Skip to content

Commit 109ea41

Browse files
brandonjbjellandbrandonjbjelland
authored
disabled logging now possible (#69)
* refactor to support no_logs scenario
1 parent 669f188 commit 109ea41

File tree

12 files changed

+413
-182
lines changed

12 files changed

+413
-182
lines changed

‎.pre-commit-config.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,14 @@
22
# See http://pre-commit.com/hooks.html for more hooks
33
repos:
44
- repo: git://github.com/antonbabenko/pre-commit-terraform
5-
rev: v1.7.0
5+
rev: v1.7.1
6+
sha: 091f8b15d7b458e5a0aca642483deb2205e7db02
67
hooks:
78
- id: terraform_fmt
8-
- id: terraform_docs
9+
# - id: terraform_docs
910
- repo: git://github.com/pre-commit/pre-commit-hooks
1011
rev: v1.2.3
12+
sha: 92e1570c282e3c69a1f8b5b8dd8d286fe27cfaa7
1113
hooks:
1214
- id: check-merge-conflict
1315
- id: trailing-whitespace

‎CHANGELOG.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,15 @@ All notable changes to this project will be documented in this file.
55
The format is based on [Keep a Changelog](http://keepachangelog.com/) and this
66
project adheres to [Semantic Versioning](http://semver.org/).
77

8+
## [[v3.4.0](https://github.com/terraform-aws-modules/terraform-aws-alb/compare/v3.3.1...v3.4.0)] - 2018-05-17]
9+
10+
### Changed
11+
12+
* resources supporting the not logging scenario added. Outputs now accommodate.
13+
* reorganized the resource explosion to separate files.
14+
* tests reorganized to confine cruft.
15+
* `terraform-docs` now supported and generating documentation. (Kiitos, @antonbabenko 🍒)
16+
817
## [[v3.3.1](https://github.com/terraform-aws-modules/terraform-aws-alb/compare/v3.3.0...v3.3.1)] - 2018-05-06]
918

1019
### Changed

‎README.md‎

Lines changed: 53 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# terraform-aws-alb
22

33
A Terraform module containing common configurations for an AWS Application Load
4-
Balancer (ALB) running over HTTP/HTTPS. Available through the [terraform registry](https://registry.terraform.io/modules/terraform-aws-modules/alb/aws).
4+
Balancer (ALB) running over HTTP/HTTPS. Available through the [Terraform registry](https://registry.terraform.io/modules/terraform-aws-modules/alb/aws).
55

66
| Branch | Build status |
77
| ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -31,11 +31,11 @@ to the ASG immediately or will result in failure. The value of `target_group[n][
3131

3232
## Why ALB instead of ELB
3333

34-
The use-case presented here appears almost identical to how one would use an ELB
35-
but we inherit a few bonuses by moving to ALB like the ability to leverage WAF.
34+
ALB has the ability to replace what several ELBs can do by routing based on URI matchers.
35+
Additionally, operating at layer 7 opens the ability to shape traffic using WAF.
3636
[AWS's documentation](https://aws.amazon.com/elasticloadbalancing/applicationloadbalancer/) has a more
3737
exhaustive set of reasons. Alternatively, if using ALB with ECS look no further than
38-
the [Hashicorp example](https://github.com/terraform-providers/terraform-provider-aws/blob/master/examples/ecs-alb).
38+
the [HashiCorp example](https://github.com/terraform-providers/terraform-provider-aws/blob/master/examples/ecs-alb).
3939

4040
## Usage example
4141

@@ -60,7 +60,52 @@ module "alb" {
6060
}
6161
```
6262

63-
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
63+
## Testing
64+
65+
This module has been packaged with [awspec](https://github.com/k1LoW/awspec) tests through [kitchen](https://kitchen.ci/) and [kitchen-terraform](https://newcontext-oss.github.io/kitchen-terraform/). To run them:
66+
67+
1. Install [rvm](https://rvm.io/rvm/install) and the ruby version specified in the [Gemfile](https://github.com/terraform-aws-modules/terraform-aws-alb/tree/master/Gemfile).
68+
2. Install bundler and the gems from our Gemfile:
69+
70+
```bash
71+
gem install bundler && bundle install
72+
```
73+
74+
3. Ensure your AWS environment is configured (i.e. credentials and region) for test and set TF_VAR_region to a valid AWS region (e.g. `export TF_VAR_region=${AWS_REGION}`).
75+
4. Test using `bundle exec kitchen test` from the root of the repo.
76+
77+
## Doc generation
78+
79+
Documentation should be modified within `main.tf` and generated using [terraform-docs](https://github.com/segmentio/terraform-docs).
80+
Generate them like so:
81+
82+
```bash
83+
terraform-docs md ./ | cat -s | ghead -n -1 > README.md
84+
```
85+
86+
## Contributing
87+
88+
Report issues/questions/feature requests on in the [issues](https://github.com/terraform-aws-modules/terraform-aws-alb/issues/new) section.
89+
90+
Full contributing [guidelines are covered here](https://github.com/terraform-aws-modules/terraform-aws-alb/blob/master/CONTRIBUTING.md).
91+
92+
## IAM Permissions
93+
94+
Testing and using this repo requires a minimum set of IAM permissions. Test permissions
95+
are listed in the [alb_test_fixture README](https://github.com/terraform-aws-modules/terraform-aws-alb/tree/master/examples/alb_test_fixture/README.md).
96+
97+
## Change log
98+
99+
The [changelog](https://github.com/terraform-aws-modules/terraform-aws-alb/tree/master/CHANGELOG.md) captures all important release notes.
100+
101+
## Authors
102+
103+
Created and maintained by [Brandon O'Connor](https://github.com/brandoconnor) - [email protected].
104+
Many thanks to [the contributors listed here](https://github.com/terraform-aws-modules/terraform-aws-alb/graphs/contributors)!
105+
106+
## License
107+
108+
MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-aws-alb/tree/master/LICENSE) for full details.
64109
65110
## Inputs
66111
@@ -76,14 +121,15 @@ module "alb" {
76121
| https_listeners_count | A manually provided count/length of the https_listeners list of maps since the list cannot be computed. | string | `0` | no |
77122
| idle_timeout | The time in seconds that the connection is allowed to be idle. | string | `60` | no |
78123
| ip_address_type | The type of IP addresses used by the subnets for your load balancer. The possible values are ipv4 and dualstack. | string | `ipv4` | no |
79-
| listener_ssl_policy_default | The security policy if using HTTPS externally on the load balancer. See: https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-security-policy-table.html | string | `ELBSecurityPolicy-2016-08` | no |
124+
| listener_ssl_policy_default | The security policy if using HTTPS externally on the load balancer. [See](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-security-policy-table.html). | string | `ELBSecurityPolicy-2016-08` | no |
80125
| load_balancer_create_timeout | Timeout value when creating the ALB. | string | `10m` | no |
81126
| load_balancer_delete_timeout | Timeout value when deleting the ALB. | string | `10m` | no |
82127
| load_balancer_is_internal | Boolean determining if the load balancer is internal or externally facing. | string | `false` | no |
83128
| load_balancer_name | The resource name and Name tag of the load balancer. | string | - | yes |
84129
| load_balancer_update_timeout | Timeout value when updating the ALB. | string | `10m` | no |
85-
| log_bucket_name | S3 bucket (externally created) for storing load balancer access logs. | string | - | yes |
130+
| log_bucket_name | S3 bucket (externally created) for storing load balancer access logs. Required if logging_enabled is true. | string | `` | no |
86131
| log_location_prefix | S3 prefix within the log_bucket_name under which logs are stored. | string | `` | no |
132+
| logging_enabled | Controls if the ALB will log requests to S3. | string | `true` | no |
87133
| security_groups | The security groups to attach to the load balancer. e.g. ["sg-edcd9784","sg-edcd9785"] | list | - | yes |
88134
| subnets | A list of subnets to associate with the load balancer. e.g. ['subnet-1a2b3c4d','subnet-1a2b3c4e','subnet-1a2b3c4f'] | list | - | yes |
89135
| tags | A map of tags to add to all resources | string | `<map>` | no |
@@ -107,43 +153,3 @@ module "alb" {
107153
| target_group_arn_suffixes | ARN suffixes of our target groups - can be used with CloudWatch. |
108154
| target_group_arns | ARNs of the target groups. Useful for passing to your Auto Scaling group. |
109155
| target_group_names | Name of the target group. Useful for passing to your CodeDeploy Deployment Group. |
110-
111-
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
112-
113-
## Testing
114-
115-
This module has been packaged with [awspec](https://github.com/k1LoW/awspec) tests through [kitchen](https://kitchen.ci/) and [kitchen-terraform](https://newcontext-oss.github.io/kitchen-terraform/). To run them:
116-
117-
1. Install [rvm](https://rvm.io/rvm/install) and the ruby version specified in the [Gemfile](https://github.com/terraform-aws-modules/terraform-aws-alb/tree/master/Gemfile).
118-
2. Install bundler and the gems from our Gemfile:
119-
120-
```bash
121-
gem install bundler && bundle install
122-
```
123-
124-
3. Ensure your AWS environment is configured (i.e. credentials and region) for test and set TF_VAR_region to a valid AWS region (e.g. `export TF_VAR_region=${AWS_REGION}`).
125-
4. Test using `bundle exec kitchen test` from the root of the repo.
126-
127-
## Contributing
128-
129-
Report issues/questions/feature requests on in the [issues](https://github.com/terraform-aws-modules/terraform-aws-alb/issues/new) section.
130-
131-
Full contributing [guidelines are covered here](https://github.com/terraform-aws-modules/terraform-aws-alb/blob/master/CONTRIBUTING.md).
132-
133-
## IAM Permissions
134-
135-
Testing and using this repo requires a minimum set of IAM permissions. Test permissions
136-
are listed in the [alb_test_fixture README](https://github.com/terraform-aws-modules/terraform-aws-alb/tree/master/examples/alb_test_fixture/README.md).
137-
138-
## Change log
139-
140-
The [changelog](https://github.com/terraform-aws-modules/terraform-aws-alb/tree/master/CHANGELOG.md) captures all important release notes.
141-
142-
## Authors
143-
144-
Created and maintained by [Brandon O'Connor](https://github.com/brandoconnor) - [email protected].
145-
Many thanks to [the contributors listed here](https://github.com/terraform-aws-modules/terraform-aws-alb/graphs/contributors)!
146-
147-
## License
148-
149-
MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-aws-alb/tree/master/LICENSE) for full details.

‎alb_no_logs.tf‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
resource "aws_lb" "application_no_logs" {
2+
load_balancer_type = "application"
3+
name = "${var.load_balancer_name}"
4+
internal = "${var.load_balancer_is_internal}"
5+
security_groups = ["${var.security_groups}"]
6+
subnets = ["${var.subnets}"]
7+
idle_timeout = "${var.idle_timeout}"
8+
enable_deletion_protection = "${var.enable_deletion_protection}"
9+
enable_http2 = "${var.enable_http2}"
10+
ip_address_type = "${var.ip_address_type}"
11+
tags = "${merge(var.tags, map("Name", var.load_balancer_name))}"
12+
13+
timeouts {
14+
create = "${var.load_balancer_create_timeout}"
15+
delete = "${var.load_balancer_delete_timeout}"
16+
update = "${var.load_balancer_update_timeout}"
17+
}
18+
19+
count = "${var.logging_enabled ? 0 : 1}"
20+
}
21+
22+
resource "aws_lb_target_group" "main_no_logs" {
23+
name = "${lookup(var.target_groups[count.index], "name")}"
24+
vpc_id = "${var.vpc_id}"
25+
port = "${lookup(var.target_groups[count.index], "backend_port")}"
26+
protocol = "${upper(lookup(var.target_groups[count.index], "backend_protocol"))}"
27+
deregistration_delay = "${lookup(var.target_groups[count.index], "deregistration_delay", lookup(var.target_groups_defaults, "deregistration_delay"))}"
28+
target_type = "${lookup(var.target_groups[count.index], "target_type", lookup(var.target_groups_defaults, "target_type"))}"
29+
30+
health_check {
31+
interval = "${lookup(var.target_groups[count.index], "health_check_interval", lookup(var.target_groups_defaults, "health_check_interval"))}"
32+
path = "${lookup(var.target_groups[count.index], "health_check_path", lookup(var.target_groups_defaults, "health_check_path"))}"
33+
port = "${lookup(var.target_groups[count.index], "health_check_port", lookup(var.target_groups_defaults, "health_check_port"))}"
34+
healthy_threshold = "${lookup(var.target_groups[count.index], "health_check_healthy_threshold", lookup(var.target_groups_defaults, "health_check_healthy_threshold"))}"
35+
unhealthy_threshold = "${lookup(var.target_groups[count.index], "health_check_unhealthy_threshold", lookup(var.target_groups_defaults, "health_check_unhealthy_threshold"))}"
36+
timeout = "${lookup(var.target_groups[count.index], "health_check_timeout", lookup(var.target_groups_defaults, "health_check_timeout"))}"
37+
protocol = "${upper(lookup(var.target_groups[count.index], "healthcheck_protocol", lookup(var.target_groups[count.index], "backend_protocol")))}"
38+
matcher = "${lookup(var.target_groups[count.index], "health_check_matcher", lookup(var.target_groups_defaults, "health_check_matcher"))}"
39+
}
40+
41+
stickiness {
42+
type = "lb_cookie"
43+
cookie_duration = "${lookup(var.target_groups[count.index], "cookie_duration", lookup(var.target_groups_defaults, "cookie_duration"))}"
44+
enabled = "${lookup(var.target_groups[count.index], "stickiness_enabled", lookup(var.target_groups_defaults, "stickiness_enabled"))}"
45+
}
46+
47+
tags = "${merge(var.tags, map("Name", lookup(var.target_groups[count.index], "name")))}"
48+
count = "${var.logging_enabled ? 0 : var.target_groups_count}"
49+
depends_on = ["aws_lb.application_no_logs"]
50+
51+
lifecycle {
52+
create_before_destroy = true
53+
}
54+
}
55+
56+
resource "aws_lb_listener" "frontend_http_tcp_no_logs" {
57+
load_balancer_arn = "${element(concat(aws_lb.application_no_logs.*.arn, list("")), 0)}"
58+
port = "${lookup(var.http_tcp_listeners[count.index], "port")}"
59+
protocol = "${lookup(var.http_tcp_listeners[count.index], "protocol")}"
60+
count = "${var.logging_enabled ? 0 : var.http_tcp_listeners_count}"
61+
62+
default_action {
63+
target_group_arn = "${aws_lb_target_group.main_no_logs.*.id[lookup(var.http_tcp_listeners[count.index], "target_group_index", 0)]}"
64+
type = "forward"
65+
}
66+
}
67+
68+
resource "aws_lb_listener" "frontend_https_no_logs" {
69+
load_balancer_arn = "${element(concat(aws_lb.application_no_logs.*.arn, list("")), 0)}"
70+
port = "${lookup(var.https_listeners[count.index], "port")}"
71+
protocol = "HTTPS"
72+
certificate_arn = "${lookup(var.https_listeners[count.index], "certificate_arn")}"
73+
ssl_policy = "${lookup(var.https_listeners[count.index], "ssl_policy", var.listener_ssl_policy_default)}"
74+
count = "${var.logging_enabled ? 0 : var.https_listeners_count}"
75+
76+
default_action {
77+
target_group_arn = "${aws_lb_target_group.main_no_logs.*.id[lookup(var.https_listeners[count.index], "target_group_index", 0)]}"
78+
type = "forward"
79+
}
80+
}
81+
82+
resource "aws_lb_listener_certificate" "https_listener_no_logs" {
83+
listener_arn = "${aws_lb_listener.frontend_https_no_logs.*.arn[lookup(var.extra_ssl_certs[count.index], "https_listener_index")]}"
84+
certificate_arn = "${lookup(var.extra_ssl_certs[count.index], "certificate_arn")}"
85+
count = "${var.logging_enabled ? 0 : var.extra_ssl_certs_count}"
86+
}

‎alb_w_logs.tf‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
resource "aws_lb" "application" {
2+
load_balancer_type = "application"
3+
name = "${var.load_balancer_name}"
4+
internal = "${var.load_balancer_is_internal}"
5+
security_groups = ["${var.security_groups}"]
6+
subnets = ["${var.subnets}"]
7+
idle_timeout = "${var.idle_timeout}"
8+
enable_deletion_protection = "${var.enable_deletion_protection}"
9+
enable_http2 = "${var.enable_http2}"
10+
ip_address_type = "${var.ip_address_type}"
11+
tags = "${merge(var.tags, map("Name", var.load_balancer_name))}"
12+
13+
access_logs {
14+
enabled = true
15+
bucket = "${var.log_bucket_name}"
16+
prefix = "${var.log_location_prefix}"
17+
}
18+
19+
timeouts {
20+
create = "${var.load_balancer_create_timeout}"
21+
delete = "${var.load_balancer_delete_timeout}"
22+
update = "${var.load_balancer_update_timeout}"
23+
}
24+
25+
count = "${var.logging_enabled ? 1 : 0}"
26+
}
27+
28+
resource "aws_lb_target_group" "main" {
29+
name = "${lookup(var.target_groups[count.index], "name")}"
30+
vpc_id = "${var.vpc_id}"
31+
port = "${lookup(var.target_groups[count.index], "backend_port")}"
32+
protocol = "${upper(lookup(var.target_groups[count.index], "backend_protocol"))}"
33+
deregistration_delay = "${lookup(var.target_groups[count.index], "deregistration_delay", lookup(var.target_groups_defaults, "deregistration_delay"))}"
34+
target_type = "${lookup(var.target_groups[count.index], "target_type", lookup(var.target_groups_defaults, "target_type"))}"
35+
36+
health_check {
37+
interval = "${lookup(var.target_groups[count.index], "health_check_interval", lookup(var.target_groups_defaults, "health_check_interval"))}"
38+
path = "${lookup(var.target_groups[count.index], "health_check_path", lookup(var.target_groups_defaults, "health_check_path"))}"
39+
port = "${lookup(var.target_groups[count.index], "health_check_port", lookup(var.target_groups_defaults, "health_check_port"))}"
40+
healthy_threshold = "${lookup(var.target_groups[count.index], "health_check_healthy_threshold", lookup(var.target_groups_defaults, "health_check_healthy_threshold"))}"
41+
unhealthy_threshold = "${lookup(var.target_groups[count.index], "health_check_unhealthy_threshold", lookup(var.target_groups_defaults, "health_check_unhealthy_threshold"))}"
42+
timeout = "${lookup(var.target_groups[count.index], "health_check_timeout", lookup(var.target_groups_defaults, "health_check_timeout"))}"
43+
protocol = "${upper(lookup(var.target_groups[count.index], "healthcheck_protocol", lookup(var.target_groups[count.index], "backend_protocol")))}"
44+
matcher = "${lookup(var.target_groups[count.index], "health_check_matcher", lookup(var.target_groups_defaults, "health_check_matcher"))}"
45+
}
46+
47+
stickiness {
48+
type = "lb_cookie"
49+
cookie_duration = "${lookup(var.target_groups[count.index], "cookie_duration", lookup(var.target_groups_defaults, "cookie_duration"))}"
50+
enabled = "${lookup(var.target_groups[count.index], "stickiness_enabled", lookup(var.target_groups_defaults, "stickiness_enabled"))}"
51+
}
52+
53+
tags = "${merge(var.tags, map("Name", lookup(var.target_groups[count.index], "name")))}"
54+
count = "${var.logging_enabled ? var.target_groups_count : 0}"
55+
depends_on = ["aws_lb.application"]
56+
57+
lifecycle {
58+
create_before_destroy = true
59+
}
60+
}
61+
62+
resource "aws_lb_listener" "frontend_http_tcp" {
63+
load_balancer_arn = "${element(concat(aws_lb.application.*.arn, aws_lb.application_no_logs.*.arn), 0)}"
64+
port = "${lookup(var.http_tcp_listeners[count.index], "port")}"
65+
protocol = "${lookup(var.http_tcp_listeners[count.index], "protocol")}"
66+
count = "${var.logging_enabled ? var.http_tcp_listeners_count : 0}"
67+
68+
default_action {
69+
target_group_arn = "${aws_lb_target_group.main.*.id[lookup(var.http_tcp_listeners[count.index], "target_group_index", 0)]}"
70+
type = "forward"
71+
}
72+
}
73+
74+
resource "aws_lb_listener" "frontend_https" {
75+
load_balancer_arn = "${element(concat(aws_lb.application.*.arn, aws_lb.application_no_logs.*.arn), 0)}"
76+
port = "${lookup(var.https_listeners[count.index], "port")}"
77+
protocol = "HTTPS"
78+
certificate_arn = "${lookup(var.https_listeners[count.index], "certificate_arn")}"
79+
ssl_policy = "${lookup(var.https_listeners[count.index], "ssl_policy", var.listener_ssl_policy_default)}"
80+
count = "${var.logging_enabled ? var.https_listeners_count : 0}"
81+
82+
default_action {
83+
target_group_arn = "${aws_lb_target_group.main.*.id[lookup(var.https_listeners[count.index], "target_group_index", 0)]}"
84+
type = "forward"
85+
}
86+
}
87+
88+
resource "aws_lb_listener_certificate" "https_listener" {
89+
listener_arn = "${aws_lb_listener.frontend_https.*.arn[lookup(var.extra_ssl_certs[count.index], "https_listener_index")]}"
90+
certificate_arn = "${lookup(var.extra_ssl_certs[count.index], "certificate_arn")}"
91+
count = "${var.logging_enabled ? var.extra_ssl_certs_count : 0}"
92+
}

0 commit comments

Comments
 (0)