terraform-aws-alb

The module code is based on github.com/worldcoin/terraform-aws-nlb

Example

module "alb" {
  source = "github.com/worldcoin/terraform-aws-alb?ref=v1.1.0"

  cluster_name = var.name
  application  = "traefik/traefik"
  ingress_name = "traefik"
  internal     = false

  acm_arn        = var.acm_arn
  acm_extra_arns = var.acm_extra_arns
  vpc_id         = var.vpc_config.vpc_id
  public_subnets = var.vpc_config.public_subnets
}

When create_default_listener = false, acm_arn can be omitted:

module "alb" {
  source = "github.com/worldcoin/terraform-aws-alb?ref=v1.6.0"

  cluster_name             = var.name
  application              = "gateway-api/gateway"
  ingress_name             = "gateway"
  internal                 = false
  create_default_listener  = false

  vpc_id         = var.vpc_config.vpc_id
  public_subnets = var.vpc_config.public_subnets
}

mTLS (Mutual TLS)

By default mTLS for ALB listener is enable with this module. If you want to disable it set variable to false

• mtls_enabled = false

WAF

You can override default rules using waf_rules

WAF rules are defined as default, if you want to add custom managed WAF rules you need to create your own file due to restrictions in creation of custom rules. If you create your own WAF resource you need to deattach WAF rules created in this module.

Requirements

Name	Version
terraform	>= 1.2
aws	>= 4.14.0
cloudflare	>= 5.8
datadog	>= 3.0

Providers

Name	Version
aws	>= 4.14.0
cloudflare	>= 5.8
datadog	>= 3.0

Modules

No modules.

Resources

Name	Type
aws_lb.alb	resource
aws_lb_listener.tls	resource
aws_lb_listener_certificate.extra	resource
aws_lb_trust_store.root_ca	resource
aws_security_group.alb	resource
aws_security_group.alb_backend	resource
datadog_monitor.traefik_alb_client_tls_negotiation	resource
aws_region.current	data source
aws_vpc.current	data source
cloudflare_ip_ranges.cloudflare	data source

Inputs

Name	Description	Type	Default	Required
acm_arn	ARN for ACM certificate used for TLS. Required when create_default_listener is true.	string	null	no
acm_extra_arns	ARNs of ACM certificates used for TLS, attached as additional certificates to the main NLB	list(string)	[]	no
additional_open_ports	Additional ports accessible from the Internet for the ALB	set(object({ port = number protocol = optional(string, "tcp") }))	[]	no
application	Name of application which will be connected to this ALB	string	n/a	yes
backend_ingress_rules	The security group rules to allow ingress from.	set(object({ description = optional(string, "") protocol = optional(string, "tcp") port = optional(number, 443) security_groups = optional(list(string)) cidr_blocks = optional(list(string)) }))	[]	no
cluster_name	Name of the cluster will be used as suffix to all resources	string	n/a	yes
cluster_tag	Value for the elbv2.k8s.aws/cluster tag. Defaults to cluster_name. Use when the tag must differ from the name used to construct the LB name (e.g. Gateway API where the LB name prefix is trimmed but the tag must match the LBC --cluster-name).	string	""	no
create_default_listener	Create the default HTTPS listener on port 443. Set to false when the listener is managed externally (e.g. by the AWS Gateway API controller).	bool	true	no
datadog	Datadog configuration	object({ monitoring_notification_channel = string client_tls_negotiation_threshold = optional(number, 5) })	null	no
drop_invalid_header_fields	Drop invalid header fields	bool	true	no
enable_deletion_protection	If true, deletion of the load balancer will be disabled via the AWS API	bool	true	no
idle_timeout	The time in seconds that the connection is allowed to be idle	number	60	no
internal	Set NLB to be internal (available only within VPC)	bool	n/a	yes
mtls_enabled	Enable mutual TLS (mTLS) on the ALB TLS listener	bool	true	no
mtls_s3_bucket	S3 bucket where the CA certificates for mTLS are stored	string	"wld-mtls-ca-us-east-1"	no
mtls_s3_key	S3 key where the CA certificates for mTLS are stored	string	"ca_cert/RootCA.pem"	no
name_suffix	Part of the name used to differentiate NLBs for multiple traefik instances	string	""	no
namespace	Name of namespace where application is deployed	string	n/a	yes
open_to_all	Allow all traffic to the ALB	bool	false	no
public_subnets	List of public subnets to use	list(string)	n/a	yes
s3_logs_bucket_id	The ID of S3 bucket where the ALB logs will be stored, enables logging if set	string	null	no
tag_prefix	Tag key prefix for LBC resource/stack tags (e.g. ingress.k8s.aws for Ingress, gateway.k8s.aws.alb for Gateway API)	string	"ingress.k8s.aws"	no
tag_stack	Override the computed stack tag value (default: namespace.application)	string	""	no
tags	Tags for the ALB and its default listener. If non-empty, these fully replace the module's default tags (elbv2.k8s.aws/cluster, <tag_prefix>/resource, <tag_prefix>/stack) instead of merging with them - use this for an ALB that must not be tracked/managed by an EKS AWS Load Balancer Controller (e.g. a Lambda-backed ALB).	map(string)	{}	no
tls_listener_version	Minimum TLS version served by TLS listener	string	"1.3"	no
vpc_id	VPC ID where the NLB will be deployed	string	n/a	yes

Outputs

Name	Description
arn	The ARN of the NLB.
dns_name	The DNS name of the NLB.
listener_arn	The ARN of the ALB default listener.
sg_ids	Security Group attached to loadbalancer
ssl_policy	SSL Policy attached to loadbalancer
trust_store_arn	The ARN of the mTLS trust store.
zone_id	The zone ID of the NLB.