resource "aws_default_network_acl" "MAX-U3-DEFAULT-NACL" {
  egress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = 0
    icmp_code  = 0
    icmp_type  = 0
    protocol   = "6"
    rule_no    = 100
    to_port    = 0
  }
  ingress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = 0
    icmp_code  = 0
    icmp_type  = 0
    protocol   = "6"
    rule_no    = 10
    to_port    = 0
  }
  default_network_acl_id = aws_vpc.MAX-U3.default_network_acl_id
  tags                   = merge(var.tags, { Name = "MAX-U3-DEFAULT-NACL" })
}

resource "aws_network_acl" "MAX-U3-PUB-NACL" {
  #checkov:skip=CKV_AWS_231: Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389. Migrated existing NACL as-is.
  #checkov:skip=CKV_AWS_232: Ensure no NACL allow ingress from 0.0.0.0:0 to port 22. Migrated existing NACL as-is.
  egress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "1"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "udp"
    rule_no    = "2"
    to_port    = "65535"
  }

  ingress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "1024"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "tcp"
    rule_no    = "3"
    to_port    = "65535"
  }

  ingress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "443"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "tcp"
    rule_no    = "4"
    to_port    = "443"
  }

  ingress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "80"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "tcp"
    rule_no    = "5"
    to_port    = "80"
  }

  ingress {
    action     = "allow"
    cidr_block = "10.0.0.0/8"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "6"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "162.49.0.0/16"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "7"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "192.168.0.0/16"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "8"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "22"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "tcp"
    rule_no    = "9"
    to_port    = "22"
  }

  subnet_ids = [aws_subnet.MAX-U3-XDMZ-1A.id, aws_subnet.MAX-U3-XDMZ-1B.id, aws_subnet.MAX-U3-FNET-1A.id]
  tags       = merge(var.tags, { Name = "MAX-U3-PUB-NACL" })
  vpc_id     = aws_vpc.MAX-U3.id
}

resource "aws_network_acl" "MAX-U3-APP-NACL" {
  #checkov:skip=CKV_AWS_231: Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389. Migrated existing NACL as-is.
  egress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "1"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "udp"
    rule_no    = "2"
    to_port    = "65535"
  }

  ingress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "1024"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "tcp"
    rule_no    = "3"
    to_port    = "65535"
  }

  ingress {
    action     = "allow"
    cidr_block = "10.0.0.0/8"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "6"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "162.49.0.0/16"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "7"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "192.168.0.0/16"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "8"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "172.34.20.0/24"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "9"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "172.34.21.0/25"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "10"
    to_port    = "0"
  }

  subnet_ids = [
    aws_subnet.MAX-U3-IAPP-1A.id,
    aws_subnet.MAX-U3-IAPP-1B.id,
    aws_subnet.MAX-U3-XAPP-1A.id,
    aws_subnet.MAX-U3-XAPP-1B.id,
    aws_subnet.MAX-U3-XEKS-1A.id,
    aws_subnet.MAX-U3-XEKS-1B.id,
    aws_subnet.MAX-U3-XEKS-1C.id,
  ]
  tags   = merge(var.tags, { Name = "MAX-U3-APP-NACL" })
  vpc_id = aws_vpc.MAX-U3.id
}

resource "aws_network_acl" "MAX-U3-RDS-NACL" {
  #checkov:skip=CKV_AWS_231: Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389. Migrated existing NACL as-is.
  egress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "1"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "10.0.0.0/8"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "2"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "172.34.25.0/24"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "3"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "udp"
    rule_no    = "4"
    to_port    = "65535"
  }

  ingress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "1024"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "tcp"
    rule_no    = "5"
    to_port    = "65535"
  }
  subnet_ids = [aws_subnet.MAX-U3-XRDS-1A.id, aws_subnet.MAX-U3-XRDS-1B.id, ]
  tags       = merge(var.tags, { Name = "MAX-U3-RDS-NACL" })
  vpc_id     = aws_vpc.MAX-U3.id
}