Add restricted nacls

data-dot-all · Aug 3, 2023 · 63e3d4f · 63e3d4f
1 parent 041df7a
commit 63e3d4f
Show file tree

Hide file tree

Showing 4 changed files with 7 additions and 0 deletions.
diff --git a/cdk.json b/cdk.json
@@ -13,7 +13,9 @@
         "account": "033050164246",
         "region": "us-east-1",
         "prod_sizing": false,
+        "vpc_restricted_nacl": true,
         "enable_pivot_role_auto_create": true
+
       }
     ]
   }

diff --git a/deploy/stacks/backend_stack.py b/deploy/stacks/backend_stack.py
@@ -36,6 +36,7 @@ def __init__(
         image_tag=None,
         pipeline_bucket=None,
         vpc_id=None,
+        vpc_restricted_nacls=False,
         vpc_endpoints_sg=None,
         internet_facing=True,
         custom_domain=None,
@@ -65,6 +66,7 @@ def __init__(
             resource_prefix=resource_prefix,
             vpc_endpoints_sg=vpc_endpoints_sg,
             vpc_id=vpc_id,
+            restricted_nacl=vpc_restricted_nacls,
             **kwargs,
         )
         vpc = self.vpc_stack.vpc

diff --git a/deploy/stacks/backend_stage.py b/deploy/stacks/backend_stage.py
@@ -18,6 +18,7 @@ def __init__(
         tooling_account_id=None,
         pipeline_bucket=None,
         vpc_id=None,
+        vpc_restricted_nacls=False,
         vpc_endpoints_sg=None,
         internet_facing=True,
         custom_domain=None,
@@ -47,6 +48,7 @@ def __init__(
             pipeline_bucket=pipeline_bucket,
             image_tag=commit_id,
             vpc_id=vpc_id,
+            vpc_restricted_nacls=vpc_restricted_nacls,
             vpc_endpoints_sg=vpc_endpoints_sg,
             internet_facing=internet_facing,
             custom_domain=custom_domain,

diff --git a/deploy/stacks/pipeline.py b/deploy/stacks/pipeline.py
@@ -604,6 +604,7 @@ def set_backend_stage(self, target_env, repository_name):
                 commit_id=self.image_tag,
                 vpc_id=target_env.get('vpc_id'),
                 vpc_endpoints_sg=target_env.get('vpc_endpoints_sg'),
+                vpc_restricted_nacls=target_env.get('vpc_restricted_nacl', False),
                 internet_facing=target_env.get('internet_facing', True),
                 custom_domain=target_env.get('custom_domain'),
                 ip_ranges=target_env.get('ip_ranges'),