Module: `alb-ingress`

Terraform module to provision an HTTP style ALB ingress based on hostname and/or path.

ALB ingress can be provisioned without authentication, or using Cognito or OIDC authentication.

Usage

For a complete example, see examples/complete.

For automated test of the complete example using bats and Terratest, see test.

provider "aws" {
  region = var.region
}

module "vpc" {
  source     = "cloudposse/vpc/aws"
  # Cloud Posse recommends pinning every module to a specific version
  # version     = "x.x.x"

  namespace  = var.namespace
  stage      = var.stage
  name       = var.name
  delimiter  = var.delimiter
  attributes = var.attributes
  cidr_block = var.vpc_cidr_block

  tags       = var.tags
}

module "subnets" {
  source = "cloudposse/dynamic-subnets/aws"
  # Cloud Posse recommends pinning every module to a specific version
  # version     = "x.x.x"

  availability_zones   = var.availability_zones
  namespace            = var.namespace
  stage                = var.stage
  name                 = var.name
  attributes           = var.attributes
  delimiter            = var.delimiter
  vpc_id               = module.vpc.vpc_id
  igw_id               = module.vpc.igw_id
  cidr_block           = module.vpc.vpc_cidr_block
  nat_gateway_enabled  = false
  nat_instance_enabled = false

  tags = var.tags
}

module "alb" {
  source = "cloudposse/alb/aws"
  # Cloud Posse recommends pinning every module to a specific version
  # version     = "x.x.x"

  namespace                               = var.namespace
  stage                                   = var.stage
  name                                    = var.name
  attributes                              = var.attributes
  delimiter                               = var.delimiter
  vpc_id                                  = module.vpc.vpc_id
  security_group_ids                      = [module.vpc.vpc_default_security_group_id]
  subnet_ids                              = module.subnets.public_subnet_ids
  internal                                = var.internal
  http_enabled                            = var.http_enabled
  access_logs_enabled                     = var.access_logs_enabled
  alb_access_logs_s3_bucket_force_destroy = var.alb_access_logs_s3_bucket_force_destroy
  cross_zone_load_balancing_enabled       = var.cross_zone_load_balancing_enabled
  http2_enabled                           = var.http2_enabled
  idle_timeout                            = var.idle_timeout
  ip_address_type                         = var.ip_address_type
  deletion_protection_enabled             = var.deletion_protection_enabled
  deregistration_delay                    = var.deregistration_delay
  health_check_path                       = var.health_check_path
  health_check_timeout                    = var.health_check_timeout
  health_check_healthy_threshold          = var.health_check_healthy_threshold
  health_check_unhealthy_threshold        = var.health_check_unhealthy_threshold
  health_check_interval                   = var.health_check_interval
  health_check_matcher                    = var.health_check_matcher
  target_group_port                       = var.target_group_port
  target_group_target_type                = var.target_group_target_type

  tags = var.tags
}

module "alb_ingress" {
  source = "cloudposse/alb-ingress/aws"
  # Cloud Posse recommends pinning every module to a specific version
  # version     = "x.x.x"

  namespace                           = var.namespace
  stage                               = var.stage
  name                                = var.name
  attributes                          = var.attributes
  delimiter                           = var.delimiter
  vpc_id                              = module.vpc.vpc_id
  authentication_type                 = var.authentication_type
  unauthenticated_priority            = var.unauthenticated_priority
  unauthenticated_paths               = var.unauthenticated_paths
  slow_start                          = var.slow_start
  stickiness_enabled                  = var.stickiness_enabled
  default_target_group_enabled        = false
  target_group_arn                    = module.alb.default_target_group_arn
  unauthenticated_listener_arns       = [module.alb.http_listener_arn]

  tags = var.tags
}

Requirements

Name	Version
terraform	>= 1.0
aws	>= 4.0

Providers

Name	Version
aws	>= 4.0

Modules

Name	Source	Version
target_group	cloudposse/label/null	0.25.0
this	cloudposse/label/null	0.25.0

Resources

Name	Type
aws_lb_listener_rule.authenticated_hosts_cognito	resource
aws_lb_listener_rule.authenticated_hosts_oidc	resource
aws_lb_listener_rule.authenticated_hosts_paths_cognito	resource
aws_lb_listener_rule.authenticated_hosts_paths_oidc	resource
aws_lb_listener_rule.authenticated_paths_cognito	resource
aws_lb_listener_rule.authenticated_paths_oidc	resource
aws_lb_listener_rule.unauthenticated_hosts	resource
aws_lb_listener_rule.unauthenticated_hosts_paths	resource
aws_lb_listener_rule.unauthenticated_paths	resource
aws_lb_target_group.default	resource
aws_lb_target_group.default	data source

Inputs

Name	Description	Type	Default	Required
additional_tag_map	Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. This is for some rare cases where resources want additional configuration of tags and therefore take a list of maps with tag key, value, and additional configuration.	`map(string)`	`{}`	no
attributes	ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, in the order they appear in the list. New attributes are appended to the end of the list. The elements of the list are joined by the `delimiter` and treated as a single ID element.	`list(string)`	`[]`	no
authenticated_hosts	Authenticated hosts to match in Hosts header	`list(string)`	`[]`	no
authenticated_listener_arns	A list of authenticated ALB listener ARNs to attach ALB listener rules to	`list(string)`	`[]`	no
authenticated_paths	Authenticated path pattern to match (a maximum of 1 can be defined)	`list(string)`	`[]`	no
authenticated_priority	The priority for the rules with authentication, between 1 and 50000 (1 being highest priority). Must be different from `unauthenticated_priority` since a listener can't have multiple rules with the same priority	`number`	`null`	no
authentication_cognito_on_unauthenticated_request	Cognito unauthenticated behavior, deny, allow, or authenticate	`string`	`"authenticate"`	no
authentication_cognito_request_extra_params	Cognito query parameters to include in redirect request	`map(string)`	`null`	no
authentication_cognito_scope	Cognito scope, which should be a space separated string of requested scopes (see https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims)	`string`	`null`	no
authentication_cognito_user_pool_arn	Cognito User Pool ARN	`string`	`""`	no
authentication_cognito_user_pool_client_id	Cognito User Pool Client ID	`string`	`""`	no
authentication_cognito_user_pool_domain	Cognito User Pool Domain. The User Pool Domain should be set to the domain prefix (`xxx`) instead of full domain (https://xxx.auth.us-west-2.amazoncognito.com)	`string`	`""`	no
authentication_oidc_authorization_endpoint	OIDC Authorization Endpoint	`string`	`""`	no
authentication_oidc_client_id	OIDC Client ID	`string`	`""`	no
authentication_oidc_client_secret	OIDC Client Secret	`string`	`""`	no
authentication_oidc_issuer	OIDC Issuer	`string`	`""`	no
authentication_oidc_on_unauthenticated_request	OIDC unauthenticated behavior, deny, allow, or authenticate	`string`	`"authenticate"`	no
authentication_oidc_request_extra_params	OIDC query parameters to include in redirect request	`map(string)`	`null`	no
authentication_oidc_scope	OIDC scope, which should be a space separated string of requested scopes (see https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims, and https://developers.google.com/identity/protocols/oauth2/openid-connect#scope-param for an example set of scopes when using Google as the IdP)	`string`	`null`	no
authentication_oidc_token_endpoint	OIDC Token Endpoint	`string`	`""`	no
authentication_oidc_user_info_endpoint	OIDC User Info Endpoint	`string`	`""`	no
authentication_type	Authentication type. Supported values are `COGNITO` and `OIDC`	`string`	`""`	no
context	Single object for setting entire context at once. See description of individual variables for details. Leave string and numeric variables as `null` to use default value. Individual variable settings (non-null) override settings in context object, except for attributes, tags, and additional_tag_map, which are merged.	`any`	`{ "additional_tag_map": {}, "attributes": [], "delimiter": null, "descriptor_formats": {}, "enabled": true, "environment": null, "id_length_limit": null, "label_key_case": null, "label_order": [], "label_value_case": null, "labels_as_tags": [ "unset" ], "name": null, "namespace": null, "regex_replace_chars": null, "stage": null, "tags": {}, "tenant": null }`	no
default_target_group_enabled	Enable/disable creation of the default target group	`bool`	`true`	no
delimiter	Delimiter to be used between ID elements. Defaults to `-` (hyphen). Set to `""` to use no delimiter at all.	`string`	`null`	no
deregistration_delay	The amount of time to wait in seconds while deregistering target	`number`	`15`	no
descriptor_formats	Describe additional descriptors to be output in the `descriptors` output map. Map of maps. Keys are names of descriptors. Values are maps of the form `{<br/> format = string<br/> labels = list(string)<br/>}` (Type is `any` so the map values can later be enhanced to provide additional options.) `format` is a Terraform format string to be passed to the `format()` function. `labels` is a list of labels, in order, to pass to `format()` function. Label values will be normalized before being passed to `format()` so they will be identical to how they appear in `id`. Default is `{}` (`descriptors` output will be empty).	`any`	`{}`	no
enabled	Set to false to prevent the module from creating any resources	`bool`	`null`	no
environment	ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'	`string`	`null`	no
health_check_enabled	Indicates whether health checks are enabled. Defaults to `true`	`bool`	`true`	no
health_check_healthy_threshold	The number of consecutive health checks successes required before healthy	`number`	`2`	no
health_check_interval	The duration in seconds in between health checks	`number`	`15`	no
health_check_matcher	The HTTP response codes to indicate a healthy check	`string`	`"200-399"`	no
health_check_path	The destination for the health check request	`string`	`"/"`	no
health_check_port	The port to use to connect with the target. Valid values are either ports 1-65536, or `traffic-port`. Defaults to `traffic-port`	`string`	`"traffic-port"`	no
health_check_protocol	The protocol to use to connect with the target. Defaults to `HTTP`. Not applicable when `target_type` is `lambda`	`string`	`"HTTP"`	no
health_check_timeout	The amount of time to wait in seconds before failing a health check request	`number`	`10`	no
health_check_unhealthy_threshold	The number of consecutive health check failures required before unhealthy	`number`	`2`	no
id_length_limit	Limit `id` to this many characters (minimum 6). Set to `0` for unlimited length. Set to `null` for keep the existing setting, which defaults to `0`. Does not affect `id_full`.	`number`	`null`	no
label_key_case	Controls the letter case of the `tags` keys (label names) for tags generated by this module. Does not affect keys of tags passed in via the `tags` input. Possible values: `lower`, `title`, `upper`. Default value: `title`.	`string`	`null`	no
label_order	The order in which the labels (ID elements) appear in the `id`. Defaults to ["namespace", "environment", "stage", "name", "attributes"]. You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.	`list(string)`	`null`	no
label_value_case	Controls the letter case of ID elements (labels) as included in `id`, set as tag values, and output by this module individually. Does not affect values of tags passed in via the `tags` input. Possible values: `lower`, `title`, `upper` and `none` (no transformation). Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. Default value: `lower`.	`string`	`null`	no
labels_as_tags	Set of labels (ID elements) to include as tags in the `tags` output. Default is to include all labels. Tags with empty values will not be included in the `tags` output. Set to `[]` to suppress all generated tags. Notes: The value of the `name` tag, if included, will be the `id`, not the `name`. Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be changed in later chained modules. Attempts to change it will be silently ignored.	`set(string)`	`[ "default" ]`	no
listener_http_header_conditions	A list of http header conditions to apply to the listener.	`list(object({ name = string value = list(string) }))`	`[]`	no
load_balancing_algorithm_type	Determines how the load balancer selects targets when routing requests. Only applicable for Application Load Balancer Target Groups. The value is round_robin or least_outstanding_requests. The default is round_robin.	`string`	`"round_robin"`	no
name	ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. This is the only ID element not also included as a `tag`. The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input.	`string`	`null`	no
namespace	ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique	`string`	`null`	no
port	The port for the created ALB target group (if `target_group_arn` is not set)	`number`	`80`	no
protocol	The protocol for the created ALB target group (if `target_group_arn` is not set)	`string`	`"HTTP"`	no
protocol_version	Only applicable when protocol is `HTTP` or `HTTPS`. The protocol version. Specify GRPC to send requests to targets using gRPC. Specify HTTP2 to send requests to targets using HTTP/2. The default is `HTTP1`, which sends requests to targets using HTTP/1.1	`string`	`"HTTP1"`	no
regex_replace_chars	Terraform regular expression (regex) string. Characters matching the regex will be removed from the ID elements. If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits.	`string`	`null`	no
slow_start	The amount of time for targets to warm up before the load balancer sends them a full share of requests. The range is 30-900 seconds or 0 to disable. The default value is `0` seconds	`number`	`0`	no
stage	ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'	`string`	`null`	no
stickiness_cookie_duration	The time period, in seconds, during which requests from a client should be routed to the same target. After this time period expires, the load balancer-generated cookie is considered stale. The range is 1 second to 1 week (604800 seconds). The default value is 1 day (86400 seconds)	`number`	`86400`	no
stickiness_enabled	Boolean to enable / disable `stickiness`. Default is `true`	`bool`	`true`	no
stickiness_type	The type of sticky sessions. The only current possible value is `lb_cookie`	`string`	`"lb_cookie"`	no
tags	Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). Neither the tag keys nor the tag values will be modified by this module.	`map(string)`	`{}`	no
target_group_arn	Existing ALB target group ARN. If provided, set `default_target_group_enabled` to `false` to disable creation of the default target group	`string`	`""`	no
target_group_name	Override the target group name	`string`	`""`	no
target_type	The type (`instance`, `ip` or `lambda`) of targets that can be registered with the target group	`string`	`"ip"`	no
tenant	ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for	`string`	`null`	no
unauthenticated_hosts	Unauthenticated hosts to match in Hosts header	`list(string)`	`[]`	no
unauthenticated_listener_arns	A list of unauthenticated ALB listener ARNs to attach ALB listener rules to	`list(string)`	`[]`	no
unauthenticated_paths	Unauthenticated path pattern to match (a maximum of 1 can be defined)	`list(string)`	`[]`	no
unauthenticated_priority	The priority for the rules without authentication, between 1 and 50000 (1 being highest priority). Must be different from `authenticated_priority` since a listener can't have multiple rules with the same priority	`number`	`null`	no
vpc_id	The VPC ID where generated ALB target group will be provisioned (if `target_group_arn` is not set)	`string`	n/a	yes

Outputs

Name	Description
target_group_arn	ALB Target Group ARN
target_group_arn_suffix	ALB Target Group ARN suffix
target_group_name	ALB Target Group name

Module: alb-ingress

Usage​

Requirements​

Providers​

Modules​

Resources​

Inputs​

Outputs​