Support http respond headers for ALB listeners

Author: ekirmayer

README.md

@@ -352,13 +352,14 @@ See [patterns.md](https://github.com/terraform-aws-modules/terraform-aws-alb/blo
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
-| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.82 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.84 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.82 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.84 |
+| <a name="provider_terraform"></a> [terraform](#provider\_terraform) | n/a |
 
 ## Modules
 
@@ -381,6 +382,7 @@ No modules.
 | [aws_vpc_security_group_egress_rule.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_egress_rule) | resource |
 | [aws_vpc_security_group_ingress_rule.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_ingress_rule) | resource |
 | [aws_wafv2_web_acl_association.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl_association) | resource |
+| [terraform_data.listeaner_replacement_trigger](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
 | [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 
 ## Inputs

examples/complete-alb/main.tf

@@ -359,6 +359,31 @@ module "alb" {
         target_group_key = "ex-instance"
       }
     }
+
+    ex-response-headers = {
+      port            = "443"
+      protocol        = "HTTPS"
+      ssl_policy      = "ELBSecurityPolicy-TLS13-1-2-Res-2021-06"
+      certificate_arn = module.acm.acm_certificate_arn
+
+      fixed_response = {
+        content_type = "text/plain"
+        message_body = "Fixed message"
+        status_code  = "200"
+      }
+
+      routing_http_response_server_enabled                                = false
+      routing_http_response_strict_transport_security_header_value        = "max-age=31536000; includeSubDomains; preload"
+      routing_http_response_access_control_allow_origin_header_value      = "https://example.com"
+      routing_http_response_access_control_allow_methods_header_value     = "TRACE,GET"
+      routing_http_response_access_control_allow_headers_header_value     = "Accept-Language,Content-Language"
+      routing_http_response_access_control_allow_credentials_header_value = "true"
+      routing_http_response_access_control_expose_headers_header_value    = "Cache-Control"
+      routing_http_response_access_control_max_age_header_value           = 86400
+      routing_http_response_content_security_policy_header_value          = "*"
+      routing_http_response_x_content_type_options_header_value           = "nosniff"
+      routing_http_response_x_frame_options_header_value                  = "SAMEORIGIN"
+    }
   }
 
   target_groups = {

main.tf

@@ -217,14 +217,46 @@ resource "aws_lb_listener" "this" {
     }
   }
 
+  routing_http_response_server_enabled                                = try(each.value.routing_http_response_server_enabled, false)
+  routing_http_response_strict_transport_security_header_value        = try(each.value.routing_http_response_strict_transport_security_header_value, null)
+  routing_http_response_access_control_allow_origin_header_value      = try(each.value.routing_http_response_access_control_allow_origin_header_value, null)
+  routing_http_response_access_control_allow_methods_header_value     = try(each.value.routing_http_response_access_control_allow_methods_header_value, null)
+  routing_http_response_access_control_allow_headers_header_value     = try(each.value.routing_http_response_access_control_allow_headers_header_value, null)
+  routing_http_response_access_control_allow_credentials_header_value = try(each.value.routing_http_response_access_control_allow_credentials_header_value, null)
+  routing_http_response_access_control_expose_headers_header_value    = try(each.value.routing_http_response_access_control_expose_headers_header_value, null)
+  routing_http_response_access_control_max_age_header_value           = try(each.value.routing_http_response_access_control_max_age_header_value, null)
+  routing_http_response_content_security_policy_header_value          = try(each.value.routing_http_response_content_security_policy_header_value, null)
+  routing_http_response_x_content_type_options_header_value           = try(each.value.routing_http_response_x_content_type_options_header_value, null)
+  routing_http_response_x_frame_options_header_value                  = try(each.value.routing_http_response_x_frame_options_header_value, null)
+
   load_balancer_arn        = aws_lb.this[0].arn
   port                     = try(each.value.port, var.default_port)
   protocol                 = try(each.value.protocol, var.default_protocol)
   ssl_policy               = contains(["HTTPS", "TLS"], try(each.value.protocol, var.default_protocol)) ? try(each.value.ssl_policy, "ELBSecurityPolicy-TLS13-1-2-Res-2021-06") : try(each.value.ssl_policy, null)
   tcp_idle_timeout_seconds = try(each.value.tcp_idle_timeout_seconds, null)
   tags                     = merge(local.tags, try(each.value.tags, {}))
+
+  lifecycle {
+    replace_triggered_by = [terraform_data.listeaner_replacement_trigger[each.key]]
+  }
 }
 
+resource "terraform_data" "listeaner_replacement_trigger" {
+  for_each = { for k, v in var.listeners : k => v if local.create }
+  input = [
+    try(each.value.routing_http_response_server_enabled, true),
+    try(each.value.routing_http_response_strict_transport_security_header_value, null),
+    try(each.value.routing_http_response_access_control_allow_origin_header_value, null),
+    try(each.value.routing_http_response_access_control_allow_methods_header_value, null),
+    try(each.value.routing_http_response_access_control_allow_headers_header_value, null),
+    try(each.value.routing_http_response_access_control_allow_credentials_header_value, null),
+    try(each.value.routing_http_response_access_control_expose_headers_header_value, null),
+    try(each.value.routing_http_response_access_control_max_age_header_value, null),
+    try(each.value.routing_http_response_content_security_policy_header_value, null),
+    try(each.value.routing_http_response_x_content_type_options_header_value, null),
+    try(each.value.routing_http_response_x_frame_options_header_value, null)
+  ]
+}
 ################################################################################
 # Listener Rule(s)
 ################################################################################

versions.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.82"
+      version = ">= 5.84"
     }
   }
 }

wrappers/versions.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 5.82"
+      version = ">= 5.84"
     }
   }
 }