resource "aws_default_network_acl" "MAX-P3-DEFAULT-NACL" {
  default_network_acl_id = aws_vpc.MAX-P3.default_network_acl_id
  tags                   = merge(var.tags, { Name = "MAX-P3-DEFAULT-NACL" })
}

resource "aws_network_acl" "MAX-P3-PUB-NACL" {
  #checkov:skip=CKV_AWS_231: Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389. Migrated existing NACL as-is.
  #checkov:skip=CKV_AWS_232: Ensure no NACL allow ingress from 0.0.0.0:0 to port 22. Migrated existing NACL as-is.
  egress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "1"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "udp"
    rule_no    = "2"
    to_port    = "65535"
  }

  ingress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "1024"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "tcp"
    rule_no    = "3"
    to_port    = "65535"
  }

  ingress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "443"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "tcp"
    rule_no    = "4"
    to_port    = "443"
  }

  ingress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "80"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "tcp"
    rule_no    = "5"
    to_port    = "80"
  }

  ingress {
    action     = "allow"
    cidr_block = "10.0.0.0/8"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "6"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "162.49.0.0/16"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "7"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "193.168.0.0/16"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "8"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "22"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "tcp"
    rule_no    = "9"
    to_port    = "22"
  }

  subnet_ids = [aws_subnet.MAX-P3-XDMZ-1A.id, aws_subnet.MAX-P3-XDMZ-1B.id, aws_subnet.MAX-P3-FNET-1A.id]
  tags       = merge(var.tags, { Name = "MAX-P3-PUB-NACL" })
  vpc_id     = aws_vpc.MAX-P3.id
}

resource "aws_network_acl" "MAX-P3-APP-NACL" {
  #checkov:skip=CKV_AWS_231: Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389. Migrated existing NACL as-is.
  egress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "1"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "udp"
    rule_no    = "2"
    to_port    = "65535"
  }

  ingress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "1024"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "tcp"
    rule_no    = "3"
    to_port    = "65535"
  }

  ingress {
    action     = "allow"
    cidr_block = "10.0.0.0/8"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "6"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "162.49.0.0/16"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "7"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "193.168.0.0/16"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "8"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "172.34.20.0/24"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "9"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "172.34.22.0/24"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "10"
    to_port    = "0"
  }

  subnet_ids = [
    aws_subnet.MAX-P3-IAPP-1A.id,
    aws_subnet.MAX-P3-IAPP-1B.id,
    aws_subnet.MAX-P3-XAPP-1A.id,
    aws_subnet.MAX-P3-XAPP-1B.id,
    aws_subnet.MAX-P3-XEKS-1A.id,
    aws_subnet.MAX-P3-XEKS-1B.id,
    aws_subnet.MAX-P3-XEKS-1C.id,
  ]
  tags   = merge(var.tags, { Name = "MAX-P3-APP-NACL" })
  vpc_id = aws_vpc.MAX-P3.id
}

resource "aws_network_acl" "MAX-P3-RDS-NACL" {
  #checkov:skip=CKV_AWS_231: Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389. Migrated existing NACL as-is.
  egress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "1"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "10.0.0.0/8"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "2"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "172.34.25.0/24"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "-1"
    rule_no    = "3"
    to_port    = "0"
  }

  ingress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "0"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "udp"
    rule_no    = "4"
    to_port    = "65535"
  }

  ingress {
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = "1024"
    icmp_code  = "0"
    icmp_type  = "0"
    protocol   = "tcp"
    rule_no    = "5"
    to_port    = "65535"
  }
  subnet_ids = [aws_subnet.MAX-P3-XRDS-1A.id, aws_subnet.MAX-P3-XRDS-1B.id, ]
  tags       = merge(var.tags, { Name = "MAX-P3-RDS-NACL" })
  vpc_id     = aws_vpc.MAX-P3.id
}