ansible/test/integration/targets/ec2_vpc_nacl/tasks/subnet_names.yml
Mark Chappell dbc9444572 ec2_vpc_nacl and ec2_vpc_nacl_info migrate to AnsibleAWSModule and add tests (#63163)
* Move EC2 networking objects into network-policy.json

* ec2_vpc_nacl: Add integration tests

* ec2_vpc_nacl: Migrate tests to use module_defaults

* ec2_vpc_nacl: (integration tests) Add missing AWS permissions

* ec2_vpc_nacl: (integration tests) Update tests for ipv6 support

* ec2_vpc_nacl: Migrate to AnsibleAWSModule

* Fix sanity tests for ec2_vpc_nacl and ec2_vpc_nacl_info

* ec2_vpc_nacl_info: Migrate to AnsibleAWSModule

* ec2_vpc_nacl_info: (integration tests) Rename from ec2_vpc_nacl_facts to ec2_vpc_nacl_info and add a test using a filter (by tag)

* Pick availability zones dynamically

Rather than assuming that AZa and AZb always exist (they don't), query to find out which AZs we have available first

* Test that the NACLs we get back are actually the *saml* NACL rather than duplicates/delete remove

* Cleanup IPv6 tests a little.

Note: IPv6 support for ec2_vpc_nacl not complete yet.

This provides the initial framework, and should ensure things don't start exploding when support is added.

* Removing subnets by name from a NACL *is* now supported

* Fix ec2_vpc_nacl return documentation
2019-10-08 13:27:24 -07:00

140 lines
3.8 KiB
YAML

# ============================================================
- name: create ingress and egress rules using subnet names
ec2_vpc_nacl:
vpc_id: "{{ vpc_id }}"
name: "{{ resource_prefix }}-acl"
subnets: "{{ subnet_names }}"
tags:
Created_by: "Ansible test {{ resource_prefix }}"
ingress:
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
- [300, 'icmp', 'allow', '0.0.0.0/0', 0, 8]
egress:
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
state: 'present'
register: nacl
- set_fact:
nacl_id: "{{ nacl.nacl_id }}"
- name: assert the network acl was created
assert:
that:
- nacl.changed
- nacl.nacl_id.startswith('acl-')
- name: get network ACL facts
ec2_vpc_nacl_info:
nacl_ids:
- "{{ nacl_id }}"
register: nacl_facts
- name: assert the nacl has the correct attributes
assert:
that:
- nacl_facts.nacls | length == 1
- nacl_facts.nacls[0].nacl_id == nacl_id
- nacl_facts.nacls[0].subnets | length == 4
- nacl_facts.nacls[0].ingress | length == 3
- nacl_facts.nacls[0].egress | length == 1
- "'{{ nacl_facts.nacls[0].tags.Name }}' == '{{ resource_prefix }}-acl'"
# ============================================================
- name: test idempotence
ec2_vpc_nacl:
vpc_id: "{{ vpc_id }}"
name: "{{ resource_prefix }}-acl"
subnets: "{{ subnet_names }}"
tags:
Created_by: "Ansible test {{ resource_prefix }}"
ingress:
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
- [300, 'icmp', 'allow', '0.0.0.0/0', 0, 8]
egress:
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
state: 'present'
register: nacl
- name: assert the network acl already existed
assert:
that:
- not nacl.changed
- nacl.nacl_id == nacl_id
- nacl.nacl_id.startswith('acl-')
- name: get network ACL facts
ec2_vpc_nacl_info:
nacl_ids:
- "{{ nacl.nacl_id }}"
register: nacl_facts_idem
- name: assert the facts are the same as before
assert:
that:
- nacl_facts_idem == nacl_facts
# ============================================================
- name: remove a subnet from the network ACL
ec2_vpc_nacl:
vpc_id: "{{ vpc_id }}"
name: "{{ resource_prefix }}-acl"
subnets:
- "{{ subnet_names[0] }}"
- "{{ subnet_names[1] }}"
- "{{ subnet_names[2] }}"
tags:
Created_by: "Ansible test {{ resource_prefix }}"
ingress:
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
- [300, 'icmp', 'allow', '0.0.0.0/0', 0, 8]
egress:
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
state: 'present'
register: nacl
- name: assert the network ACL changed
assert:
that:
- nacl.changed
- nacl.nacl_id == nacl_id
- nacl.nacl_id.startswith('acl-')
- name: get network ACL facts
ec2_vpc_nacl_info:
nacl_ids:
- "{{ nacl.nacl_id }}"
register: nacl_facts
- name: assert the nacl has the correct attributes
assert:
that:
- nacl_facts.nacls | length == 1
- nacl_facts.nacls[0].nacl_id == nacl_id
- nacl_facts.nacls[0].subnets | length == 3
- nacl_facts.nacls[0].ingress | length == 3
- nacl_facts.nacls[0].egress | length == 1
- "'{{ nacl_facts.nacls[0].tags.Name }}' == '{{ resource_prefix }}-acl'"
# ============================================================
- name: remove the network ACL
ec2_vpc_nacl:
vpc_id: "{{ vpc_id }}"
name: "{{ resource_prefix }}-acl"
state: absent
register: nacl
until: nacl is success
ignore_errors: yes
retries: 5
delay: 5
- name: assert nacl was removed
assert:
that:
- nacl.changed