ec2_vpc_nacl - fix issue occurring when updating existing NACL rule

changelogs/fragments/20250513-ec2_vpc_nacl-fix-issue-when-updating-rules.yml

@@ -0,0 +1,3 @@
+---
+bugfixes:
+  - ec2_vpc_nacl - Fix issue when trying to update existing Network ACL rule (https://github.com/ansible-collections/amazon.aws/issues/2592).

plugins/modules/ec2_vpc_nacl.py

@@ -298,6 +298,13 @@ def rules_changed(
     removed_rules = find_added_rules(aws_rules, ansible_rules)
 
     changed = False
+    # Removed Rules
+    for rule in removed_rules:
+        changed = True
+        if not check_mode:
+            delete_network_acl_entry(client, network_acl_id=nacl_id, rule_number=rule["RuleNumber"], egress=egress)
+
+    # Added Rules
     for rule in added_rules:
         changed = True
         if not check_mode:
@@ -315,12 +322,6 @@ def rules_changed(
                 **rule,
             )
 
-    # Removed Rules
-    for rule in removed_rules:
-        changed = True
-        if not check_mode:
-            delete_network_acl_entry(client, network_acl_id=nacl_id, rule_number=rule["RuleNumber"], egress=egress)
-
     return changed
 
 

tests/integration/targets/ec2_vpc_nacl/tasks/ingress_and_egress.yml

@@ -145,6 +145,43 @@
           - nacl_facts.nacls[0].ingress | length == 2
           - nacl_facts.nacls[0].egress | length == 2
 
+  # ============================================================
+
+    - name: Update egress rule
+      amazon.aws.ec2_vpc_nacl:
+        vpc_id: "{{ vpc_id }}"
+        name: "{{ nacl_name }}"
+        subnets: "{{ subnet_ids }}"
+        tags:
+          Created_by: "Ansible test {{ resource_prefix }}"
+        ingress:
+          - [100, "tcp", "allow", "0.0.0.0/0", !!null "", !!null "", 22, 22]
+          - [200, "tcp", "allow", "0.0.0.0/0", !!null "", !!null "", 80, 80]
+        egress:
+          - [100, "tcp", "allow", "192.68.0.0/24", !!null "", !!null "", 22, 22]
+          - [200, "udp", "allow", "192.68.0.0/24", !!null "", !!null "", 443, 443]
+        state: "present"
+      register: nacl
+
+    - name: Assert the network acl changed
+      ansible.builtin.assert:
+        that:
+          - nacl.changed
+          - nacl.nacl_id.startswith('acl-')
+
+    - name: Get network ACL facts
+      amazon.aws.ec2_vpc_nacl_info:
+        nacl_ids:
+          - "{{ nacl.nacl_id }}"
+      register: nacl_facts
+
+    - name: Assert the nacl has the correct attributes
+      ansible.builtin.assert:
+        that:
+          - nacl_facts.nacls | length == 1
+          - nacl_facts.nacls[0].ingress | length == 2
+          - nacl_facts.nacls[0].egress | length == 2
+
   # ============================================================
 
     - name: Remove the network ACL