ansible/test/integration/targets/ec2_vpc_nacl/tasks/subnet_names.yml

141 lines
3.8 KiB
YAML
Raw Normal View History

# ============================================================
- name: create ingress and egress rules using subnet names
ec2_vpc_nacl:
vpc_id: "{{ vpc_id }}"
name: "{{ resource_prefix }}-acl"
subnets: "{{ subnet_names }}"
tags:
Created_by: "Ansible test {{ resource_prefix }}"
ingress:
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
- [300, 'icmp', 'allow', '0.0.0.0/0', 0, 8]
egress:
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
state: 'present'
register: nacl
- set_fact:
nacl_id: "{{ nacl.nacl_id }}"
- name: assert the network acl was created
assert:
that:
- nacl.changed
- nacl.nacl_id.startswith('acl-')
- name: get network ACL facts
ec2_vpc_nacl_info:
nacl_ids:
- "{{ nacl_id }}"
register: nacl_facts
- name: assert the nacl has the correct attributes
assert:
that:
- nacl_facts.nacls | length == 1
- nacl_facts.nacls[0].nacl_id == nacl_id
- nacl_facts.nacls[0].subnets | length == 4
- nacl_facts.nacls[0].ingress | length == 3
- nacl_facts.nacls[0].egress | length == 1
- "'{{ nacl_facts.nacls[0].tags.Name }}' == '{{ resource_prefix }}-acl'"
# ============================================================
- name: test idempotence
ec2_vpc_nacl:
vpc_id: "{{ vpc_id }}"
name: "{{ resource_prefix }}-acl"
subnets: "{{ subnet_names }}"
tags:
Created_by: "Ansible test {{ resource_prefix }}"
ingress:
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
- [300, 'icmp', 'allow', '0.0.0.0/0', 0, 8]
egress:
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
state: 'present'
register: nacl
- name: assert the network acl already existed
assert:
that:
- not nacl.changed
- nacl.nacl_id == nacl_id
- nacl.nacl_id.startswith('acl-')
- name: get network ACL facts
ec2_vpc_nacl_info:
nacl_ids:
- "{{ nacl.nacl_id }}"
register: nacl_facts_idem
- name: assert the facts are the same as before
assert:
that:
- nacl_facts_idem == nacl_facts
# ============================================================
- name: remove a subnet from the network ACL
ec2_vpc_nacl:
vpc_id: "{{ vpc_id }}"
name: "{{ resource_prefix }}-acl"
subnets:
- "{{ subnet_names[0] }}"
- "{{ subnet_names[1] }}"
- "{{ subnet_names[2] }}"
tags:
Created_by: "Ansible test {{ resource_prefix }}"
ingress:
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
- [300, 'icmp', 'allow', '0.0.0.0/0', 0, 8]
egress:
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
state: 'present'
register: nacl
- name: assert the network ACL changed
assert:
that:
- nacl.changed
- nacl.nacl_id == nacl_id
- nacl.nacl_id.startswith('acl-')
- name: get network ACL facts
ec2_vpc_nacl_info:
nacl_ids:
- "{{ nacl.nacl_id }}"
register: nacl_facts
- name: assert the nacl has the correct attributes
assert:
that:
- nacl_facts.nacls | length == 1
- nacl_facts.nacls[0].nacl_id == nacl_id
- nacl_facts.nacls[0].subnets | length == 3
- nacl_facts.nacls[0].ingress | length == 3
- nacl_facts.nacls[0].egress | length == 1
- "'{{ nacl_facts.nacls[0].tags.Name }}' == '{{ resource_prefix }}-acl'"
# ============================================================
- name: remove the network ACL
ec2_vpc_nacl:
vpc_id: "{{ vpc_id }}"
name: "{{ resource_prefix }}-acl"
state: absent
register: nacl
until: nacl is success
ignore_errors: yes
retries: 5
delay: 5
- name: assert nacl was removed
assert:
that:
- nacl.changed