title: How to use CloudFormation to edit a VPC's default network ACL?
body: <p>If I declare the following resource in a CloudFormation template,</p>
  
  <pre><code>"CoolVpc": {
    "Type": "AWS::EC2::VPC",
    "Properties": {
      "CidrBlock": "10.10.0.0/16",
      "Tags": [
        {"Key": "Name", "Value": "cool-vpc"},
      ]
    }
  }
  </code></pre>
  
  <p>... CloudFormation will dutifully comply and create my VPC, and as part of the process it will automatically create a default network ACL to go along with it. I could easily <em>reference</em> that ACL using the <code>GetAtt</code> function, like:</p>
  
  <pre><code>"TestSubnetAcl": {
    "Type": "AWS::EC2::SubnetNetworkAclAssociation",
    "Properties": {
      "NetworkAclId": {"Fn::GetAtt" : ["CoolVpc" , "DefaultNetworkAcl"]},
      "SubnetId": {"Ref": "TestSubnet"}
    }
  }
  </code></pre>
  
  <p>or</p>
  
  <pre><code>"AclRule100": {
    "Type": "AWS::EC2::NetworkAclEntry",
    "Properties": {
      "CidrBlock": "0.0.0.0/0",
      "Egress": "true",
      "Protocol": "-1",
      "RuleAction": "allow",
      "RuleNumber": "100",
      "NetworkAclId": {"Fn::GetAtt" : ["CoolVpc" , "DefaultNetworkAcl"]}
    }
  }
  </code></pre>
  
  <p>... but what if I wanted to <em>edit</em> the default network ACL itself? (Yes, I know the only thing that can be changed there are the <code>Tags</code>, but that's exactly what I want to edit.)</p>
  
  <p>I've tried adding a new NetworkAcl to the template and only using that, but the unnamed default keeps hanging around and it bugs me that I don't have a way to assign tags to it that make it clear what its purpose is.</p>