Module: `nlb`

Terraform module to create an NLB and a default NLB target and related security groups.

Usage

For a complete example, see examples/complete.

For automated test of the complete example using bats and Terratest, see test.

  provider "aws" {
    region = var.region
  }

  module "vpc" {
    source     = "cloudposse/vpc/aws"
    # Cloud Posse recommends pinning every module to a specific version
    # version     = "x.x.x"

    cidr_block = var.vpc_cidr_block

    context = module.this.context
    namespace = "eg"

  }

  module "subnets" {
    source     = "cloudposse/dynamic-subnets/aws"
    # Cloud Posse recommends pinning every module to a specific version
    # version     = "x.x.x"

    availability_zones   = var.availability_zones
    vpc_id               = module.vpc.vpc_id
    igw_id               = module.vpc.igw_id
    cidr_block           = module.vpc.vpc_cidr_block
    nat_gateway_enabled  = false
    nat_instance_enabled = false

    context = module.this.context
    namespace = "eg"
  }

  module "nlb" {
    source = "cloudposse/nlb/aws"
    # Cloud Posse recommends pinning every module to a specific version
    # version = "x.x.x"
    vpc_id                                          = module.vpc.vpc_id
    subnet_ids                                      = module.subnets.public_subnet_ids
    internal                                        = var.internal
    tcp_enabled                                     = var.tcp_enabled
    access_logs_enabled                             = var.access_logs_enabled
    nlb_access_logs_s3_bucket_force_destroy         = var.nlb_access_logs_s3_bucket_force_destroy
    nlb_access_logs_s3_bucket_force_destroy_enabled = var.nlb_access_logs_s3_bucket_force_destroy_enabled
    cross_zone_load_balancing_enabled               = var.cross_zone_load_balancing_enabled
    idle_timeout                                    = var.idle_timeout
    ip_address_type                                 = var.ip_address_type
    deletion_protection_enabled                     = var.deletion_protection_enabled
    deregistration_delay                            = var.deregistration_delay
    health_check_path                               = var.health_check_path
    health_check_timeout                            = var.health_check_timeout
    health_check_threshold                          = var.health_check_healthy_threshold
    health_check_unhealthy_threshold                = var.health_check_unhealthy_threshold
    health_check_interval                           = var.health_check_interval
    target_group_port                               = var.target_group_port
    target_group_target_type                        = var.target_group_target_type
    
    context = module.this.context
  }

Requirements

Name	Version
terraform	>= 1.0
aws	>= 2.0
local	>= 1.3
null	>= 2.0
template	>= 2.0

Providers

Name	Version
aws	>= 2.0

Modules

Name	Source	Version
access_logs	cloudposse/lb-s3-bucket/aws	0.16.4
default_target_group_label	cloudposse/label/null	0.25.0
eip_label	cloudposse/label/null	0.25.0
lb_label	cloudposse/label/null	0.25.0
this	cloudposse/label/null	0.25.0

Resources

Name	Type
aws_eip.lb	resource
aws_lb.default	resource
aws_lb_listener.default	resource
aws_lb_listener.tls	resource
aws_lb_listener_certificate.https_sni	resource
aws_lb_target_group.default	resource
aws_security_group.default	resource
aws_security_group_rule.default_ingress	resource
aws_security_group_rule.egress	resource
aws_security_group_rule.tls_ingress	resource

Inputs

Name	Description	Type	Default	Required
access_logs_enabled	A boolean flag to enable/disable access_logs	`bool`	`true`	no
access_logs_prefix	The S3 log bucket prefix	`string`	`""`	no
access_logs_s3_bucket_id	An external S3 Bucket name to store access logs in. If specified, no logging bucket will be created.	`string`	`null`	no
additional_certs	A list of additonal certs to add to the https listerner	`list(string)`	`[]`	no
additional_tag_map	Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. This is for some rare cases where resources want additional configuration of tags and therefore take a list of maps with tag key, value, and additional configuration.	`map(string)`	`{}`	no
allow_ssl_requests_only	Set to true to require requests to use Secure Socket Layer (HTTPS/SSL) on the access logs S3 bucket. This will explicitly deny access to HTTP requests	`bool`	`false`	no
attributes	ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, in the order they appear in the list. New attributes are appended to the end of the list. The elements of the list are joined by the `delimiter` and treated as a single ID element.	`list(string)`	`[]`	no
certificate_arn	The ARN of the default SSL certificate for HTTPS listener	`string`	`""`	no
context	Single object for setting entire context at once. See description of individual variables for details. Leave string and numeric variables as `null` to use default value. Individual variable settings (non-null) override settings in context object, except for attributes, tags, and additional_tag_map, which are merged.	`any`	`{ "additional_tag_map": {}, "attributes": [], "delimiter": null, "descriptor_formats": {}, "enabled": true, "environment": null, "id_length_limit": null, "label_key_case": null, "label_order": [], "label_value_case": null, "labels_as_tags": [ "unset" ], "name": null, "namespace": null, "regex_replace_chars": null, "stage": null, "tags": {}, "tenant": null }`	no
cross_zone_load_balancing_enabled	A boolean flag to enable/disable cross zone load balancing	`bool`	`true`	no
default_listener_ingress_cidr_blocks	List of CIDR blocks to allow in TLS security group	`list(string)`	`[ "0.0.0.0/0" ]`	no
default_listener_ingress_prefix_list_ids	List of prefix list IDs for allowing access to TLS ingress security group	`list(string)`	`[]`	no
deletion_protection_enabled	A boolean flag to enable/disable deletion protection for NLB	`bool`	`false`	no
delimiter	Delimiter to be used between ID elements. Defaults to `-` (hyphen). Set to `""` to use no delimiter at all.	`string`	`null`	no
deregistration_delay	The amount of time to wait in seconds before changing the state of a deregistering target to unused	`number`	`15`	no
descriptor_formats	Describe additional descriptors to be output in the `descriptors` output map. Map of maps. Keys are names of descriptors. Values are maps of the form `{<br/> format = string<br/> labels = list(string)<br/>}` (Type is `any` so the map values can later be enhanced to provide additional options.) `format` is a Terraform format string to be passed to the `format()` function. `labels` is a list of labels, in order, to pass to `format()` function. Label values will be normalized before being passed to `format()` so they will be identical to how they appear in `id`. Default is `{}` (`descriptors` output will be empty).	`any`	`{}`	no
eip_additional_tags	The additional tags to apply to the generated eip	`map(string)`	`{}`	no
eip_allocation_ids	Allocation ID for EIP for subnets. The length of the list must correspond to the number of defined subnents. If the `subnet_mapping_enabled` variable is not defined and enabled `subnet_mapping_enabled`, EIPs will be created	`list(string)`	`[]`	no
enable_glacier_transition	(Deprecated, use `lifecycle_configuration_rules` instead) Enables the transition to AWS Glacier which can cause unnecessary costs for huge amount of small files	`bool`	`true`	no
enabled	Set to false to prevent the module from creating any resources	`bool`	`null`	no
enforce_security_group_inbound_rules_on_private_link_traffic	Indicates whether inbound security group rules are enforced for traffic originating from a PrivateLink. Only valid for Load Balancers of type network. The possible values are on and off.	`string`	`null`	no
environment	ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'	`string`	`null`	no
expiration_days	(Deprecated, use `lifecycle_configuration_rules` instead) Number of days after which to expunge the objects	`number`	`90`	no
glacier_transition_days	(Deprecated, use `lifecycle_configuration_rules` instead) Number of days after which to move the data to the Glacier Flexible Retrieval storage tier	`number`	`60`	no
health_check_enabled	A boolean flag to enable/disable the NLB health checks	`bool`	`true`	no
health_check_interval	The duration in seconds in between health checks	`number`	`10`	no
health_check_path	The destination for the health check request	`string`	`"/"`	no
health_check_port	The port to send the health check request to (defaults to `traffic-port`)	`number`	`null`	no
health_check_protocol	The protocol to use for the health check request	`string`	`null`	no
health_check_threshold	The number of consecutive health checks successes required before considering an unhealthy target healthy.	`number`	`2`	no
health_check_timeout	The amount of time, in seconds, during which no response means a failed health check	`number`	`null`	no
health_check_unhealthy_threshold	The number of consecutive health check failures required before considering the target unhealthy. If not set using value from `health_check_threshold`	`number`	`null`	no
id_length_limit	Limit `id` to this many characters (minimum 6). Set to `0` for unlimited length. Set to `null` for keep the existing setting, which defaults to `0`. Does not affect `id_full`.	`number`	`null`	no
internal	A boolean flag to determine whether the NLB should be internal	`bool`	`false`	no
ip_address_type	The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`.	`string`	`"ipv4"`	no
label_key_case	Controls the letter case of the `tags` keys (label names) for tags generated by this module. Does not affect keys of tags passed in via the `tags` input. Possible values: `lower`, `title`, `upper`. Default value: `title`.	`string`	`null`	no
label_order	The order in which the labels (ID elements) appear in the `id`. Defaults to ["namespace", "environment", "stage", "name", "attributes"]. You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.	`list(string)`	`null`	no
label_value_case	Controls the letter case of ID elements (labels) as included in `id`, set as tag values, and output by this module individually. Does not affect values of tags passed in via the `tags` input. Possible values: `lower`, `title`, `upper` and `none` (no transformation). Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. Default value: `lower`.	`string`	`null`	no
labels_as_tags	Set of labels (ID elements) to include as tags in the `tags` output. Default is to include all labels. Tags with empty values will not be included in the `tags` output. Set to `[]` to suppress all generated tags. Notes: The value of the `name` tag, if included, will be the `id`, not the `name`. Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be changed in later chained modules. Attempts to change it will be silently ignored.	`set(string)`	`[ "default" ]`	no
lifecycle_configuration_rules	A list of S3 bucket v2 lifecycle rules, as specified in terraform-aws-s3-bucket" These rules are not affected by the deprecated `lifecycle_rule_enabled` flag. NOTE: Unless you also set `lifecycle_rule_enabled = false` you will also get the default deprecated rules set on your bucket.	`list(object({ enabled = bool id = string abort_incomplete_multipart_upload_days = number # filter_and is the and configuration block inside the filter configuration. # This is the only place you should specify a prefix. filter_and = any expiration = any transition = list(any) noncurrent_version_expiration = any noncurrent_version_transition = list(any) }))`	`[]`	no
lifecycle_rule_enabled	DEPRECATED: Defaults to `false`, use `lifecycle_configuration_rules` instead. When `true`, configures lifecycle events on this bucket using individual (now deprecated) variables."	`bool`	`false`	no
name	ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. This is the only ID element not also included as a `tag`. The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input.	`string`	`null`	no
namespace	ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique	`string`	`null`	no
nlb_access_logs_s3_bucket_force_destroy	A boolean that indicates all objects should be deleted from the NLB access logs S3 bucket so that the bucket can be destroyed without error	`bool`	`false`	no
noncurrent_version_expiration_days	(Deprecated, use `lifecycle_configuration_rules` instead) Specifies when non-current object versions expire (in days)	`number`	`90`	no
noncurrent_version_transition_days	(Deprecated, use `lifecycle_configuration_rules` instead) Specifies (in days) when noncurrent object versions transition to Glacier Flexible Retrieval	`number`	`30`	no
regex_replace_chars	Terraform regular expression (regex) string. Characters matching the regex will be removed from the ID elements. If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits.	`string`	`null`	no
security_group_enabled	Enables the security group	`bool`	`false`	no
security_group_ids	A list of additional security group IDs to allow access to NLB	`list(string)`	`[]`	no
slow_start	Amount time for targets to warm up before the load balancer sends them a full share of requests. The range is 30-900 seconds or 0 to disable.	`number`	`0`	no
stage	ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'	`string`	`null`	no
standard_transition_days	(Deprecated, use `lifecycle_configuration_rules` instead) Number of days to persist in the standard storage tier before moving to the infrequent access tier	`number`	`30`	no
subnet_ids	A list of subnet IDs to associate with NLB	`list(string)`	n/a	yes
subnet_mapping_enabled	Enable generate EIP for defined subnet ids	`bool`	`false`	no
tags	Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). Neither the tag keys nor the tag values will be modified by this module.	`map(string)`	`{}`	no
target_group_additional_tags	The additional tags to apply to the default target group	`map(string)`	`{}`	no
target_group_enabled	Whether or not to create the default target group and listener	`bool`	`true`	no
target_group_ip_address_type	The type of IP addresses used by the target group. The possible values are `ipv4` and `ipv6`.	`string`	`"ipv4"`	no
target_group_name	The name for the default target group, uses a module label name if left empty	`string`	`""`	no
target_group_port	The port for the default target group	`number`	`80`	no
target_group_preserve_client_ip	A boolean flag to enable/disable client IP preservation.	`bool`	`false`	no
target_group_proxy_protocol_v2	A boolean flag to enable/disable proxy protocol v2 support	`bool`	`false`	no
target_group_target_type	The type (`instance`, `ip` or `lambda`) of targets that can be registered with the default target group	`string`	`"ip"`	no
tcp_enabled	A boolean flag to enable/disable TCP listener	`bool`	`true`	no
tcp_port	The port for the TCP listener	`number`	`80`	no
tenant	ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for	`string`	`null`	no
tls_enabled	A boolean flag to enable/disable TLS listener	`bool`	`false`	no
tls_ingress_cidr_blocks	List of CIDR blocks to allow in TLS security group	`list(string)`	`[ "0.0.0.0/0" ]`	no
tls_ingress_prefix_list_ids	List of prefix list IDs for allowing access to TLS ingress security group	`list(string)`	`[]`	no
tls_port	The port for the TLS listener	`number`	`443`	no
tls_ssl_policy	The name of the SSL Policy for the listener	`string`	`"ELBSecurityPolicy-2016-08"`	no
udp_enabled	A boolean flag to enable/disable UDP listener	`bool`	`false`	no
udp_port	The port for the UDP listener	`number`	`53`	no
vpc_id	VPC ID to associate with NLB	`string`	n/a	yes

Outputs

Name	Description
access_logs_bucket_id	The S3 bucket ID for access logs
default_listener_arn	The ARN of the default listener
default_target_group_arn	The default target group ARN
listener_arns	A list of all the listener ARNs
nlb_arn	The ARN of the NLB
nlb_arn_suffix	The ARN suffix of the NLB
nlb_dns_name	DNS name of NLB
nlb_name	The ARN suffix of the NLB
nlb_zone_id	The ID of the zone which NLB is provisioned
security_group_id	The security group ID of the NLB
tls_listener_arn	The ARN of the TLS listener

Module: nlb

Usage​

Requirements​

Providers​

Modules​

Resources​

Inputs​

Outputs​