# cs_network_acl_rule – Manages network access control list (ACL) rules on Apache CloudStack based clouds

New in version 2.4.

- Synopsis
- Requirements
- Parameters
- Notes
- Examples
- Return Values
- Status

## Synopsis

- Add, update and remove network ACL rules.

## Requirements

The below requirements are needed on the host that executes this module.

- python >= 2.6
- cs >= 0.6.10

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---
account string |  | Account the VPC is related to.

action_policy
string

Choices:
- allow ←
- deny

Action policy of the rule.
aliases: action

api_http_method
string

Choices:
- get
- post

HTTP method used to query the API endpoint.
If not given, the `CLOUDSTACK_METHOD` env variable is considered.
As the last option, the value is taken from the ini config file, also see the notes.
Fallback value is `get` if not specified.

api_key string |  | API key of the CloudStack API. If not given, the `CLOUDSTACK_KEY` env variable is considered. As the last option, the value is taken from the ini config file, also see the notes.
api_region string | Default: "cloudstack" | Name of the ini section in the `cloustack.ini` file. If not given, the `CLOUDSTACK_REGION` env variable is considered.
api_secret string |  | Secret key of the CloudStack API. If not set, the `CLOUDSTACK_SECRET` env variable is considered. As the last option, the value is taken from the ini config file, also see the notes.
api_timeout integer |  | HTTP timeout in seconds. If not given, the `CLOUDSTACK_TIMEOUT` env variable is considered. As the last option, the value is taken from the ini config file, also see the notes. Fallback value is 10 seconds if not specified.
api_url string |  | URL of the CloudStack API e.g. https://cloud.example.com/client/api. If not given, the `CLOUDSTACK_ENDPOINT` env variable is considered. As the last option, the value is taken from the ini config file, also see the notes.
cidrs list | Default: ["0.0.0.0/0"] | CIDRs of the rule. aliases: cidr
domain string |  | Domain the VPC is related to.
end_port integer |  | End port for this rule. Considered if protocol=tcp or protocol=udp. If not specified, equal start_port.
icmp_code integer |  | Error code for this icmp message. Considered if protocol=icmp.
icmp_type integer |  | Type of the icmp message being sent. Considered if protocol=icmp.
network_acl string / required |  | Name of the network ACL. aliases: acl

poll_async
boolean

Choices:
- no
- yes ←

Poll async jobs until job has finished.

project string |  | Name of the project the VPC is related to.

protocol
string

Choices:
- tcp ←
- udp
- icmp
- all
- by_number

Protocol of the rule

protocol_number integer |  | Protocol number from 1 to 256 required if protocol=by_number.
rule_position integer / required |  | The position of the network ACL rule. aliases: number
start_port integer |  | Start port for this rule. Considered if protocol=tcp or protocol=udp. aliases: port

state
string

Choices:
- present ←
- absent

State of the network ACL rule.

tags list |  | List of tags. Tags are a list of dictionaries having keys key and value. If you want to delete all tags, set a empty list e.g. tags: []. aliases: tag

traffic_type
string

Choices:
- ingress ←
- egress

Traffic type of the rule.
aliases: type

vpc string / required |  | VPC the network ACL is related to.
zone string |  | Name of the zone the VPC related to. If not set, default zone is used.

## Notes

Note

- Ansible uses the `cs` library’s configuration method if credentials are not provided by the arguments `api_url`, `api_key`, `api_secret`. Configuration is read from several locations, in the following order. The `CLOUDSTACK_ENDPOINT`, `CLOUDSTACK_KEY`, `CLOUDSTACK_SECRET` and `CLOUDSTACK_METHOD`. `CLOUDSTACK_TIMEOUT` environment variables. A `CLOUDSTACK_CONFIG` environment variable pointing to an `.ini` file. A `cloudstack.ini` file in the current working directory. A `.cloudstack.ini` file in the users home directory. Optionally multiple credentials and endpoints can be specified using ini sections in `cloudstack.ini`. Use the argument `api_region` to select the section name, default section is `cloudstack`. See https://github.com/exoscale/cs for more information.
- A detailed guide about cloudstack modules can be found in the CloudStack Cloud Guide.
- This module supports check mode.

## Examples

    - name: create a network ACL rule, allow port 80 ingress
      cs_network_acl_rule:
        network_acl: web
        rule_position: 1
        vpc: my vpc
        traffic_type: ingress
        action_policy: allow
        port: 80
        cidr: 0.0.0.0/0
      delegate_to: localhost

    - name: create a network ACL rule, deny port range 8000-9000 ingress for 10.20.0.0/16 and 10.22.0.0/16
      cs_network_acl_rule:
        network_acl: web
        rule_position: 1
        vpc: my vpc
        traffic_type: ingress
        action_policy: deny
        start_port: 8000
        end_port: 9000
        cidrs:
        - 10.20.0.0/16
        - 10.22.0.0/16
      delegate_to: localhost

    - name: remove a network ACL rule
      cs_network_acl_rule:
        network_acl: web
        rule_position: 1
        vpc: my vpc
        state: absent
      delegate_to: localhost

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Returned | Description
--- | --- | ---
account string | success | Account the network ACL rule is related to. Sample: example account
action_policy string | success | Action policy of the network ACL rule. Sample: deny
cidr string | success | CIDR of the network ACL rule. Sample: 0.0.0.0/0
cidrs list added in 2.9 | success | CIDRs of the network ACL rule. Sample: ['0.0.0.0/0']
domain string | success | Domain the network ACL rule is related to. Sample: example domain
end_port integer | success | End port of the network ACL rule. Sample: 80
icmp_code integer | success | ICMP code of the network ACL rule. Sample: 8
icmp_type integer | success | ICMP type of the network ACL rule.
network_acl string | success | Name of the network ACL. Sample: customer acl
project string | success | Name of project the network ACL rule is related to. Sample: Production
protocol string | success | Protocol of the network ACL rule. Sample: tcp
protocol_number integer | success | Protocol number in case protocol is by number. Sample: 8
rule_position integer | success | Position of the network ACL rule. Sample: 1
start_port integer | success | Start port of the network ACL rule. Sample: 80
state string | success | State of the network ACL rule. Sample: Active
tags list | success | List of resource tags associated with the network ACL rule. Sample: [ { "key": "foo", "value": "bar" } ]
traffic_type string | success | Traffic type of the network ACL rule. Sample: ingress
vpc string | success | VPC of the network ACL. Sample: customer vpc
zone string | success | Zone the VPC is related to. Sample: ch-gva-2

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]
- This module is maintained by the Ansible Community. [community]

### Authors

- René Moser (@resmo)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.