(EC2): document how to workaround Network ACL rule 100

[MHacker9404]

The default NACL created with a custom VPC has a default "100 - Allow All" ingress rule. This should not be since we can't delete rules after the fact thru the CDK.

Reproduction Steps

What did you expect to happen?

What actually happened?

Environment

• CDK CLI Version :
• Framework Version:
• Node.js Version:
• OS :
• Language (Version):

Other

---

This is 🐛 Bug Report

[rix0rrr]

Some example code would have been helpful.

Nevertheless, I'm fairly sure that it's not the CDK adding that rule, but EC2's (and our CloudFormation's) underlying implementation.

Your solutions seem to be:

• Use a custom resource to remove rule 100
• Insert rules with a smaller number than 100 (potentially a deny-all rule at 99)
• File a bug report with CloudFormation asking them to make it possible to remove/overwrite rule 100.

I will keep this ticket open as a reminder that this is something that could and should probably be called out in documentation.

[MHacker9404]

That’s why I added the images – I didn’t have any code whatsoever to create the NACL. This was part of the default from the vpc itself – which your point #2 shows why this is a bad default. ` // build the VPC const subnetConfiguration: SubnetConfiguration[] = [ { name: 'public', cidrMask: 24, subnetType: SubnetType.PUBLIC, }, ]; const vpcProps: VpcProps = { cidr: '10.0.0.0/16', subnetConfiguration, maxAzs: 99, }; const vpc = new Vpc(this, 'VPC', vpcProps); ` From: Rico Huijbers <notifications@github.com> Sent: 24 February, 2021 08:19 To: aws/aws-cdk <aws-cdk@noreply.github.com> Cc: Phil Boyd <phil.boyd@live.com>; Author <author@noreply.github.com> Subject: Re: [aws/aws-cdk] (EC2): default NACL in custom VPC has invalid ingress rule.... (#13220) Some example code would have been helpful. Nevertheless, I'm fairly sure that it's not the CDK adding that rule, but EC2's (and our CloudFormation's) underlying implementation. Your solutions seem to be: * Use a custom resource to remove rule 100 * Insert rules with a smaller number than 100 (potentially a deny-all rule at 99) * File a bug report with CloudFormation asking them to make it possible to remove/overwrite rule 100. I will keep this ticket open as a reminder that this is something that could and should probably be called out in documentation. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<#13220 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AA75SHDDLK4I3OYBG5SRUE3TAT4DNANCNFSM4YCVW5RA>.

[rix0rrr]

Well the default ACL just gets created with the default settings. Not exactly sure what the process is, but if you care about NACLs then wouldn't creating a NetworkACL object allow you to modify the rules?

Does a fresh NetworkACL object also come with default rule 100?

[MHacker9404]

Then I have to figure out how to swap it out for the default NACL…

[rix0rrr]

That is true. It might just be that the CloudFormation story for Network ACLs has been underdeveloped.

But if that's true, then there's not a lot that the CDK can do to make it better, I'm afraid