Add support for aws_subnet_network_acl_association

[gkrizek]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

We are missing something similar to AWS::EC2::SubnetNetworkAclAssociation in CloudFormation. There currently isn't a way to associate subnets with network acls. I think we need to create a aws_subnet_network_acl_association resource for this. Only parameters needed are subnet_id and network_acl_id.

New or Affected Resource(s)

• aws_subnet_network_acl_association

Potential Terraform Configuration

resource "aws_subnet_network_acl_association" "subnet_a" {
  subnet_id      = "${aws_subnet.public_a.id}"
  network_acl_id = "${aws_network_acl.public_acl.id}"
}

References

• https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-subnet-network-acl-assoc.html

[catsby]

Hey @gkrizek ! We're beholden to the public API / SDK, which I'm having difficulty finding this API call in, do you by chance know where I can find it?

I'm looking here:

• https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Welcome.html

[gkrizek]

@catsby, I think you are right! I don't see any API method for associating a subnet with a Network ACL. So I guess it's not possible. I just ran my terraform template without this feature and it worked on. I just have to use the default Network ACL that is created with the VPC instead of creating a new one.

So I'm able to work around it, but it's strange AWS doesn't have an API for that.

[phillbaker]

@catsby would ReplaceNetworkAclAssociation documented in https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceNetworkAclAssociation.html handle this functionality?

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!