Add support for "ipv6_cidr_block" to "aws_default_network_acl" and "aws_default_security_group" resources

[tylert]

I'm just starting out using Terraform and am very happy with it.

Lots of lovely IPv6 support was added to the "aws_network_acl" and "aws_security_group" resources in v0.9.9.

However, the "aws_default_network_acl" and "aws_default_security_group" resources still do not have support for the "ipv6_cidr_block" arguments (at least, not according to the https://www.terraform.io/docs/providers/aws/r/default_network_acl.html and https://www.terraform.io/docs/providers/aws/r/default_security_group.html pages).

Terraform Version

v0.9.11

Affected Resource(s)

• aws_default_network_acl
• aws_default_security_group

Terraform Configuration Files

Make sure you created a VPC with "assign_generated_ipv6_cidr_block = true" and then try to tag the default acl and security groups that got created...

...
# Just tag the default network acl but also replace the rules that got cleared out automatically

resource "aws_default_network_acl" "default_acl" {
  default_network_acl_id = "${aws_vpc.main.default_network_acl_id}"

  ingress {
    from_port  = 0
    to_port    = 0
    protocol   = -1
    cidr_block = "0.0.0.0/0"
    rule_no    = 100
    action     = "allow"
  }

  /* XXX FIXME XXX Not supported yet
  ingress {
    from_port       = 0
    to_port         = 0
    protocol        = -1
    ipv6_cidr_block = "::/0"
    rule_no         = 101
    action          = "allow"
  }
  */

  egress {
    from_port  = 0
    to_port    = 0
    protocol   = -1
    cidr_block = "0.0.0.0/0"
    rule_no    = 100
    action     = "allow"
  }

  /* XXX FIXME XXX Not supported yet
  egress {
    from_port       = 0
    to_port         = 0
    protocol        = -1
    ipv6_cidr_block = "::/0"
    rule_no         = 101
    action          = "allow"
  }
  */

  tags = {
    Name        = "${var.basename}_def_acl"
    Environment = "${var.environment}"
  }
}
...
# Just tag the default sg but also replace the rules that got cleared out automatically

resource "aws_default_security_group" "default" {
  vpc_id = "${aws_vpc.main.id}"

  ingress {
    from_port = 0
    to_port   = 0
    protocol  = -1
    self      = true
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  /* XXX FIXME XXX Not supported yet
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    ipv6_cidr_blocks = ["::/0"]
  }
  */

  tags = {
    Name        = "${var.basename}_def_sg"
    Environment = "${var.environment}"
  }
}
...

Debug Output

N/A; enhancement

Panic Output

N/A; enhancement

Expected Behavior

It would be really swell if the "aws_default_network_acl" and "aws_default_security_group" resources supported the same set of arguments as their corresponding counterparts; "aws_network_acl" and "aws_security_group", respectively.

Actual Behavior

At the moment, if you choose to tag your default ACL and SG, you'll lose the default allow rules for "::/0".

Steps to Reproduce

N/A; enhancement

Important Factoids

N/A; enhancement

References

N/A; enhancement

[tylert]

@stack72 🥇 Is this a candidate for inclusion in 0.1.3?

[stack72]

Hi I'm afraid this will only be part of the 0.10 release - this doesn't qualify as a regression requiring a point release Sorry! Paul

…

On Tue, 11 Jul 2017 at 22:18, Tyler Tidman ***@***.***> wrote: @stack72 <https://github.com/stack72> 🥇 Is this a candidate for inclusion in 0.9.12 or 0.10.0? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1096 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAN57zf2puek1CbHQH_3PxM5J0dbC-9kks5sM8p6gaJpZM4OTH9E> .

[tylert]

@stack72 not a problem. Thankfully, this isn't a blocker for me at the moment so I don't need to worry about building my own yet. Thanks for the quick turn-around 👍 .

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!