Class: Aws::EC2::NetworkAcl

Inherits:
Object
  • Object
show all
Defined in:
gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb

Defined Under Namespace

Classes: Collection

Read-Only Attributes collapse

Actions collapse

Associations collapse

Instance Method Summary collapse

Constructor Details

#initialize(id, options = {}) ⇒ NetworkAcl #initialize(options = {}) ⇒ NetworkAcl

Returns a new instance of NetworkAcl.

Overloads:

  • #initialize(id, options = {}) ⇒ NetworkAcl

    Parameters:

    • id (String)

    Options Hash (options):

  • #initialize(options = {}) ⇒ NetworkAcl

    Options Hash (options):

    • :id (required, String)
    • :client (Client) 


22
23
24
25
26
27
28
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 22

def initialize(*args)
  options = Hash === args.last ? args.pop.dup : {}
  @id = extract_id(args, options)
  @data = options.delete(:data)
  @client = options.delete(:client) || Client.new(options)
  @waiter_block_warned = false
end

Instance Method Details

#associations ⇒ Array<Types::NetworkAclAssociation>

Any associations between the network ACL and one or more subnets

Returns:



40
41
42
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 40

def associations
  data[:associations]
end

#client ⇒ Client

Returns:



77
78
79
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 77

def client
  @client
end

#create_entry(options = {}) ⇒ EmptyStructure

Examples:

Request syntax with placeholder values


network_acl.create_entry({
  cidr_block: "String",
  dry_run: false,
  egress: false, # required
  icmp_type_code: {
    code: 1,
    type: 1,
  },
  ipv_6_cidr_block: "String",
  port_range: {
    from: 1,
    to: 1,
  },
  protocol: "String", # required
  rule_action: "allow", # required, accepts allow, deny
  rule_number: 1, # required
})

Parameters:

  • options (Hash) (defaults to: {}) —

    ({})

Options Hash (options):

  • :cidr_block (String) —

    The IPv4 network range to allow or deny, in CIDR notation (for example 172.16.0.0/24). We modify the specified CIDR block to its canonical form; for example, if you specify 100.68.0.18/18, we modify it to 100.68.0.0/18.

  • :dry_run (Boolean) —

    Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.

  • :egress (required, Boolean) —

    Indicates whether this is an egress rule (rule is applied to traffic leaving the subnet).

  • :icmp_type_code (Types::IcmpTypeCode) —

    ICMP protocol: The ICMP or ICMPv6 type and code. Required if specifying protocol 1 (ICMP) or protocol 58 (ICMPv6) with an IPv6 CIDR block.

  • :ipv_6_cidr_block (String) —

    The IPv6 network range to allow or deny, in CIDR notation (for example 2001:db8:1234:1a00::/64).

  • :port_range (Types::PortRange) —

    TCP or UDP protocols: The range of ports the rule applies to. Required if specifying protocol 6 (TCP) or 17 (UDP).

  • :protocol (required, String) —

    The protocol number. A value of "-1" means all protocols. If you specify "-1" or a protocol number other than "6" (TCP), "17" (UDP), or "1" (ICMP), traffic on all ports is allowed, regardless of any ports or ICMP types or codes that you specify. If you specify protocol "58" (ICMPv6) and specify an IPv4 CIDR block, traffic for all ICMP types and codes allowed, regardless of any that you specify. If you specify protocol "58" (ICMPv6) and specify an IPv6 CIDR block, you must specify an ICMP type and code.

  • :rule_action (required, String) —

    Indicates whether to allow or deny the traffic that matches the rule.

  • :rule_number (required, Integer) —

    The rule number for the entry (for example, 100). ACL entries are processed in ascending order by rule number.

    Constraints: Positive integer from 1 to 32766. The range 32767 to 65535 is reserved for internal use.

Returns:

  • (EmptyStructure) 


273
274
275
276
277
278
279
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 273

def create_entry(options = {})
  options = options.merge(network_acl_id: @id)
  resp = Aws::Plugins::UserAgent.feature('resource') do
    @client.create_network_acl_entry(options)
  end
  resp.data
end

#create_tags(options = {}) ⇒ Tag::Collection

Examples:

Request syntax with placeholder values


tag = network_acl.create_tags({
  dry_run: false,
  tags: [ # required
    {
      key: "String",
      value: "String",
    },
  ],
})

Parameters:

  • options (Hash) (defaults to: {}) —

    ({})

Options Hash (options):

  • :dry_run (Boolean) —

    Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.

  • :tags (required, Array<Types::Tag>) —

    The tags. The value parameter is required, but if you don't want the tag to have a value, specify the parameter with no value, and we set the value to an empty string.

Returns:



303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 303

def create_tags(options = {})
  batch = []
  options = Aws::Util.deep_merge(options, resources: [@id])
  resp = Aws::Plugins::UserAgent.feature('resource') do
    @client.create_tags(options)
  end
  options[:tags].each do |t|
    batch << Tag.new(
      resource_id: @id,
      key: t[:key],
      value: t[:value],
      client: @client
    )
  end
  Tag::Collection.new([batch], size: batch.size)
end

#data ⇒ Types::NetworkAcl

Returns the data for this Aws::EC2::NetworkAcl. Calls Client#describe_network_acls if #data_loaded? is false.

Returns:



99
100
101
102
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 99

def data
  load unless @data
  @data
end

#data_loaded? ⇒ Boolean

Returns true if this resource is loaded. Accessing attributes or #data on an unloaded resource will trigger a call to #load.

Returns:

  • (Boolean) —

    Returns true if this resource is loaded. Accessing attributes or #data on an unloaded resource will trigger a call to #load.



107
108
109
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 107

def data_loaded?
  !!@data
end

#delete(options = {}) ⇒ EmptyStructure

Examples:

Request syntax with placeholder values


network_acl.delete({
  dry_run: false,
})

Parameters:

  • options (Hash) (defaults to: {}) —

    ({})

Options Hash (options):

  • :dry_run (Boolean) —

    Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.

Returns:

  • (EmptyStructure) 


379
380
381
382
383
384
385
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 379

def delete(options = {})
  options = options.merge(network_acl_id: @id)
  resp = Aws::Plugins::UserAgent.feature('resource') do
    @client.delete_network_acl(options)
  end
  resp.data
end

#delete_entry(options = {}) ⇒ EmptyStructure

Examples:

Request syntax with placeholder values


network_acl.delete_entry({
  dry_run: false,
  egress: false, # required
  rule_number: 1, # required
})

Parameters:

  • options (Hash) (defaults to: {}) —

    ({})

Options Hash (options):

  • :dry_run (Boolean) —

    Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.

  • :egress (required, Boolean) —

    Indicates whether the rule is an egress rule.

  • :rule_number (required, Integer) —

    The rule number of the entry to delete.

Returns:

  • (EmptyStructure) 


405
406
407
408
409
410
411
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 405

def delete_entry(options = {})
  options = options.merge(network_acl_id: @id)
  resp = Aws::Plugins::UserAgent.feature('resource') do
    @client.delete_network_acl_entry(options)
  end
  resp.data
end

#delete_tags(options = {}) ⇒ Tag::Collection

Examples:

Request syntax with placeholder values


tag = network_acl.delete_tags({
  dry_run: false,
  tags: [
    {
      key: "String",
      value: "String",
    },
  ],
})

Parameters:

  • options (Hash) (defaults to: {}) —

    ({})

Options Hash (options):

  • :dry_run (Boolean) —

    Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.

  • :tags (Array<Types::Tag>) —

    The tags to delete. Specify a tag key and an optional tag value to delete specific tags. If you specify a tag key without a tag value, we delete any tag with this key regardless of its value. If you specify a tag key with an empty string as the tag value, we delete the tag only if its value is an empty string.

    If you omit this parameter, we delete all user-defined tags for the specified resources. We do not delete Amazon Web Services-generated tags (tags that have the aws: prefix).

    Constraints: Up to 1000 tags.

Returns:



350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 350

def delete_tags(options = {})
  batch = []
  options = Aws::Util.deep_merge(options, resources: [@id])
  resp = Aws::Plugins::UserAgent.feature('resource') do
    @client.delete_tags(options)
  end
  options[:tags].each do |t|
    batch << Tag.new(
      resource_id: @id,
      key: t[:key],
      value: t[:value],
      client: @client
    )
  end
  Tag::Collection.new([batch], size: batch.size)
end

#entries ⇒ Array<Types::NetworkAclEntry>

The entries (rules) in the network ACL.

Returns:



46
47
48
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 46

def entries
  data[:entries]
end

#id ⇒ String Also known as: network_acl_id

Returns:

  • (String) 


33
34
35
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 33

def id
  @id
end

#is_default ⇒ Boolean

Indicates whether this is the default network ACL for the VPC.

Returns:

  • (Boolean) 


52
53
54
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 52

def is_default
  data[:is_default]
end

#load ⇒ self Also known as: reload

Loads, or reloads #data for the current Aws::EC2::NetworkAcl. Returns self making it possible to chain methods.

network_acl.reload.data

Returns:

  • (self) 


87
88
89
90
91
92
93
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 87

def load
  resp = Aws::Plugins::UserAgent.feature('resource') do
    @client.describe_network_acls(network_acl_ids: [@id])
  end
  @data = resp.network_acls[0]
  self
end

#owner_id ⇒ String

The ID of the Amazon Web Services account that owns the network ACL.

Returns:

  • (String) 


70
71
72
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 70

def owner_id
  data[:owner_id]
end

#replace_association(options = {}) ⇒ Types::ReplaceNetworkAclAssociationResult

Examples:

Request syntax with placeholder values


network_acl.replace_association({
  association_id: "NetworkAclAssociationId", # required
  dry_run: false,
})

Parameters:

  • options (Hash) (defaults to: {}) —

    ({})

Options Hash (options):

  • :association_id (required, String) —

    The ID of the current association between the original network ACL and the subnet.

  • :dry_run (Boolean) —

    Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.

Returns:



429
430
431
432
433
434
435
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 429

def replace_association(options = {})
  options = options.merge(network_acl_id: @id)
  resp = Aws::Plugins::UserAgent.feature('resource') do
    @client.replace_network_acl_association(options)
  end
  resp.data
end

#replace_entry(options = {}) ⇒ EmptyStructure

Examples:

Request syntax with placeholder values


network_acl.replace_entry({
  cidr_block: "String",
  dry_run: false,
  egress: false, # required
  icmp_type_code: {
    code: 1,
    type: 1,
  },
  ipv_6_cidr_block: "String",
  port_range: {
    from: 1,
    to: 1,
  },
  protocol: "String", # required
  rule_action: "allow", # required, accepts allow, deny
  rule_number: 1, # required
})

Parameters:

  • options (Hash) (defaults to: {}) —

    ({})

Options Hash (options):

  • :cidr_block (String) —

    The IPv4 network range to allow or deny, in CIDR notation (for example 172.16.0.0/24).

  • :dry_run (Boolean) —

    Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.

  • :egress (required, Boolean) —

    Indicates whether to replace the egress rule.

    Default: If no value is specified, we replace the ingress rule.

  • :icmp_type_code (Types::IcmpTypeCode) —

    ICMP protocol: The ICMP or ICMPv6 type and code. Required if specifying protocol 1 (ICMP) or protocol 58 (ICMPv6) with an IPv6 CIDR block.

  • :ipv_6_cidr_block (String) —

    The IPv6 network range to allow or deny, in CIDR notation (for example 2001:bd8:1234:1a00::/64).

  • :port_range (Types::PortRange) —

    TCP or UDP protocols: The range of ports the rule applies to. Required if specifying protocol 6 (TCP) or 17 (UDP).

  • :protocol (required, String) —

    The protocol number. A value of "-1" means all protocols. If you specify "-1" or a protocol number other than "6" (TCP), "17" (UDP), or "1" (ICMP), traffic on all ports is allowed, regardless of any ports or ICMP types or codes that you specify. If you specify protocol "58" (ICMPv6) and specify an IPv4 CIDR block, traffic for all ICMP types and codes allowed, regardless of any that you specify. If you specify protocol "58" (ICMPv6) and specify an IPv6 CIDR block, you must specify an ICMP type and code.

  • :rule_action (required, String) —

    Indicates whether to allow or deny the traffic that matches the rule.

  • :rule_number (required, Integer) —

    The rule number of the entry to replace.

Returns:

  • (EmptyStructure) 


493
494
495
496
497
498
499
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 493

def replace_entry(options = {})
  options = options.merge(network_acl_id: @id)
  resp = Aws::Plugins::UserAgent.feature('resource') do
    @client.replace_network_acl_entry(options)
  end
  resp.data
end

#tags ⇒ Array<Types::Tag>

Any tags assigned to the network ACL.

Returns:



58
59
60
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 58

def tags
  data[:tags]
end

#vpc ⇒ Vpc?

Returns:



504
505
506
507
508
509
510
511
512
513
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 504

def vpc
  if data[:vpc_id]
    Vpc.new(
      id: data[:vpc_id],
      client: @client
    )
  else
    nil
  end
end

#vpc_id ⇒ String

The ID of the VPC for the network ACL.

Returns:

  • (String) 


64
65
66
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 64

def vpc_id
  data[:vpc_id]
end

#wait_until(options = {}) {|resource| ... } ⇒ Resource

Deprecated.

Use [Aws::EC2::Client] #wait_until instead

Note:

The waiting operation is performed on a copy. The original resource remains unchanged.

Waiter polls an API operation until a resource enters a desired state.

Basic Usage

Waiter will polls until it is successful, it fails by entering a terminal state, or until a maximum number of attempts are made.

# polls in a loop until condition is true
resource.wait_until(options) {|resource| condition}

Example

instance.wait_until(max_attempts:10, delay:5) do |instance|
  instance.state.name == 'running'
end

Configuration

You can configure the maximum number of polling attempts, and the delay (in seconds) between each polling attempt. The waiting condition is set by passing a block to #wait_until:

# poll for ~25 seconds
resource.wait_until(max_attempts:5,delay:5) {|resource|...}

Callbacks

You can be notified before each polling attempt and before each delay. If you throw :success or :failure from these callbacks, it will terminate the waiter.

started_at = Time.now
# poll for 1 hour, instead of a number of attempts
proc = Proc.new do |attempts, response|
  throw :failure if Time.now - started_at > 3600
end

  # disable max attempts
instance.wait_until(before_wait:proc, max_attempts:nil) {...}

Handling Errors

When a waiter is successful, it returns the Resource. When a waiter fails, it raises an error.

begin
  resource.wait_until(...)
rescue Aws::Waiters::Errors::WaiterFailed
  # resource did not enter the desired state in time
end

attempts attempt in seconds invoked before each attempt invoked before each wait

Parameters:

  • options (Hash) (defaults to: {}) —

    a customizable set of options

Options Hash (options):

  • :max_attempts (Integer) — default: 10 —

    Maximum number of

  • :delay (Integer) — default: 10 —

    Delay between each

  • :before_attempt (Proc) — default: nil —

    Callback

  • :before_wait (Proc) — default: nil —

    Callback

Yield Parameters:

  • resource (Resource) —

    to be used in the waiting condition.

Returns:

  • (Resource) —

    if the waiter was successful

Raises:

  • (Aws::Waiters::Errors::FailureStateError) —

    Raised when the waiter terminates because the waiter has entered a state that it will not transition out of, preventing success.

    yet successful.

  • (Aws::Waiters::Errors::UnexpectedError) —

    Raised when an error is encountered while polling for a resource that is not expected.

  • (NotImplementedError) —

    Raised when the resource does not



191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
 
# File 'gems/aws-sdk-ec2/lib/aws-sdk-ec2/network_acl.rb', line 191

def wait_until(options = {}, &block)
  self_copy = self.dup
  attempts = 0
  options[:max_attempts] = 10 unless options.key?(:max_attempts)
  options[:delay] ||= 10
  options[:poller] = Proc.new do
    attempts += 1
    if block.call(self_copy)
      [:success, self_copy]
    else
      self_copy.reload unless attempts == options[:max_attempts]
      :retry
    end
  end
  Aws::Plugins::UserAgent.feature('resource') do
    Aws::Waiters::Waiter.new(options).wait({})
  end
end