# VPC network ACL functionality **URL:** \ **Category:** Ansible Developer\ **Tags:** aws\ **Created:** [March 9, 2014, 3:15am UTC](https://forum.ansible.com/t/vpc-network-acl-functionality/14733 "2014-03-09T03:15:08Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Scott\_Anderson](https://avatars.discourse-cdn.com/v4/letter/s/ed655f/32.png) [@Scott\_Anderson](https://forum.ansible.com/u/Scott_Anderson)\ **Post date:** [March 9, 2014, 3:15am UTC](https://forum.ansible.com/t/vpc-network-acl-functionality/14733/1 "2014-03-09T03:15:08Z")
Unless I’m misreading the code, there is no module to manage VPC ACL groups, and the ec2\_group module only manages security groups. I could either add the ACL functionality to the ec2\_group module, but these issues would arise: 1) There would be a mixture of module parameters, possibly confusingly so, 2) VPC ACLs aren’t specific to ec2, and including them in a module named ‘ec2\_group’ would also be confusing. 3) Rules work slightly differently for network ACLs than for security groups. Adding another module (probably aws\_vpc\_acl or the like; I wish all the Amazon modules started with “aws”) would be cleaner from a cognitive standpoint. I would, however, possibly refactor ec2\_group as the rules functionality is more or less shared, other than rule order which only exists for ACLs. Is the design aesthetic for Ansible more weighted towards single-function modules, or large do-it-all modules? I personally prefer the former. On a slightly different subject, as mentioned above: what is the appetite for doing some reasonable renaming of the Amazon modules to start with aws, with a deprecation period? As an example, the “ec2\_vpc” module isn’t specific to ec2. Regards, -scott ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [March 9, 2014, 3:56pm UTC](https://forum.ansible.com/t/vpc-network-acl-functionality/14733/2 "2014-03-09T15:56:36Z")
(1) We already do have a ec2\_vpc module and there are several pull requests against it. (2) It definitely shouldn’t mingle with the security group module – this would be very bad. (3) We are not going to rename any modules at this time. (4) We do not want to entertain any refactoring at this time until various open cloud pull requests get merged, and in doing so must preserve module signatures. (5) We seek modules that fit the “right” amount of encapsulation to model a particular resource or noun. I wouldn’t describe them as functions. ---
**Author:** ![herby.gillot1](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@herby.gillot1](https://forum.ansible.com/u/herby.gillot1)\ **Post date:** [November 28, 2014, 10:11pm UTC](https://forum.ansible.com/t/vpc-network-acl-functionality/14733/3 "2014-11-28T22:11:47Z")
This pull request ( [https://github.com/ansible/ansible-modules-core/pull/403](https://github.com/ansible/ansible-modules-core/pull/403) ) would add this functionality as a seperate module: ec2\_vpc\_nacl. ---
**Author:** ![polfilm](https://avatars.discourse-cdn.com/v4/letter/p/bc8723/32.png) [@polfilm](https://forum.ansible.com/u/polfilm)\ **Post date:** [December 2, 2014, 10:53am UTC](https://forum.ansible.com/t/vpc-network-acl-functionality/14733/4 "2014-12-02T10:53:27Z")
awesome. +1 ---
**Author:** ![Josh\_Smift1](https://avatars.discourse-cdn.com/v4/letter/j/bcef8e/32.png) [@Josh\_Smift1](https://forum.ansible.com/u/Josh_Smift1)\ **Post date:** [November 24, 2015, 9:05pm UTC](https://forum.ansible.com/t/vpc-network-acl-functionality/14733/5 "2015-11-24T21:05:00Z")
I was looking to use Ansible to configure some network ACLs just now, and was surprised that there doesn't seem to be a way to do this. :^( [https://github.com/ansible/ansible-modules-core/pull/403](https://github.com/ansible/ansible-modules-core/pull/403) was a PR for an ec2\_vpc\_nacl module, which got some feedback, and was eventually closed as part of the "new modules go in extras first" rule, with an encouragement to the author (herbyg-axial) to resubmit it, but it doesn't seem like it ever was. Anyone working on this now? Or is it already there and I missed it? I don't have any experience with module development, but I could probably take herbyg-axial's code, try to apply the feedback to it, and put in a PR for it, if no one else already has this in progress.                                       -Josh (jbs@care.com) (apologies for the following automatic mandatory corporate disclaimer) This email is intended for the person(s) to whom it is addressed and may contain information that is PRIVILEGED or CONFIDENTIAL. Any unauthorized use, distribution, copying, or disclosure by any person other than the addressee(s) is strictly prohibited. If you have received this email in error, please notify the sender immediately by return email and delete the message and any attachments from your system. ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [November 24, 2015, 10:46pm UTC](https://forum.ansible.com/t/vpc-network-acl-functionality/14733/6 "2015-11-24T22:46:31Z")
Josh, I don't think anyone is working on this, if taking over please try to maintain attribution to Herb's work. He just probably got slammed and pulled in other directions and never had time to come back to this (this seems common in our line of work).