* 2.10.0 -- 2024-06-05

  - tag-shared-vpc-resources
    - use awscc provider to get network acl vs null resource

CHANGELOG.md

@@ -395,3 +395,8 @@
 * 2.9.18 -- 2024-05-09
   - tag-shared-vpc-resources
     - remap Name tag of route_table if the AZ ID is different in the source vs the taget (within the assocaated subnets)
+
+* 2.10.0 -- 2024-06-05
+  - tag-shared-vpc-resources
+    - use awscc provider to get network acl vs null resource
+

common/version.tf

@@ -1,5 +1,5 @@
 locals {
-  _module_version = "2.9.18"
+  _module_version = "2.10.0"
   _module_names = {
     "_main_" = "aws-vpc-setup"
 

tag-shared-vpc-resources/tag-network-acls.tf

@@ -40,7 +40,7 @@ locals {
   _nacl_enabled = var.tag_enabled_network_acls
   #  _network_acls         = { for k, v in data.local_file.network_acl : k => jsondecode(v.content) if local._nacl_enabled }
   #  network_acls_tags     = { for k, v in local.network_acls : k => merge({ for t in v.Tags : t.Key => t.Value }, { "boc:vpc:owner_id" = v.OwnerId }) }
-  network_acls_tags     = { for k, v in data.awscc_ec2_network_acl.nacls : k => merge(v.tags, { "boc:vpc:owner_id" = v.owner_id }) }
+  network_acls_tags     = { for k, v in data.awscc_ec2_network_acl.nacls : k => merge({ for t in v.tags : t.key => t.value }, { "boc:vpc:owner_id" = data.aws_caller_identity.network_account.account_id }) }
   network_acls_tags_map = flatten([for k, v in local.network_acls_tags : [for tk, tv in v : { label = format("%v__%v", k, tk), network_acl_id = k, key = tk, value = tv }]])
 }
 

tag-shared-vpc-resources/tag-network-acls.tf.old

@@ -0,0 +1,103 @@
+data "aws_network_acls" "network_acls" {
+  for_each = local._nacl_enabled ? toset(data.aws_vpcs.vpcs.ids) : toset([])
+  filter {
+    name   = "owner-id"
+    values = [data.aws_arn.network_account.account]
+  }
+  filter {
+    name   = "vpc-id"
+    values = [each.key]
+  }
+}
+
+## data "aws_network_acl" "network_acl" {
+##   provider = aws.network_account
+##   for_each = toset(flatten(concat([for k, v in data.aws_network_acls.network_acls : v.ids])))
+##   id       = each.key
+## }
+
+# there is no aws_network_acl data resource. Fake this out with null_resource
+#  aws --profile "057445207498-ent-gov-network-sa" --region $(get-region) ec2 describe-network-acls --network-acl-id "acl-0c19a5f3ea6a86d51"  > X.json
+# there is still no aws_network_acl, but there is an issue for it
+#   https://github.com/hashicorp/terraform-provider-aws/issues/19754
+
+resource "null_resource" "setup_directory" {
+  triggers = {
+    directory = "setup"
+  }
+
+  provisioner "local-exec" {
+    command = "test -d ${path.root}/${self.triggers.directory} || mkdir -p ${path.root}/${self.triggers.directory}"
+  }
+}
+
+resource "null_resource" "network_acl" {
+  for_each = toset(flatten(concat([for k, v in data.aws_network_acls.network_acls : v.ids])))
+  triggers = {
+    directory      = null_resource.setup_directory.triggers.directory
+    network_acl_id = each.key
+    filename       = "network_acl.${each.key}.json"
+    full_filename  = format("%v/%v/%v", path.root, "setup", "network_acl.${each.key}.json")
+  }
+
+  provisioner "local-exec" {
+    working_dir = path.root
+    command     = "${path.module}/bin/assume_role_wrapper.sh aws ec2 describe-network-acls --network-acl-id ${each.key} --output json > ${self.triggers.directory}/${self.triggers.filename}"
+    environment = {
+      AWS_PROFILE = var.profile
+      AWS_REGION  = local.region
+      ROLE_ARN    = var.role_arn
+    }
+  }
+}
+
+data "local_file" "network_acl" {
+  #  for_each = toset(flatten(concat([for k, v in data.aws_network_acls.network_acls : v.ids])))
+  for_each = null_resource.network_acl
+  #  filename = format("%v/%v/%v", path.root, each.value.triggers.directory, each.value.triggers.filename)
+  filename = each.value.triggers.full_filename
+}
+
+resource "null_resource" "network_acls" {
+  triggers = {
+    network_acls = join(",", [for k, v in data.local_file.network_acl : v.filename])
+    filename     = format("%v/%v/%v", path.root, "setup", "network_acls_extracted.dat")
+  }
+  provisioner "local-exec" {
+    command = "touch ${self.triggers.filename}"
+  }
+}
+
+
+## output "network_acls" {
+##   value = data.aws_network_acls.network_acls
+## }
+## 
+## output "network_acl" {
+## ##  value = data.aws_network_acl.network_acl
+##   value = local.network_acls
+## }
+
+locals {
+  #  _nacl_enabled         = var.tag_enabled_network_acls
+  #  _network_acls         = local._nacl_enabled ? { for k, v in data.local_file.network_acl : k => jsondecode(v.content) } : {}
+  #  network_acls          = fileexists(null_resource.network_acls.triggers.filename) ? { for k, v in local._network_acls : k => lookup(v, "NetworkAcls", [{ "Tags" : [], "OwnerId" : "" }])[0] } : {}
+  #  network_acls_tags     = fileexists(null_resource.network_acls.triggers.filename) ? { for k, v in local.network_acls : k => merge({ for t in v.Tags : t.Key => t.Value }, { "boc:vpc:owner_id" = v.OwnerId }) } : {}
+  #  network_acls_tags_map = fileexists(null_resource.network_acls.triggers.filename) ? flatten([for k, v in local.network_acls_tags : [for tk, tv in v : { label = format("%v__%v", k, tk), network_acl_id = k, key = tk, value = tv }]]) : []
+
+  _nacl_enabled         = var.tag_enabled_network_acls
+  _network_acls         = { for k, v in data.local_file.network_acl : k => jsondecode(v.content) if local._nacl_enabled }
+  network_acls          = { for k, v in local._network_acls : k => lookup(v, "NetworkAcls", [{ "Tags" : [], "OwnerId" : "" }])[0] }
+  network_acls_tags     = { for k, v in local.network_acls : k => merge({ for t in v.Tags : t.Key => t.Value }, { "boc:vpc:owner_id" = v.OwnerId }) }
+  network_acls_tags_map = flatten([for k, v in local.network_acls_tags : [for tk, tv in v : { label = format("%v__%v", k, tk), network_acl_id = k, key = tk, value = tv }]])
+}
+
+resource "aws_ec2_tag" "network_acls" {
+  for_each = { for t in local.network_acls_tags_map : t.label => t }
+
+  resource_id = each.value.network_acl_id
+  key         = each.value.key
+  value       = each.value.value
+
+  #  depends_on = [null_resource.network_acl]
+}