(EC2): document how to workaround Network ACL rule 100

The default NACL created with a custom VPC has a default “100 - Allow All” ingress rule. This should not be since we can’t delete rules after the fact thru the CDK.

Reproduction Steps

What did you expect to happen?

What actually happened?

Environment

• CDK CLI Version :
• Framework Version:
• Node.js Version:
• OS :
• Language (Version):

Other

---

This is 🐛 Bug Report

[zachgoll]

For anyone stumbling on this in the future, there’s a much simpler solution than expressed above (I’m guessing due to CDK updates). Leaving an example below for a basic VPC with a public subnet and private subnet with a NAT Gateway (CDK default).

This solution of course mirrors the “allow everything” model, but the skeleton is there to customize it however you want. This solution creates a separate network ACL for the public and private subnets (regardless of how many subnets you have).

The not-so-obvious part of this solution is the fact that subnetSelection: { subnetType: ... } is the line that does all the network acl to subnet associations for you. It will dissociate the default network ACL (CDK default) and re-associate these newly created ACLs.

const vpc = new Vpc(this, 'VPC', {
    maxAzs: 2,
})

const publicNetworkACL = new NetworkAcl(this, 'PublicNetworkACL', {
    vpc,
    subnetSelection: { subnetType: SubnetType.PUBLIC },
})

publicNetworkACL.addEntry('AllowAllIngress', {
    cidr: AclCidr.anyIpv4(),
    ruleNumber: 100,
    traffic: AclTraffic.allTraffic(),
    direction: TrafficDirection.INGRESS,
    ruleAction: Action.ALLOW,
})

publicNetworkACL.addEntry('AllowAllEgress', {
    cidr: AclCidr.anyIpv4(),
    ruleNumber: 100,
    traffic: AclTraffic.allTraffic(),
    direction: TrafficDirection.EGRESS,
    ruleAction: Action.ALLOW,
})

const privateNetworkACL = new NetworkAcl(this, 'PrivateNetworkACL', {
    vpc: this.vpc,
    subnetSelection: { subnetType: SubnetType.PRIVATE_WITH_NAT },
})

privateNetworkACL.addEntry('AllowAllIngress', {
    cidr: AclCidr.anyIpv4(),
    ruleNumber: 100,
    traffic: AclTraffic.allTraffic(),
    direction: TrafficDirection.INGRESS,
    ruleAction: Action.ALLOW,
})

privateNetworkACL.addEntry('AllowAllEgress', {
    cidr: AclCidr.anyIpv4(),
    ruleNumber: 100,
    traffic: AclTraffic.allTraffic(),
    direction: TrafficDirection.EGRESS,
    ruleAction: Action.ALLOW,
})

Hope this helps!

[ALFmachine]

my current work around building off of this concept

import * as cdk from "aws-cdk-lib";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import {
  AwsCustomResource,
  AwsCustomResourcePolicy,
  PhysicalResourceId,
} from "aws-cdk-lib/custom-resources";
import { Construct } from "constructs";

export class BaseVpc extends ec2.Vpc {
  constructor(scope: Construct, id: string, props: ec2.VpcProps) {
    super(scope, id, props);

    const defaultNacl = this.vpcDefaultNetworkAcl;
    const options = [true, false];
    const stack = cdk.Stack.of(this);

    options.forEach((option) => {
      const type = option ? "egress" : "ingress";

      new AwsCustomResource(this, `restrict-default-nacl-${type}`, {
        onCreate: {
          action: "deleteNetworkAclEntry",
          parameters: {
            Egress: option,
            NetworkAclId: defaultNacl,
            RuleNumber: 100,
          },
          physicalResourceId: PhysicalResourceId.of(
            `restrict-nacl-${this.vpcId}-${defaultNacl}-${type}`
          ),
          service: "EC2",
        },
        policy: AwsCustomResourcePolicy.fromSdkCalls({
          resources: [
            `arn:aws:ec2:${stack.region}:${stack.account}:network-acl/${defaultNacl}`,
          ],
        }),
      });
    });
  }
}