diff --git a/packages/@aws-cdk/aws-ec2/test/test.l1.ts b/packages/@aws-cdk/aws-ec2/test/test.l1.ts
new file mode 100644
index 0000000000000..ca90171b20fbe
--- /dev/null
+++ b/packages/@aws-cdk/aws-ec2/test/test.l1.ts
@@ -0,0 +1,19 @@
+import cdk = require('@aws-cdk/cdk');
+import { Test } from 'nodeunit';
+import ec2 = require('../lib');
+
+export = {
+  'NetworkAclEntry CidrBlock should be optional'(test: Test) {
+    const stack = new cdk.Stack();
+
+    new ec2.CfnNetworkAclEntry(stack, 'ACL', {
+      // Note the conspicuous absence of cidrBlock
+      networkAclId: 'asdf',
+      protocol: 5,
+      ruleAction: 'action',
+      ruleNumber: 1
+    });
+
+    test.done();
+  },
+};
\ No newline at end of file
diff --git a/packages/@aws-cdk/cfnspec/spec-source/500_NetworkAclEntry_patch.json b/packages/@aws-cdk/cfnspec/spec-source/500_NetworkAclEntry_patch.json
new file mode 100644
index 0000000000000..7b12501932a1f
--- /dev/null
+++ b/packages/@aws-cdk/cfnspec/spec-source/500_NetworkAclEntry_patch.json
@@ -0,0 +1,16 @@
+{
+    "ResourceTypes": {
+        "AWS::EC2::NetworkAclEntry": {
+            "patch": {
+                "description": "https://github.com/awslabs/aws-cdk/issues/1517",
+                "operations": [
+                    {
+                        "op": "add",
+                        "path": "/Properties/CidrBlock/Required",
+                        "value": false
+                    }
+                ]
+            }
+        }
+    }
+}