||
|
ignore_errors: yes
|
||||||
|
|
||||||
|
- name: remove subnets
|
||||||
|
ec2_vpc_subnet:
|
||||||
|
cidr: "{{ item.cidr }}"
|
||||||
|
az: "{{ aws_region}}{{ item.az }}"
|
||||||
|
vpc_id: "{{ vpc.vpc.id }}"
|
||||||
|
state: absent
|
||||||
|
tags:
|
||||||
|
Public: "{{ item.public | string }}"
|
||||||
|
Name: "{{ item.public | ternary('public', 'private') }}-{{ item.az }}"
|
||||||
|
with_items:
|
||||||
|
- cidr: 10.230.230.0/26
|
||||||
|
az: "a"
|
||||||
|
public: "True"
|
||||||
|
- cidr: 10.230.230.64/26
|
||||||
|
az: "b"
|
||||||
|
public: "True"
|
||||||
|
- cidr: 10.230.230.128/26
|
||||||
|
az: "a"
|
||||||
|
public: "False"
|
||||||
|
- cidr: 10.230.230.192/26
|
||||||
|
az: "b"
|
||||||
|
public: "False"
|
||||||
|
ignore_errors: yes
|
||||||
|
register: removed_subnets
|
||||||
|
until: removed_subnets is success
|
||||||
|
retries: 5
|
||||||
|
delay: 5
|
||||||
|
|
||||||
|
- name: remove the VPC
|
||||||
|
ec2_vpc_net:
|
||||||
|
cidr_block: 10.230.230.0/24
|
||||||
|
name: "{{ resource_prefix }}"
|
||||||
|
state: absent
|
||||||
|
ignore_errors: yes
|
||||||
|
register: removed_vpc
|
||||||
|
until: removed_vpc is success
|
||||||
|
retries: 5
|
||||||
|
delay: 5
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
@ -0,0 +1,142 @@
|
|||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: create ingress and egress rules using subnet IDs
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
subnets: "{{ subnet_ids }}"
|
||||||
|
tags:
|
||||||
|
Created_by: "Ansible test {{ resource_prefix }}"
|
||||||
|
ingress:
|
||||||
|
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
|
||||||
|
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
|
||||||
|
- [300, 'icmp', 'allow', '0.0.0.0/0', 0, 8]
|
||||||
|
egress:
|
||||||
|
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
|
||||||
|
state: 'present'
|
||||||
|
register: nacl
|
||||||
|
|
||||||
|
- set_fact:
|
||||||
|
nacl_id: "{{ nacl.nacl_id }}"
|
||||||
|
|
||||||
|
- name: assert the network acl was created
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl.changed
|
||||||
|
- nacl.nacl_id.startswith('acl-')
|
||||||
|
|
||||||
|
- name: get network ACL facts
|
||||||
|
ec2_vpc_nacl_info:
|
||||||
|
nacl_ids:
|
||||||
|
- "{{ nacl_id }}"
|
||||||
|
register: nacl_facts
|
||||||
|
|
||||||
|
- name: assert the nacl has the correct attributes
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl_facts.nacls | length == 1
|
||||||
|
- nacl_facts.nacls[0].nacl_id == nacl_id
|
||||||
|
- nacl_facts.nacls[0].subnets | length == 4
|
||||||
|
- nacl_facts.nacls[0].subnets | sort == subnet_ids | sort
|
||||||
|
- nacl_facts.nacls[0].ingress | length == 3
|
||||||
|
- nacl_facts.nacls[0].egress | length == 1
|
||||||
|
- "'{{ nacl_facts.nacls[0].tags.Name }}' == '{{ resource_prefix }}-acl'"
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: test idempotence
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
subnets: "{{ subnet_ids }}"
|
||||||
|
tags:
|
||||||
|
Created_by: "Ansible test {{ resource_prefix }}"
|
||||||
|
ingress:
|
||||||
|
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
|
||||||
|
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
|
||||||
|
- [300, 'icmp', 'allow', '0.0.0.0/0', 0, 8]
|
||||||
|
egress:
|
||||||
|
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
|
||||||
|
state: 'present'
|
||||||
|
register: nacl
|
||||||
|
|
||||||
|
- name: assert the network acl already existed
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- not nacl.changed
|
||||||
|
- nacl.nacl_id == nacl_id
|
||||||
|
- nacl.nacl_id.startswith('acl-')
|
||||||
|
|
||||||
|
- name: get network ACL facts
|
||||||
|
ec2_vpc_nacl_info:
|
||||||
|
nacl_ids:
|
||||||
|
- "{{ nacl.nacl_id }}"
|
||||||
|
register: nacl_facts_idem
|
||||||
|
|
||||||
|
- name: assert the facts are the same as before
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl_facts_idem == nacl_facts
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: remove a subnet from the network ACL
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
subnets:
|
||||||
|
- "{{ subnet_ids[0] }}"
|
||||||
|
- "{{ subnet_ids[1] }}"
|
||||||
|
- "{{ subnet_ids[2] }}"
|
||||||
|
tags:
|
||||||
|
Created_by: "Ansible test {{ resource_prefix }}"
|
||||||
|
ingress:
|
||||||
|
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
|
||||||
|
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
|
||||||
|
- [300, 'icmp', 'allow', '0.0.0.0/0', 0, 8]
|
||||||
|
egress:
|
||||||
|
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
|
||||||
|
state: 'present'
|
||||||
|
register: nacl
|
||||||
|
|
||||||
|
- name: assert the network ACL changed
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl.changed
|
||||||
|
- nacl.nacl_id.startswith('acl-')
|
||||||
|
- nacl.nacl_id == nacl_id
|
||||||
|
|
||||||
|
- name: get network ACL facts
|
||||||
|
ec2_vpc_nacl_info:
|
||||||
|
nacl_id:
|
||||||
|
- "{{ nacl.nacl_id }}"
|
||||||
|
register: nacl_facts
|
||||||
|
|
||||||
|
- name: assert the nacl has the correct attributes
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl_facts.nacls | length == 1
|
||||||
|
- nacl_facts.nacls[0].nacl_id == nacl_id
|
||||||
|
- nacl_facts.nacls[0].subnets | length == 3
|
||||||
|
- subnet_ids[3] not in nacl_facts.nacls[0].subnets
|
||||||
|
- nacl_facts.nacls[0].ingress | length == 3
|
||||||
|
- nacl_facts.nacls[0].egress | length == 1
|
||||||
|
- "'{{ nacl_facts.nacls[0].tags.Name }}' == '{{ resource_prefix }}-acl'"
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: remove the network ACL
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
state: absent
|
||||||
|
register: nacl
|
||||||
|
until: nacl is success
|
||||||
|
ignore_errors: yes
|
||||||
|
retries: 5
|
||||||
|
delay: 5
|
||||||
|
|
||||||
|
- name: assert nacl was removed
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl.changed
|
||||||
@ -0,0 +1,140 @@
|
|||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: create ingress and egress rules using subnet names
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
subnets: "{{ subnet_names }}"
|
||||||
|
tags:
|
||||||
|
Created_by: "Ansible test {{ resource_prefix }}"
|
||||||
|
ingress:
|
||||||
|
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
|
||||||
|
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
|
||||||
|
- [300, 'icmp', 'allow', '0.0.0.0/0', 0, 8]
|
||||||
|
egress:
|
||||||
|
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
|
||||||
|
state: 'present'
|
||||||
|
register: nacl
|
||||||
|
|
||||||
|
- set_fact:
|
||||||
|
nacl_id: "{{ nacl.nacl_id }}"
|
||||||
|
|
||||||
|
- name: assert the network acl was created
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl.changed
|
||||||
|
- nacl.nacl_id.startswith('acl-')
|
||||||
|
|
||||||
|
- name: get network ACL facts
|
||||||
|
ec2_vpc_nacl_info:
|
||||||
|
nacl_ids:
|
||||||
|
- "{{ nacl_id }}"
|
||||||
|
register: nacl_facts
|
||||||
|
|
||||||
|
- name: assert the nacl has the correct attributes
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl_facts.nacls | length == 1
|
||||||
|
- nacl_facts.nacls[0].nacl_id == nacl_id
|
||||||
|
- nacl_facts.nacls[0].subnets | length == 4
|
||||||
|
- nacl_facts.nacls[0].ingress | length == 3
|
||||||
|
- nacl_facts.nacls[0].egress | length == 1
|
||||||
|
- "'{{ nacl_facts.nacls[0].tags.Name }}' == '{{ resource_prefix }}-acl'"
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: test idempotence
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
subnets: "{{ subnet_names }}"
|
||||||
|
tags:
|
||||||
|
Created_by: "Ansible test {{ resource_prefix }}"
|
||||||
|
ingress:
|
||||||
|
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
|
||||||
|
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
|
||||||
|
- [300, 'icmp', 'allow', '0.0.0.0/0', 0, 8]
|
||||||
|
egress:
|
||||||
|
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
|
||||||
|
state: 'present'
|
||||||
|
register: nacl
|
||||||
|
|
||||||
|
- name: assert the network acl already existed
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- not nacl.changed
|
||||||
|
- nacl.nacl_id == nacl_id
|
||||||
|
- nacl.nacl_id.startswith('acl-')
|
||||||
|
|
||||||
|
- name: get network ACL facts
|
||||||
|
ec2_vpc_nacl_info:
|
||||||
|
nacl_ids:
|
||||||
|
- "{{ nacl.nacl_id }}"
|
||||||
|
register: nacl_facts_idem
|
||||||
|
|
||||||
|
- name: assert the facts are the same as before
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl_facts_idem == nacl_facts
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: remove a subnet from the network ACL
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
subnets:
|
||||||
|
- "{{ subnet_names[0] }}"
|
||||||
|
- "{{ subnet_names[1] }}"
|
||||||
|
- "{{ subnet_names[2] }}"
|
||||||
|
tags:
|
||||||
|
Created_by: "Ansible test {{ resource_prefix }}"
|
||||||
|
ingress:
|
||||||
|
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
|
||||||
|
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
|
||||||
|
- [300, 'icmp', 'allow', '0.0.0.0/0', 0, 8]
|
||||||
|
egress:
|
||||||
|
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
|
||||||
|
state: 'present'
|
||||||
|
register: nacl
|
||||||
|
|
||||||
|
- name: assert the network ACL changed
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl.changed
|
||||||
|
- nacl.nacl_id == nacl_id
|
||||||
|
- nacl.nacl_id.startswith('acl-')
|
||||||
|
|
||||||
|
- name: get network ACL facts
|
||||||
|
ec2_vpc_nacl_info:
|
||||||
|
nacl_ids:
|
||||||
|
- "{{ nacl.nacl_id }}"
|
||||||
|
register: nacl_facts
|
||||||
|
|
||||||
|
- name: assert the nacl has the correct attributes
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl_facts.nacls | length == 1
|
||||||
|
- nacl_facts.nacls[0].nacl_id == nacl_id
|
||||||
|
- nacl_facts.nacls[0].subnets | length == 3
|
||||||
|
- nacl_facts.nacls[0].ingress | length == 3
|
||||||
|
- nacl_facts.nacls[0].egress | length == 1
|
||||||
|
- "'{{ nacl_facts.nacls[0].tags.Name }}' == '{{ resource_prefix }}-acl'"
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: remove the network ACL
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
state: absent
|
||||||
|
register: nacl
|
||||||
|
until: nacl is success
|
||||||
|
ignore_errors: yes
|
||||||
|
retries: 5
|
||||||
|
delay: 5
|
||||||
|
|
||||||
|
- name: assert nacl was removed
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl.changed
|
||||||
@ -0,0 +1,117 @@
|
|||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: create a network ACL using subnet IDs
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
subnets: "{{ subnet_ids }}"
|
||||||
|
state: 'present'
|
||||||
|
register: nacl
|
||||||
|
|
||||||
|
- name: assert the network acl was created
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl.changed
|
||||||
|
- nacl.nacl_id.startswith('acl-')
|
||||||
|
|
||||||
|
- name: get network ACL facts
|
||||||
|
ec2_vpc_nacl_info:
|
||||||
|
nacl_ids:
|
||||||
|
- "{{ nacl.nacl_id }}"
|
||||||
|
register: nacl_facts
|
||||||
|
|
||||||
|
- name: assert the nacl has the correct attributes
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl_facts.nacls[0].tags | length == 1
|
||||||
|
- "'{{ nacl_facts.nacls[0].tags.Name }}' == '{{ resource_prefix }}-acl'"
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: add a tag
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
subnets: "{{ subnet_ids }}"
|
||||||
|
tags:
|
||||||
|
Created_by: "Ansible test {{ resource_prefix }}"
|
||||||
|
state: 'present'
|
||||||
|
register: nacl
|
||||||
|
|
||||||
|
- name: assert the network acl changed
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl.changed
|
||||||
|
|
||||||
|
- name: get network ACL facts
|
||||||
|
ec2_vpc_nacl_info:
|
||||||
|
nacl_ids:
|
||||||
|
- "{{ nacl.nacl_id }}"
|
||||||
|
register: nacl_facts
|
||||||
|
|
||||||
|
- name: assert the facts are the same as before
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl_facts.nacls[0].tags | length == 2
|
||||||
|
- "'{{ nacl_facts.nacls[0].tags.Name }}' == '{{ resource_prefix }}-acl'"
|
||||||
|
- "'{{ nacl_facts.nacls[0].tags.Created_by }}' == 'Ansible test {{ resource_prefix }}'"
|
||||||
|
|
||||||
|
- name: get network ACL facts by filter
|
||||||
|
ec2_vpc_nacl_info:
|
||||||
|
filters:
|
||||||
|
"tag:Created_by": "Ansible test {{ resource_prefix }}"
|
||||||
|
register: nacl_facts
|
||||||
|
|
||||||
|
- name: assert the facts are the same as before
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl_facts.nacls | length == 1
|
||||||
|
- nacl_facts.nacls[0].tags | length == 2
|
||||||
|
- "'{{ nacl_facts.nacls[0].tags.Name }}' == '{{ resource_prefix }}-acl'"
|
||||||
|
- "'{{ nacl_facts.nacls[0].tags.Created_by }}' == 'Ansible test {{ resource_prefix }}'"
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: remove a tag
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
subnets: "{{ subnet_ids }}"
|
||||||
|
state: 'present'
|
||||||
|
register: nacl
|
||||||
|
|
||||||
|
- name: assert the network acl was created
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl.changed
|
||||||
|
- nacl.nacl_id.startswith('acl-')
|
||||||
|
|
||||||
|
- name: get network ACL facts
|
||||||
|
ec2_vpc_nacl_info:
|
||||||
|
nacl_ids:
|
||||||
|
- "{{ nacl.nacl_id }}"
|
||||||
|
register: nacl_facts
|
||||||
|
|
||||||
|
- name: assert the nacl has the correct attributes
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl_facts.nacls[0].tags | length == 1
|
||||||
|
- "'{{ nacl_facts.nacls[0].tags.Name }}' == '{{ resource_prefix }}-acl'"
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
- name: remove the network ACL
|
||||||
|
ec2_vpc_nacl:
|
||||||
|
vpc_id: "{{ vpc_id }}"
|
||||||
|
name: "{{ resource_prefix }}-acl"
|
||||||
|
state: absent
|
||||||
|
register: nacl
|
||||||
|
until: nacl is success
|
||||||
|
ignore_errors: yes
|
||||||
|
retries: 5
|
||||||
|
delay: 5
|
||||||
|
|
||||||
|
- name: assert nacl was removed
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- nacl.changed
|
||||||
Loading…
Reference in New Issue