Added network ACLs

[dylanratcliffe]

No description provided.

[github-actions]

Expected Changes

ec2-launch-template › lt-0731f767e6be2ab94

--- current
+++ planned
@@ -14,14 +14,14 @@
 hibernation_options: []
 iam_instance_profile: []
 id: lt-0731f767e6be2ab94
-image_id: ami-0a2b52b696339c85d
+image_id: ami-0696036841f0f18bd
 instance_initiated_shutdown_behavior: ""
 instance_market_options: []
 instance_requirements: []
 instance_type: t3.micro
 kernel_id: ""
 key_name: ""
-latest_version: 2
+latest_version: (known after apply)
 license_specification: []
 maintenance_options: []
 metadata_options: []

ec2-instance › i-0a525744b5dac529d

--- current
+++ planned
@@ -1,90 +1,63 @@
-ami: ami-0a2b52b696339c85d
-arn: arn:aws:ec2:eu-west-2:540044833068:instance/i-0a525744b5dac529d
+ami: ami-0696036841f0f18bd
+arn: (known after apply)
 associate_public_ip_address: true
-availability_zone: eu-west-2b
-capacity_reservation_specification:
-    - capacity_reservation_preference: open
-      capacity_reservation_target: []
-cpu_core_count: 1
-cpu_options:
-    - amd_sev_snp: ""
-      core_count: 1
-      threads_per_core: 2
-cpu_threads_per_core: 2
-credit_specification:
-    - cpu_credits: unlimited
-disable_api_stop: false
-disable_api_termination: false
-ebs_block_device: []
-ebs_optimized: false
-enclave_options:
-    - enabled: false
-ephemeral_block_device: []
+availability_zone: (known after apply)
+capacity_reservation_specification: (known after apply)
+cpu_core_count: (known after apply)
+cpu_options: (known after apply)
+cpu_threads_per_core: (known after apply)
+credit_specification: []
+disable_api_stop: (known after apply)
+disable_api_termination: (known after apply)
+ebs_block_device: (known after apply)
+ebs_optimized: (known after apply)
+enclave_options: (known after apply)
+ephemeral_block_device: (known after apply)
 get_password_data: false
-hibernation: false
-host_id: ""
-host_resource_group_arn: null
-iam_instance_profile: ""
-id: i-0a525744b5dac529d
-instance_initiated_shutdown_behavior: stop
-instance_lifecycle: ""
-instance_market_options: []
-instance_state: running
+hibernation: null
+host_id: (known after apply)
+host_resource_group_arn: (known after apply)
+iam_instance_profile: (known after apply)
+id: (known after apply)
+instance_initiated_shutdown_behavior: (known after apply)
+instance_lifecycle: (known after apply)
+instance_market_options: (known after apply)
+instance_state: (known after apply)
 instance_type: t3.micro
-ipv6_address_count: 0
-ipv6_addresses: []
+ipv6_address_count: (known after apply)
+ipv6_addresses: (known after apply)
 key_name: Demo Key Pair
 launch_template: []
-maintenance_options:
-    - auto_recovery: default
-metadata_options:
-    - http_endpoint: enabled
-      http_protocol_ipv6: disabled
-      http_put_response_hop_limit: 1
-      http_tokens: optional
-      instance_metadata_tags: disabled
-monitoring: false
-network_interface: []
-outpost_arn: ""
-password_data: ""
-placement_group: ""
-placement_partition_number: 0
-primary_network_interface_id: eni-052b9ce8c42900c07
-private_dns: ip-10-0-10-86.eu-west-2.compute.internal
-private_dns_name_options:
-    - enable_resource_name_dns_a_record: false
-      enable_resource_name_dns_aaaa_record: false
-      hostname_type: ip-name
-private_ip: 10.0.10.86
-public_dns: ec2-18-175-243-185.eu-west-2.compute.amazonaws.com
-public_ip: 18.175.243.185
-root_block_device:
-    - delete_on_termination: true
-      device_name: /dev/xvda
-      encrypted: false
-      iops: 0
-      kms_key_id: ""
-      tags: {}
-      tags_all: {}
-      throughput: 0
-      volume_id: vol-087349579eb65ac71
-      volume_size: 8
-      volume_type: standard
-secondary_private_ips: []
-security_groups: []
+maintenance_options: (known after apply)
+metadata_options: (known after apply)
+monitoring: (known after apply)
+network_interface: (known after apply)
+outpost_arn: (known after apply)
+password_data: (known after apply)
+placement_group: (known after apply)
+placement_partition_number: (known after apply)
+primary_network_interface_id: (known after apply)
+private_dns: (known after apply)
+private_dns_name_options: (known after apply)
+private_ip: (known after apply)
+public_dns: (known after apply)
+public_ip: (known after apply)
+root_block_device: (known after apply)
+secondary_private_ips: (known after apply)
+security_groups: (known after apply)
 source_dest_check: true
-spot_instance_request_id: ""
+spot_instance_request_id: (known after apply)
 subnet_id: subnet-036704734045071f9
 tags:
     Name: App Server
 tags_all:
     Name: App Server
-tenancy: default
+tenancy: (known after apply)
 terraform_address: module.scenarios[0].aws_instance.app_server
 terraform_name: module.scenarios[0].aws_instance.app_server
 timeouts: null
-user_data: null
-user_data_base64: null
+user_data: (known after apply)
+user_data_base64: (known after apply)
 user_data_replace_on_change: false
 volume_tags: null
 vpc_security_group_ids:

ec2-instance › i-05bccc870971a2004

--- current
+++ planned
@@ -1,90 +1,63 @@
-ami: ami-0a2b52b696339c85d
-arn: arn:aws:ec2:eu-west-2:540044833068:instance/i-05bccc870971a2004
+ami: ami-0696036841f0f18bd
+arn: (known after apply)
 associate_public_ip_address: true
-availability_zone: eu-west-2a
-capacity_reservation_specification:
-    - capacity_reservation_preference: open
-      capacity_reservation_target: []
-cpu_core_count: 1
-cpu_options:
-    - amd_sev_snp: ""
-      core_count: 1
-      threads_per_core: 2
-cpu_threads_per_core: 2
-credit_specification:
-    - cpu_credits: unlimited
-disable_api_stop: false
-disable_api_termination: false
-ebs_block_device: []
-ebs_optimized: false
-enclave_options:
-    - enabled: false
-ephemeral_block_device: []
+availability_zone: (known after apply)
+capacity_reservation_specification: (known after apply)
+cpu_core_count: (known after apply)
+cpu_options: (known after apply)
+cpu_threads_per_core: (known after apply)
+credit_specification: []
+disable_api_stop: (known after apply)
+disable_api_termination: (known after apply)
+ebs_block_device: (known after apply)
+ebs_optimized: (known after apply)
+enclave_options: (known after apply)
+ephemeral_block_device: (known after apply)
 get_password_data: false
-hibernation: false
-host_id: ""
-host_resource_group_arn: null
-iam_instance_profile: ""
-id: i-05bccc870971a2004
-instance_initiated_shutdown_behavior: stop
-instance_lifecycle: ""
-instance_market_options: []
-instance_state: running
+hibernation: null
+host_id: (known after apply)
+host_resource_group_arn: (known after apply)
+iam_instance_profile: (known after apply)
+id: (known after apply)
+instance_initiated_shutdown_behavior: (known after apply)
+instance_lifecycle: (known after apply)
+instance_market_options: (known after apply)
+instance_state: (known after apply)
 instance_type: t3.micro
-ipv6_address_count: 0
-ipv6_addresses: []
+ipv6_address_count: (known after apply)
+ipv6_addresses: (known after apply)
 key_name: Demo Key Pair
 launch_template: []
-maintenance_options:
-    - auto_recovery: default
-metadata_options:
-    - http_endpoint: enabled
-      http_protocol_ipv6: disabled
-      http_put_response_hop_limit: 1
-      http_tokens: optional
-      instance_metadata_tags: disabled
-monitoring: false
-network_interface: []
-outpost_arn: ""
-password_data: ""
-placement_group: ""
-placement_partition_number: 0
-primary_network_interface_id: eni-05a61fe5efd2c3a26
-private_dns: ip-10-0-9-45.eu-west-2.compute.internal
-private_dns_name_options:
-    - enable_resource_name_dns_a_record: false
-      enable_resource_name_dns_aaaa_record: false
-      hostname_type: ip-name
-private_ip: 10.0.9.45
-public_dns: ec2-13-40-131-98.eu-west-2.compute.amazonaws.com
-public_ip: 13.40.131.98
-root_block_device:
-    - delete_on_termination: true
-      device_name: /dev/xvda
-      encrypted: false
-      iops: 0
-      kms_key_id: ""
-      tags: {}
-      tags_all: {}
-      throughput: 0
-      volume_id: vol-04ea3f96ac619251d
-      volume_size: 8
-      volume_type: standard
-secondary_private_ips: []
-security_groups: []
+maintenance_options: (known after apply)
+metadata_options: (known after apply)
+monitoring: (known after apply)
+network_interface: (known after apply)
+outpost_arn: (known after apply)
+password_data: (known after apply)
+placement_group: (known after apply)
+placement_partition_number: (known after apply)
+primary_network_interface_id: (known after apply)
+private_dns: (known after apply)
+private_dns_name_options: (known after apply)
+private_ip: (known after apply)
+public_dns: (known after apply)
+public_ip: (known after apply)
+root_block_device: (known after apply)
+secondary_private_ips: (known after apply)
+security_groups: (known after apply)
 source_dest_check: true
-spot_instance_request_id: ""
+spot_instance_request_id: (known after apply)
 subnet_id: subnet-06302fc5a50644cd9
 tags:
     Name: Webserver
 tags_all:
     Name: Webserver
-tenancy: default
+tenancy: (known after apply)
 terraform_address: module.scenarios[0].aws_instance.webserver
 terraform_name: module.scenarios[0].aws_instance.webserver
 timeouts: null
-user_data: null
-user_data_base64: null
+user_data: (known after apply)
+user_data_base64: (known after apply)
 user_data_replace_on_change: false
 volume_tags: null
 vpc_security_group_ids:

Unmapped Changes

Note

These changes couldn't be mapped to a discoverable cloud resource and therefore won't be included in the blast radius calculation.

aws_network_acl › module.scenarios[0].aws_network_acl.block_high_ports

--- current
+++ planned
@@ -1 +1,40 @@
+arn: (known after apply)
+egress:
+    - action: allow
+      cidr_block: 0.0.0.0/0
+      from_port: 1
+      icmp_code: null
+      icmp_type: null
+      ipv6_cidr_block: ""
+      protocol: "-1"
+      rule_no: 100
+      to_port: 65535
+id: (known after apply)
+ingress:
+    - action: allow
+      cidr_block: 0.0.0.0/0
+      from_port: 22
+      icmp_code: null
+      icmp_type: null
+      ipv6_cidr_block: ""
+      protocol: tcp
+      rule_no: 100
+      to_port: 22
+    - action: deny
+      cidr_block: 0.0.0.0/0
+      from_port: 20000
+      icmp_code: null
+      icmp_type: null
+      ipv6_cidr_block: ""
+      protocol: tcp
+      rule_no: 200
+      to_port: 65535
+owner_id: (known after apply)
+subnet_ids: (known after apply)
+tags:
+    Name: block-high-ports-nacl
+tags_all:
+    Name: block-high-ports-nacl
+terraform_address: module.scenarios[0].aws_network_acl.block_high_ports
+terraform_name: module.scenarios[0].aws_network_acl.block_high_ports
+vpc_id: vpc-0be4b791e20954fea

aws_network_acl_association › module.scenarios[0].aws_network_acl_association.subnet_0482035a966810071

--- current
+++ planned
@@ -1 +1,5 @@
+id: (known after apply)
+network_acl_id: (known after apply)
+subnet_id: subnet-0482035a966810071
+terraform_address: module.scenarios[0].aws_network_acl_association.subnet_0482035a966810071
+terraform_name: module.scenarios[0].aws_network_acl_association.subnet_0482035a966810071

aws_network_acl_association › module.scenarios[0].aws_network_acl_association.subnet_05ef77bb39c151e08

--- current
+++ planned
@@ -1 +1,5 @@
+id: (known after apply)
+network_acl_id: (known after apply)
+subnet_id: subnet-05ef77bb39c151e08
+terraform_address: module.scenarios[0].aws_network_acl_association.subnet_05ef77bb39c151e08
+terraform_name: module.scenarios[0].aws_network_acl_association.subnet_05ef77bb39c151e08

aws_network_acl_association › module.scenarios[0].aws_network_acl_association.subnet_07e9f4f746f63ed3d

--- current
+++ planned
@@ -1 +1,5 @@
+id: (known after apply)
+network_acl_id: (known after apply)
+subnet_id: subnet-07e9f4f746f63ed3d
+terraform_address: module.scenarios[0].aws_network_acl_association.subnet_07e9f4f746f63ed3d
+terraform_name: module.scenarios[0].aws_network_acl_association.subnet_07e9f4f746f63ed3d

aws_network_acl_association › module.scenarios[0].aws_network_acl_association.subnet_0f0702af871e6a71f

--- current
+++ planned
@@ -1 +1,5 @@
+id: (known after apply)
+network_acl_id: (known after apply)
+subnet_id: subnet-0f0702af871e6a71f
+terraform_address: module.scenarios[0].aws_network_acl_association.subnet_0f0702af871e6a71f
+terraform_name: module.scenarios[0].aws_network_acl_association.subnet_0f0702af871e6a71f

aws_iam_openid_connect_provider › tfc_provider[0]

--- current
+++ planned
@@ -7,5 +7,5 @@
 terraform_address: aws_iam_openid_connect_provider.tfc_provider[0]
 terraform_name: tfc_provider[0]
 thumbprint_list:
-    - 9e99a48a9960b14926bb7f3b02e22da2b0ab7280
+    - 06b25927c42a721631c1efd9431e648fa62e1e39
 url: app.terraform.io

Blast Radius

Items	Edges
15	24

Open in Overmind

Risks

Overmind has not identified any risks associated with this change.

This could be due to the change being low risk with no impact on other parts of the system, or involving resources that Overmind currently does not support.