Skip to content

Commit 0202352

Browse files
jnoninojnonino
committed
Fixing issues
1 parent b6cfdf4 commit 0202352

File tree

3 files changed

+223
-69
lines changed

3 files changed

+223
-69
lines changed

‎examples/test/main.tf‎

Lines changed: 9 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -14,17 +14,6 @@ module "base-network" {
1414
private_subnets_cidrs_per_availability_zone = ["192.168.128.0/19", "192.168.160.0/19", "192.168.192.0/19", "192.168.224.0/19"]
1515
}
1616

17-
module "load_balancer" {
18-
source = "../../../terraform-aws-ecs-alb"
19-
20-
# source = "cn-terraform/ecs-alb/aws"
21-
# version = "1.0.6"
22-
name_prefix = "test-alb"
23-
vpc_id = module.base-network.vpc_id
24-
private_subnets = module.base-network.private_subnets_ids
25-
public_subnets = module.base-network.public_subnets_ids
26-
}
27-
2817
module "td" {
2918
source = "cn-terraform/ecs-fargate-task-definition/aws"
3019
version = "1.0.16"
@@ -34,21 +23,13 @@ module "td" {
3423
}
3524

3625
module "service" {
37-
source = "../../"
38-
name_prefix = "test-service"
39-
vpc_id = module.base-network.vpc_id
40-
ecs_cluster_arn = module.cluster.aws_ecs_cluster_cluster_arn
41-
task_definition_arn = module.td.aws_ecs_task_definition_td_arn
42-
public_subnets = module.base-network.public_subnets_ids
43-
private_subnets = module.base-network.private_subnets_ids
44-
container_name = "test"
45-
ecs_cluster_name = module.cluster.aws_ecs_cluster_cluster_name
46-
lb_arn = module.load_balancer.aws_lb_lb_arn
47-
lb_http_tgs_arns = module.load_balancer.lb_http_tgs_arns
48-
lb_https_tgs_arns = module.load_balancer.lb_https_tgs_arns
49-
lb_http_tgs_ports = module.load_balancer.lb_http_tgs_ports
50-
lb_https_tgs_ports = module.load_balancer.lb_https_tgs_ports
51-
lb_http_listeners_arns = module.load_balancer.lb_http_listeners_arns
52-
lb_https_listeners_arns = module.load_balancer.lb_https_listeners_arns
53-
load_balancer_sg_id = module.load_balancer.aws_security_group_lb_access_sg_id
26+
source = "../../"
27+
name_prefix = "test-service"
28+
vpc_id = module.base-network.vpc_id
29+
ecs_cluster_arn = module.cluster.aws_ecs_cluster_cluster_arn
30+
task_definition_arn = module.td.aws_ecs_task_definition_td_arn
31+
public_subnets = module.base-network.public_subnets_ids
32+
private_subnets = module.base-network.private_subnets_ids
33+
container_name = "test"
34+
ecs_cluster_name = module.cluster.aws_ecs_cluster_cluster_name
5435
}

‎main.tf‎

Lines changed: 59 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,45 @@
11
#------------------------------------------------------------------------------
22
# AWS LOAD BALANCER
33
#------------------------------------------------------------------------------
4-
data "aws_lb_target_group" "lb_http_target_groups" {
5-
for_each = toset(var.lb_http_tgs_arns)
6-
arn = each.key
7-
}
4+
module "ecs-alb" {
5+
source = "cn-terraform/ecs-alb/aws"
6+
version = "1.0.7"
7+
8+
name_prefix = "${var.name_prefix}"
9+
vpc_id = var.vpc_id
10+
11+
# Application Load Balancer
12+
internal = var.lb_internal
13+
security_groups = var.lb_security_groups
14+
drop_invalid_header_fields = var.lb_drop_invalid_header_fields
15+
private_subnets = var.private_subnets
16+
public_subnets = var.public_subnets
17+
idle_timeout = var.lb_idle_timeout
18+
enable_deletion_protection = var.lb_enable_deletion_protection
19+
enable_cross_zone_load_balancing = var.lb_enable_cross_zone_load_balancing
20+
enable_http2 = var.lb_enable_http2
21+
ip_address_type = var.lb_ip_address_type
22+
23+
# Access Control to Application Load Balancer
24+
http_ports = var.lb_http_ports
25+
http_ingress_cidr_blocks = var.lb_http_ingress_cidr_blocks
26+
http_ingress_prefix_list_ids = var.lb_http_ingress_prefix_list_ids
27+
https_ports = var.lb_https_ports
28+
https_ingress_cidr_blocks = var.lb_https_ingress_cidr_blocks
29+
https_ingress_prefix_list_ids = var.lb_https_ingress_prefix_list_ids
830

9-
data "aws_lb_target_group" "lb_https_target_groups" {
10-
for_each = toset(var.lb_https_tgs_arns)
11-
arn = each.key
31+
# Target Groups
32+
deregistration_delay = var.lb_deregistration_delay
33+
slow_start = var.lb_slow_start
34+
load_balancing_algorithm_type = var.lb_load_balancing_algorithm_type
35+
stickiness = var.lb_stickiness
36+
target_group_health_check_enabled = var.lb_target_group_health_check_enabled
37+
target_group_health_check_interval = var.lb_target_group_health_check_interval
38+
target_group_health_check_path = var.lb_target_group_health_check_path
39+
target_group_health_check_timeout = var.lb_target_group_health_check_timeout
40+
target_group_health_check_healthy_threshold = var.lb_target_group_health_check_healthy_threshold
41+
target_group_health_check_unhealthy_threshold = var.lb_target_group_health_check_unhealthy_threshold
42+
target_group_health_check_matcher = var.lb_target_group_health_check_matcher
1243
}
1344

1445
#------------------------------------------------------------------------------
@@ -25,20 +56,21 @@ resource "aws_ecs_service" "service" {
2556
health_check_grace_period_seconds = var.health_check_grace_period_seconds
2657
launch_type = "FARGATE"
2758
force_new_deployment = var.force_new_deployment
59+
2860
dynamic "load_balancer" {
29-
for_each = data.aws_lb_target_group.lb_http_target_groups
61+
for_each = module.ecs-alb.lb_http_tgs_map_arn_port
3062
content {
31-
target_group_arn = load_balancer.value.arn
63+
target_group_arn = each.key
3264
container_name = var.container_name
33-
container_port = load_balancer.value.port
65+
container_port = each.value
3466
}
3567
}
3668
dynamic "load_balancer" {
37-
for_each = data.aws_lb_target_group.lb_https_target_groups
69+
for_each = module.ecs-alb.lb_https_tgs_map_arn_port
3870
content {
39-
target_group_arn = load_balancer.value.arn
71+
target_group_arn = each.key
4072
container_name = var.container_name
41-
container_port = load_balancer.value.port
73+
container_port = each.value
4274
}
4375
}
4476
network_configuration {
@@ -84,33 +116,37 @@ resource "aws_security_group" "ecs_tasks_sg" {
84116
name = "${var.name_prefix}-ecs-tasks-sg"
85117
description = "Allow inbound access from the LB only"
86118
vpc_id = var.vpc_id
87-
egress {
88-
protocol = "-1"
89-
from_port = 0
90-
to_port = 0
91-
cidr_blocks = ["0.0.0.0/0"]
92-
}
119+
93120
tags = {
94121
Name = "${var.name_prefix}-ecs-tasks-sg"
95122
}
96123
}
97124

125+
resource "aws_security_group_rule" "egress" {
126+
security_group_id = aws_security_group.ecs_tasks_sg.id
127+
type = "egress"
128+
from_port = 0
129+
to_port = 0
130+
protocol = "-1"
131+
cidr_blocks = ["0.0.0.0/0"]
132+
}
133+
98134
resource "aws_security_group_rule" "ingress_through_http" {
99-
for_each = var.lb_http_tgs_ports != null ? toset(var.lb_http_tgs_ports) : toset([])
135+
for_each = toset(module.ecs-alb.lb_http_tgs_ports)
100136
security_group_id = aws_security_group.ecs_tasks_sg.id
101137
type = "ingress"
102138
from_port = each.key
103139
to_port = each.key
104140
protocol = "tcp"
105-
source_security_group_id = var.load_balancer_sg_id
141+
source_security_group_id = module.ecs-alb.aws_security_group_lb_access_sg_id
106142
}
107143

108144
resource "aws_security_group_rule" "ingress_through_https" {
109-
for_each = var.lb_https_tgs_ports != null ? toset(var.lb_https_tgs_ports) : toset([])
145+
for_each = toset(module.ecs-alb.lb_https_tgs_ports)
110146
security_group_id = aws_security_group.ecs_tasks_sg.id
111147
type = "ingress"
112148
from_port = each.key
113149
to_port = each.key
114150
protocol = "tcp"
115-
source_security_group_id = var.load_balancer_sg_id
151+
source_security_group_id = module.ecs-alb.aws_security_group_lb_access_sg_id
116152
}

‎variables.tf‎

Lines changed: 155 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -174,42 +174,179 @@ variable "scale_target_min_capacity" {
174174
#------------------------------------------------------------------------------
175175
# AWS LOAD BALANCER
176176
#------------------------------------------------------------------------------
177-
variable "lb_arn" {
178-
description = "Load Balancer ARN"
179-
type = string
177+
#------------------------------------------------------------------------------
178+
# APPLICATION LOAD BALANCER
179+
#------------------------------------------------------------------------------
180+
variable "lb_internal" {
181+
description = "(Optional) If true, the LB will be internal."
182+
type = bool
183+
default = false
180184
}
181185

182-
variable "lb_http_tgs_arns" {
183-
description = "List of HTTP LB Target Group ARNs"
186+
variable "lb_security_groups" {
187+
description = "(Optional) A list of security group IDs to assign to the LB."
184188
type = list(string)
189+
default = []
185190
}
186191

187-
variable "lb_http_tgs_ports" {
188-
description = "List of HTTP LB Target Group Ports"
189-
type = list(string)
192+
variable "lb_drop_invalid_header_fields" {
193+
description = "(Optional) Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (true) or routed to targets (false). The default is false. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens."
194+
type = bool
195+
default = false
190196
}
191197

192-
variable "lb_https_tgs_arns" {
193-
description = "List of HTTPS LB Target Group ARNs"
198+
variable "lb_idle_timeout" {
199+
description = "(Optional) The time in seconds that the connection is allowed to be idle. Default: 60."
200+
type = number
201+
default = 60
202+
}
203+
204+
variable "lb_enable_deletion_protection" {
205+
description = "(Optional) If true, deletion of the load balancer will be disabled via the AWS API. This will prevent Terraform from deleting the load balancer. Defaults to false."
206+
type = bool
207+
default = false
208+
}
209+
210+
variable "lb_enable_cross_zone_load_balancing" {
211+
description = "(Optional) If true, cross-zone load balancing of the load balancer will be enabled. Defaults to false."
212+
type = bool
213+
default = false
214+
}
215+
216+
variable "lb_enable_http2" {
217+
description = "(Optional) Indicates whether HTTP/2 is enabled in the load balancer. Defaults to true."
218+
type = bool
219+
default = true
220+
}
221+
222+
variable "lb_ip_address_type" {
223+
description = "(Optional) The type of IP addresses used by the subnets for your load balancer. The possible values are ipv4 and dualstack. Defaults to ipv4"
224+
type = string
225+
default = "ipv4"
226+
}
227+
228+
#------------------------------------------------------------------------------
229+
# ACCESS CONTROL TO APPLICATION LOAD BALANCER
230+
#------------------------------------------------------------------------------
231+
variable "lb_http_ports" {
232+
description = "Map containing objects with two fields, listener_port and the target_group_port to redirect HTTP requests"
233+
type = map
234+
default = {
235+
default_http = {
236+
listener_port = 80
237+
target_group_port = 80
238+
}
239+
}
240+
}
241+
242+
variable "lb_http_ingress_cidr_blocks" {
243+
description = "List of CIDR blocks to allowed to access the Load Balancer through HTTP"
194244
type = list(string)
245+
default = ["0.0.0.0/0"]
195246
}
196247

197-
variable "lb_https_tgs_ports" {
198-
description = "List of HTTPS LB Target Group Ports"
248+
variable "lb_http_ingress_prefix_list_ids" {
249+
description = "List of prefix list IDs blocks to allowed to access the Load Balancer through HTTP"
199250
type = list(string)
251+
default = []
252+
}
253+
254+
variable "lb_https_ports" {
255+
description = "Map containing objects with two fields, listener_port and the target_group_port to redirect HTTPS requests"
256+
type = map
257+
default = {
258+
default_http = {
259+
listener_port = 443
260+
target_group_port = 443
261+
}
262+
}
200263
}
201264

202-
variable "lb_http_listeners_arns" {
203-
description = "List of HTTP LB Listeners ARNs"
265+
variable "lb_https_ingress_cidr_blocks" {
266+
description = "List of CIDR blocks to allowed to access the Load Balancer through HTTPS"
204267
type = list(string)
268+
default = ["0.0.0.0/0"]
205269
}
206270

207-
variable "lb_https_listeners_arns" {
208-
description = "List of HTTPS LB Listeners ARNs"
271+
variable "lb_https_ingress_prefix_list_ids" {
272+
description = "List of prefix list IDs blocks to allowed to access the Load Balancer through HTTPS"
209273
type = list(string)
274+
default = []
275+
}
276+
277+
#------------------------------------------------------------------------------
278+
# AWS LOAD BALANCER - Target Groups
279+
#------------------------------------------------------------------------------
280+
variable "lb_deregistration_delay" {
281+
description = "(Optional) The amount time for Elastic Load Balancing to wait before changing the state of a deregistering target from draining to unused. The range is 0-3600 seconds. The default value is 300 seconds."
282+
type = number
283+
default = 300
284+
}
285+
286+
variable "lb_slow_start" {
287+
description = "(Optional) The amount time for targets to warm up before the load balancer sends them a full share of requests. The range is 30-900 seconds or 0 to disable. The default value is 0 seconds."
288+
type = number
289+
default = 0
290+
}
291+
292+
variable "lb_load_balancing_algorithm_type" {
293+
description = "(Optional) Determines how the load balancer selects targets when routing requests. The value is round_robin or least_outstanding_requests. The default is round_robin."
294+
type = string
295+
default = "round_robin"
296+
}
297+
298+
variable "lb_stickiness" {
299+
description = "(Optional) A Stickiness block. Provide three fields. type, the type of sticky sessions. The only current possible value is lb_cookie. cookie_duration, the time period, in seconds, during which requests from a client should be routed to the same target. After this time period expires, the load balancer-generated cookie is considered stale. The range is 1 second to 1 week (604800 seconds). The default value is 1 day (86400 seconds). enabled, boolean to enable / disable stickiness. Default is true."
300+
type = object({
301+
type = string
302+
cookie_duration = string
303+
enabled = bool
304+
})
305+
default = {
306+
type = "lb_cookie"
307+
cookie_duration = 86400
308+
enabled = true
309+
}
310+
}
311+
312+
variable "lb_target_group_health_check_enabled" {
313+
description = "(Optional) Indicates whether health checks are enabled. Defaults to true."
314+
type = bool
315+
default = true
316+
}
317+
318+
variable "lb_target_group_health_check_interval" {
319+
description = "(Optional) The approximate amount of time, in seconds, between health checks of an individual target. Minimum value 5 seconds, Maximum value 300 seconds. Default 30 seconds."
320+
type = number
321+
default = 30
322+
}
323+
324+
variable "lb_target_group_health_check_path" {
325+
description = "The destination for the health check request."
326+
type = string
327+
default = "/"
328+
}
329+
330+
variable "lb_target_group_health_check_timeout" {
331+
description = "(Optional) The amount of time, in seconds, during which no response means a failed health check. The range is 2 to 120 seconds, and the default is 5 seconds."
332+
type = number
333+
default = 5
334+
}
335+
336+
variable "lb_target_group_health_check_healthy_threshold" {
337+
description = "(Optional) The number of consecutive health checks successes required before considering an unhealthy target healthy. Defaults to 3."
338+
type = number
339+
default = 3
340+
}
341+
342+
variable "lb_target_group_health_check_unhealthy_threshold" {
343+
description = "(Optional) The number of consecutive health check failures required before considering the target unhealthy. Defaults to 3."
344+
type = number
345+
default = 3
210346
}
211347

212-
variable "load_balancer_sg_id" {
213-
description = "The ID of the security group of the Load Balancer. This is to allow traffic only from Load Balancer"
348+
variable "lb_target_group_health_check_matcher" {
349+
description = "The HTTP codes to use when checking for a successful response from a target. You can specify multiple values (for example, \"200,202\") or a range of values (for example, \"200-299\"). Default is 200."
214350
type = string
351+
default = "200"
215352
}

0 commit comments

Comments
 (0)