Page History

...

NetworkACLList will be introduced to manage NetworkACLs (NetworkACLItems).

NetworkACLList

Terminology

ACL is Access Control List. So ACL container is kind of redundant. Instead we use the below terminology:

NetworkACLItem - Individual ACL Entry (was NetworlACL earlier). Should we call it NetworkAclEntry instead?

NetworkACL - Group of Network ACL Items. API will use the term NetworkACLList to differentiate from the existing NetworkACL APIs

NetworkACL

NetworkACLNetworkACLList is a numbered list of NetworkACLItems that are evaluated in order, starting with the lowest numbered rule, to determine whether traffic is allowed in or out of any tier associated with the network ACL.

...

NetworkACLItems can be added or removed from the NetworkACL using APIs createNetworkACL createNetworkACLItem and removeNetworkACL deleteNetworkACLItem APIs.

Sample workflow

Creating Tier with default acl and assigning a custom acl aterlater

1. Create VPC
2. Create Tier A - tier is associated with default network ACL
3. Create custom network ACL
4. Add ACLItems to the ACL
5. Assign ACL created in step # 3 to tier A using replaceNetworkACLList API

...

createNetworkAclItem (Aliased to createNetworkAcl createNetworkACL)

Adds a networkACLItem to the specified ACL.

...

For backward compatibility, if network_id is specified instead of acl_id, networkACLItem will added to the ACL assigned to the network.

deleteNetworkACLItem (Aliased to removeNetworkACL)

Deletes specifed network acl item from network ACL. No changes to the params.

createNetwork

In VPC case, createNetwork is used to create a tier within VPC. Tier can be associated with a ACL during creation. If acl_id is not specified default ACL will be used.

...

• id (required) - Id of the network ACL Item
• trafficType (optional) - can be ingress/egress (defaulted to ingress if not specified)
• cidrlist (optional) - List of the coma separated CIDRs for the rule. If not specified, defaulted to 0.0.0.0/0
• startPort (optional)
• endPort (optional)
• protocol (optional). TCP/UDP/ICMP protocol types are supported
• icmpType (optional) - type of the icmp message being sent
• icmpCode (optional) - error code for this icmp message
• action (optional) - allow/deny
• number (optional) - rule number

createNetworkAclList

Created Creates network ACL container

Parameters:

• name - Name of the Network Acl (required)
• description - Description of the Network ACL (required)
• vpc_id - Id of the VPC (required)

...

• id - uuid of the Network Acl (optional)
• network_id - list by network_id (Tier) (optional)
• vpc_id - list ACLs associated with specified vpc (optional)

Response:

• List of network ACL

...