Problems managing ACL on default VPC

[lawliet89]

These lines prevent any rules from being defined on the default ACL.

At the same time, by reattaching the ACL with the default subnets, they prevent you from defining custom ACLs on those subnets.

Any ideas how we can work around this?

I think a better solution is to remove the subnet_ids line and add

  lifecycle {
    ignore_changes = ["subnet_ids"]
  }

[nozaq]

@lawliet89

There's no specific needs to attach the default ACL to the default subet, so just ignoring changes of "subnet_ids" would be enough as you mentioned.
I've created a patch for this 👍

Regarding custom rules with the default network ACL, the only option I could come up with is enable/disable aws_default_network_acl resource depending on the input variable by using the count trick.
I would still recommend to create custom network ACLs and keep your default network ACL as "DENY ALL" setting, it will prevent the network from accidental misconfigurations.

[lawliet89]

I agree with having DENY in the default ACL.

Thanks for the patch.