
service: 'tcf-test-nacl'

provider:
  name: aws
  runtime: python3.7
  profile: 'tcf-test'
  stackName: 'tcf-test-nacl'
  region: 'af-south-1'
  stage: ${self:provider.profile}
  deploymentBucket:
    name: ${self:custom.ServerlessBucketName}
    serverSideEncryption: AES256
    blockPublicAccess: true

plugins:
  - serverless-deployment-bucket
  - serverless-parameters

custom:
  CustomerName: tcf
  StageName: test
  # Combination of profile and function name used as bucket name:
  ResourceName: serverless-framework # Only lowercase letters and numbers allowed. Used to populate bucket name.
  ServerlessBucketName: '${self:custom.ResourceName}-${self:provider.stage}-${self:provider.region}'
  FlowLogBucketName: '${self:custom.ResourceName}-${self:provider.stage}-${self:provider.region}-flowlog'

  # CloudFormation parameters templates

resources:

  # CloudFormation resource templates

  Resources:

    # Create NACL

    customNacl:
      Type: AWS::EC2::NetworkAcl
      Properties:
        VpcId:
          Fn::ImportValue: !Sub '${self:custom.CustomerName}-${self:custom.StageName}-VPC'
        Tags:
          - Key: Name
            Value: !Join
              - '-'
              - - '${self:custom.CustomerName}'
                - '${self:custom.StageName}'
                - 'custom'
                - 'nacl'

    InboundRule:
      Type: AWS::EC2::NetworkAclEntry
      Properties:
        NetworkAclId:
          Ref: customNacl
        RuleNumber: 100
        Protocol: -1
        RuleAction: allow
        CidrBlock: 0.0.0.0/0

    OutboundRule:
      Type: AWS::EC2::NetworkAclEntry
      Properties:
        NetworkAclId:
          Ref: customNacl
        RuleNumber: 100
        Protocol: -1
        Egress: true
        RuleAction: allow
        CidrBlock: 0.0.0.0/0

    mySubnetNetworkAclAssociationA1:
      Type: AWS::EC2::SubnetNetworkAclAssociation
      Properties:
        NetworkAclId:
          Ref: customNacl
        SubnetId:
          Fn::ImportValue: !Sub '${self:custom.CustomerName}-${self:custom.StageName}-PublicSubnetA1'

    mySubnetNetworkAclAssociationB1:
      Type: AWS::EC2::SubnetNetworkAclAssociation
      Properties:
        NetworkAclId:
          Ref: customNacl
        SubnetId:
          Fn::ImportValue: !Sub '${self:custom.CustomerName}-${self:custom.StageName}-PublicSubnetB1'

    mySubnetNetworkAclAssociationA1P:
      Type: AWS::EC2::SubnetNetworkAclAssociation
      Properties:
        NetworkAclId:
          Ref: customNacl
        SubnetId:
          Fn::ImportValue: !Sub '${self:custom.CustomerName}-${self:custom.StageName}-PrivateSubnetA1'

    mySubnetNetworkAclAssociationB1P:
      Type: AWS::EC2::SubnetNetworkAclAssociation
      Properties:
        NetworkAclId:
          Ref: customNacl
        SubnetId:
          Fn::ImportValue: !Sub '${self:custom.CustomerName}-${self:custom.StageName}-PrivateSubnetB1'

    mySubnetNetworkAclAssociationA2P:
      Type: AWS::EC2::SubnetNetworkAclAssociation
      Properties:
        NetworkAclId:
          Ref: customNacl
        SubnetId:
          Fn::ImportValue: !Sub '${self:custom.CustomerName}-${self:custom.StageName}-PrivateSubnetA2'

    mySubnetNetworkAclAssociationB2P:
      Type: AWS::EC2::SubnetNetworkAclAssociation
      Properties:
        NetworkAclId:
          Ref: customNacl
        SubnetId:
          Fn::ImportValue: !Sub '${self:custom.CustomerName}-${self:custom.StageName}-PrivateSubnetB2'
