mirror of https://github.com/ansible/ansible.git
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
141 lines
3.8 KiB
YAML
141 lines
3.8 KiB
YAML
# ============================================================
|
|
|
|
- name: create ingress and egress rules using subnet names
|
|
ec2_vpc_nacl:
|
|
vpc_id: "{{ vpc_id }}"
|
|
name: "{{ resource_prefix }}-acl"
|
|
subnets: "{{ subnet_names }}"
|
|
tags:
|
|
Created_by: "Ansible test {{ resource_prefix }}"
|
|
ingress:
|
|
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
|
|
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
|
|
- [300, 'icmp', 'allow', '0.0.0.0/0', 0, 8]
|
|
egress:
|
|
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
|
|
state: 'present'
|
|
register: nacl
|
|
|
|
- set_fact:
|
|
nacl_id: "{{ nacl.nacl_id }}"
|
|
|
|
- name: assert the network acl was created
|
|
assert:
|
|
that:
|
|
- nacl.changed
|
|
- nacl.nacl_id.startswith('acl-')
|
|
|
|
- name: get network ACL facts
|
|
ec2_vpc_nacl_info:
|
|
nacl_ids:
|
|
- "{{ nacl_id }}"
|
|
register: nacl_facts
|
|
|
|
- name: assert the nacl has the correct attributes
|
|
assert:
|
|
that:
|
|
- nacl_facts.nacls | length == 1
|
|
- nacl_facts.nacls[0].nacl_id == nacl_id
|
|
- nacl_facts.nacls[0].subnets | length == 4
|
|
- nacl_facts.nacls[0].ingress | length == 3
|
|
- nacl_facts.nacls[0].egress | length == 1
|
|
- "'{{ nacl_facts.nacls[0].tags.Name }}' == '{{ resource_prefix }}-acl'"
|
|
|
|
# ============================================================
|
|
|
|
- name: test idempotence
|
|
ec2_vpc_nacl:
|
|
vpc_id: "{{ vpc_id }}"
|
|
name: "{{ resource_prefix }}-acl"
|
|
subnets: "{{ subnet_names }}"
|
|
tags:
|
|
Created_by: "Ansible test {{ resource_prefix }}"
|
|
ingress:
|
|
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
|
|
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
|
|
- [300, 'icmp', 'allow', '0.0.0.0/0', 0, 8]
|
|
egress:
|
|
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
|
|
state: 'present'
|
|
register: nacl
|
|
|
|
- name: assert the network acl already existed
|
|
assert:
|
|
that:
|
|
- not nacl.changed
|
|
- nacl.nacl_id == nacl_id
|
|
- nacl.nacl_id.startswith('acl-')
|
|
|
|
- name: get network ACL facts
|
|
ec2_vpc_nacl_info:
|
|
nacl_ids:
|
|
- "{{ nacl.nacl_id }}"
|
|
register: nacl_facts_idem
|
|
|
|
- name: assert the facts are the same as before
|
|
assert:
|
|
that:
|
|
- nacl_facts_idem == nacl_facts
|
|
|
|
# ============================================================
|
|
|
|
- name: remove a subnet from the network ACL
|
|
ec2_vpc_nacl:
|
|
vpc_id: "{{ vpc_id }}"
|
|
name: "{{ resource_prefix }}-acl"
|
|
subnets:
|
|
- "{{ subnet_names[0] }}"
|
|
- "{{ subnet_names[1] }}"
|
|
- "{{ subnet_names[2] }}"
|
|
tags:
|
|
Created_by: "Ansible test {{ resource_prefix }}"
|
|
ingress:
|
|
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
|
|
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
|
|
- [300, 'icmp', 'allow', '0.0.0.0/0', 0, 8]
|
|
egress:
|
|
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
|
|
state: 'present'
|
|
register: nacl
|
|
|
|
- name: assert the network ACL changed
|
|
assert:
|
|
that:
|
|
- nacl.changed
|
|
- nacl.nacl_id == nacl_id
|
|
- nacl.nacl_id.startswith('acl-')
|
|
|
|
- name: get network ACL facts
|
|
ec2_vpc_nacl_info:
|
|
nacl_ids:
|
|
- "{{ nacl.nacl_id }}"
|
|
register: nacl_facts
|
|
|
|
- name: assert the nacl has the correct attributes
|
|
assert:
|
|
that:
|
|
- nacl_facts.nacls | length == 1
|
|
- nacl_facts.nacls[0].nacl_id == nacl_id
|
|
- nacl_facts.nacls[0].subnets | length == 3
|
|
- nacl_facts.nacls[0].ingress | length == 3
|
|
- nacl_facts.nacls[0].egress | length == 1
|
|
- "'{{ nacl_facts.nacls[0].tags.Name }}' == '{{ resource_prefix }}-acl'"
|
|
|
|
# ============================================================
|
|
|
|
- name: remove the network ACL
|
|
ec2_vpc_nacl:
|
|
vpc_id: "{{ vpc_id }}"
|
|
name: "{{ resource_prefix }}-acl"
|
|
state: absent
|
|
register: nacl
|
|
until: nacl is success
|
|
ignore_errors: yes
|
|
retries: 5
|
|
delay: 5
|
|
|
|
- name: assert nacl was removed
|
|
assert:
|
|
that:
|
|
- nacl.changed
|