NetworkAclAssociation

Source: src/AWS/EC2/NetworkAclAssociation.ts

Associates a subnet with a NetworkAcl, replacing whichever ACL the subnet currently uses (every subnet is always associated with exactly one network ACL — the VPC’s default until you point it at a custom one).

Changing subnetId replaces the association, while changing only networkAclId re-points the same subnet at a different ACL in place. On delete, the subnet is reverted to the VPC’s default network ACL so it is never left without one.

Associating Subnets

A subnet starts out attached to the VPC’s default ACL; this resource moves it onto a custom ACL so the rules you defined with NetworkAclEntry take effect for that subnet.

const association = yield* AWS.EC2.NetworkAclAssociation("PrivateSubnetNaclAssoc", {
  networkAclId: privateNetworkAcl.networkAclId,
  subnetId: privateSubnet.subnetId,
});

This detaches the subnet from the default ACL and attaches it to your custom ACL; destroying the association automatically reverts the subnet to the default ACL, which is the safe way to “remove” a custom ACL from a subnet.