aws vpc acl rules defined in yaml and templated using mako for readability. salt-master subnet can talk to both app and db subnets on ports 22 and 4505-4506 app and db can talk over 3306 app allows incoming external requests on port 8080 can now add security groups to further filter requests :-)

yaml_aws_acl_rules

<%
  salt_master_subnet='10.0.1.0/24'
  db_subnet='10.0.2.0/24'
  app_subnet='10.0.3.0/24'
%>

  - mcp-salt-master:
    - acl:
      - inbound:
        - {rule: 100, source: ${salt_master_subnet}, tcp: 22, allow-deny: 'ALLOW'}
        - {rule: 200, source: ${salt_master_subnet}, tcp: '4505-4506', allow-deny: 'ALLOW'}
        - {rule: 300, source: ${db_subnet}, tcp: 3306, allow-deny: 'ALLOW'}
        - {rule: '*', source: '0.0.0.0/0', all: 'all', allow-deny: 'DENY'}
      - outbound:
        - {rule: 100, dest: ${salt_master_subnet}, tcp: 22, allow-deny: 'ALLOW'}
        - {rule: 200, dest: ${salt_master_subnet}, tcp: '4505-4506', allow-deny: 'ALLOW'}
        - {rule: 300, dest: ${db_subnet}, tcp: 3306, allow-deny: 'ALLOW'}
        - {rule: '*', dest: '0.0.0.0/0', all: 'all', allow-deny: 'DENY'}
  - db:
    - acl:
      - inbound:
        - {rule: 100, source: ${salt_master_subnet}, tcp: 22, allow-deny: 'ALLOW'}
        - {rule: 200, source: ${salt_master_subnet}, tcp: '4505-4506', allow-deny: 'ALLOW'}
        - {rule: 300, source: ${app_subnet}, tcp: 3306, allow-deny: 'ALLOW'}
        - {rule: '*', source: '0.0.0.0/0', all: 'all', allow-deny: 'DENY'}
      - outbound:
        - {rule: 100, dest: ${salt_master_subnet}, tcp: 22, allow-deny: 'ALLOW'}
        - {rule: 200, dest: ${salt_master_subnet}, tcp: '4505-4506', allow-deny: 'ALLOW'}
        - {rule: 300, dest: ${app_subnet}, tcp: 3306, allow-deny: 'ALLOW'}
        - {rule: '*', dest: '0.0.0.0/0', all: 'all', allow-deny: 'DENY'}
  - app:
    - acl:
      - inbound:
        - {rule: 100, source: ${salt_master_subnet}, tcp: 22, allow-deny: 'ALLOW'}
        - {rule: 200, source: ${salt_master_subnet}, tcp: '4505-4506', allow-deny: 'ALLOW'}
        - {rule: 300, source: ${db_subnet}, tcp: 3306, allow-deny: 'ALLOW'}
        - {rule: 400, source: '0.0.0.0/0', tcp: 8080, allow-deny: 'ALLOW'}
        - {rule: '*', source: '0.0.0.0/0', all: 'all', allow-deny: 'DENY'}
      - outbound:
        - {rule: 100, dest: ${salt_master_subnet}, tcp: 22, allow-deny: 'ALLOW'}
        - {rule: 200, dest: ${salt_master_subnet}, tcp: '4505-4506', allow-deny: 'ALLOW'}
        - {rule: 300, source: ${db_subnet}, tcp: 3306, allow-deny: 'ALLOW'}
        - {rule: 400, dest: '0.0.0.0/0', tcp: 8080, allow-deny: 'ALLOW'}
        - {rule: '*', dest: '0.0.0.0/0', all: 'all', allow-deny: 'DENY'}