#!/usr/bin/env bash

USAGE="$(basename "$0") {instance id}"

# Validate that instance id given
if [[ $# -eq "0" ]] || ! [[ ${1:0:2} == "i-" ]]; then
  echo "$USAGE"
  exit 9
fi

INSTANCE_ID="$1"

# Get the subnet IDs for the specified instances
SUBNET_IDS=$(aws ec2 describe-instances --instance-ids "$INSTANCE_ID" --query 'Reservations[*].Instances[*].SubnetId' --output text)

# Describe the network ACLs for each subnet ID
for subnet_id in $SUBNET_IDS; do
  echo "Subnet ID: $subnet_id"

  # Fetch the network ACL associated with the subnet
  NACL_ID=$(aws ec2 describe-network-acls --filters "Name=association.subnet-id,Values=$subnet_id" --query 'NetworkAcls[*].NetworkAclId' --output text)

  if [ -n "$NACL_ID" ]; then
    echo "Network ACL ID: $NACL_ID"

    # Describe the network ACL entries
    aws ec2 describe-network-acls --network-acl-ids "$NACL_ID" --query 'NetworkAcls[*].[Associations, Entries]' --output json
  else
    echo "No Network ACL associated with this subnet."
  fi

  echo "-------------------------------------"
done
