From 0055a76487e60cc690ff6896836cdc7a65db0e43 Mon Sep 17 00:00:00 2001 From: Jan Sebastian Siwy Date: Mon, 8 Feb 2021 21:43:07 +0100 Subject: [PATCH 1/5] Initial version --- .github/workflows/validate.yml | 17 ++++++++ .gitignore | 2 + CHANGELOG.md | 5 +++ LICENSE | 7 ++++ README.md | 30 +++++++++++++- main.tf | 72 ++++++++++++++++++++++++++++++++++ outputs.tf | 4 ++ variables.tf | 54 +++++++++++++++++++++++++ 8 files changed, 189 insertions(+), 2 deletions(-) create mode 100644 .github/workflows/validate.yml create mode 100644 .gitignore create mode 100644 CHANGELOG.md create mode 100644 LICENSE create mode 100644 main.tf create mode 100644 outputs.tf create mode 100644 variables.tf diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml new file mode 100644 index 0000000..9404461 --- /dev/null +++ b/.github/workflows/validate.yml @@ -0,0 +1,17 @@ +name: Validate + +on: push + +env: + AWS_REGION: local + +jobs: + validate: + runs-on: ubuntu-20.04 + steps: + - uses: actions/checkout@v2.3.1 + - uses: hashicorp/setup-terraform@v1.3.2 + with: + terraform_version: 0.14.5 + - run: terraform init + - run: terraform validate diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..05a74e5 --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +/.terraform +/.terraform.lock.hcl diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..af52a4f --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,5 @@ +# Changelog + +## v1.0.0 + +- [Initial version](https://github.com/babbel/terraform-aws-alb-for-vpc-internal-requests/pull/1) diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..1fd65ae --- /dev/null +++ b/LICENSE @@ -0,0 +1,7 @@ +Copyright 2021 Lesson Nine GmbH + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/README.md b/README.md index fc33067..8eea502 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,28 @@ -# terraform-aws-alb-for-vpc-internal-requests -Terraform module creating a private ALB for VPC-internal requests +# Application Load Balancer (ALB) for VPC-Internal Requests + +This module creates a private ALB, a default ALB listener (with HTTP protocol), and a security group for service-2-service requests within a VPC. + +## Example Usage + +```tf +module "alb" { + source = "babbel/alb-for-vpc-internal-requests/aws" + version = "~> 1.0" + + name = "example" + + vpc = aws_vpc.this + subnets = [aws_subnet.private_a, aws_subnet.private_b] + + ingress_security_groups = { + some-service = aws_security_group.some_service + } + + target_group = aws_lb_target_group.example + + tags = { + app = "example" + env = "production" + } +} +``` diff --git a/main.tf b/main.tf new file mode 100644 index 0000000..5110a1a --- /dev/null +++ b/main.tf @@ -0,0 +1,72 @@ +# Security Group + +resource "aws_security_group" "this" { + vpc_id = var.vpc.id + + name = "lb-${var.name}" + description = "LB: ${var.name}" + + tags = merge({ + Name = "LB: ${var.name}" + }, local.tags) + + lifecycle { + create_before_destroy = true + } +} + +resource "aws_security_group_rule" "ingress" { + for_each = var.source_security_groups + + security_group_id = aws_security_group.this.id + + type = "ingress" + source_security_group_id = each.value.id + protocol = "tcp" + from_port = var.ingress_port + to_port = var.ingress_port + + lifecycle { + create_before_destroy = true + } +} + +resource "aws_security_group_rule" "egress" { + security_group_id = aws_security_group.this.id + + type = "egress" + cidr_blocks = ["0.0.0.0/0"] + protocol = "-1" + from_port = 0 + to_port = 0 + + lifecycle { + create_before_destroy = true + } +} + +# ALB + +resource "aws_lb" "this" { + name = var.name + + load_balancer_type = "application" + + internal = true + subnets = var.subnets[*].id + security_groups = [aws_security_group.this.id] + + tags = local.tags +} + +resource "aws_lb_listener" "this" { + load_balancer_arn = aws_lb.this.arn + + protocol = "HTTP" + port = var.ingress_port + + default_action { + target_group_arn = var.target_group.arn + type = "forward" + } +} diff --git a/outputs.tf b/outputs.tf new file mode 100644 index 0000000..ad287b8 --- /dev/null +++ b/outputs.tf @@ -0,0 +1,4 @@ +output "this" { + description = "ALB" + value = aws_lb.this +} diff --git a/variables.tf b/variables.tf new file mode 100644 index 0000000..428f480 --- /dev/null +++ b/variables.tf @@ -0,0 +1,54 @@ +variable "ingress_port" { + description = "The port the ALB will listen to" + + type = number + default = 80 +} + +variable "ingress_security_groups" { + description = "Map of security groups the ALB will receive requests from" + + type = map( + object({ + id = string + }) + ) +} + +variable "name" { + description = "Name of the ALB" + + type = string +} + +variable "subnets" { + description = "List of subnets the ALB will be created in" + + type = list( + object({ + id = string + }) + ) +} + +variable "tags" { + description = "Map of tags to assign to all resources supporting tags (in addition to the `Name` tag)" + + type = map(string) +} + +variable "target_group" { + description = "Target group all requests to the ALB will be forwarded to" + + type = object({ + arn = string + }) +} + +variable "vpc" { + description = "VPC the ALB and the security group will be created in" + + type = object({ + id = string + }) +} From 99218a76e546eb9594ea67827c54f80adde03928 Mon Sep 17 00:00:00 2001 From: Jan Sebastian Siwy Date: Mon, 8 Feb 2021 21:46:00 +0100 Subject: [PATCH 2/5] fix tags reference it's a variable, not a local --- main.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/main.tf b/main.tf index 5110a1a..283be3b 100644 --- a/main.tf +++ b/main.tf @@ -8,7 +8,7 @@ resource "aws_security_group" "this" { tags = merge({ Name = "LB: ${var.name}" - }, local.tags) + }, var.tags) lifecycle { create_before_destroy = true @@ -56,7 +56,7 @@ resource "aws_lb" "this" { subnets = var.subnets[*].id security_groups = [aws_security_group.this.id] - tags = local.tags + tags = var.tags } resource "aws_lb_listener" "this" { From 110d213921df66543116cd029998f6dd8bd176ae Mon Sep 17 00:00:00 2001 From: Jan Sebastian Siwy Date: Mon, 8 Feb 2021 21:48:13 +0100 Subject: [PATCH 3/5] rename source_security_groups to ingress_security_groups --- main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/main.tf b/main.tf index 283be3b..1b2d020 100644 --- a/main.tf +++ b/main.tf @@ -16,7 +16,7 @@ resource "aws_security_group" "this" { } resource "aws_security_group_rule" "ingress" { - for_each = var.source_security_groups + for_each = var.ingress_security_groups security_group_id = aws_security_group.this.id From 2f49acb3e4f90c71c0b311b6c6b9964a47e97406 Mon Sep 17 00:00:00 2001 From: Fionn Masuhr Date: Thu, 11 Feb 2021 12:44:13 +0100 Subject: [PATCH 4/5] Add security group output --- outputs.tf | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/outputs.tf b/outputs.tf index ad287b8..01482bf 100644 --- a/outputs.tf +++ b/outputs.tf @@ -1,3 +1,8 @@ +output "aws_security_group" { + description = "The Security Group used by the ALB" + value = aws_security_group.this +} + output "this" { description = "ALB" value = aws_lb.this From 690fe984590c7d22d54ca7c7c2576e16fba7ed0a Mon Sep 17 00:00:00 2001 From: Fionn Masuhr Date: Thu, 11 Feb 2021 14:49:35 +0100 Subject: [PATCH 5/5] Apply suggestions from code review Co-authored-by: Jan Sebastian Siwy --- outputs.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/outputs.tf b/outputs.tf index 01482bf..40d2c84 100644 --- a/outputs.tf +++ b/outputs.tf @@ -1,5 +1,5 @@ -output "aws_security_group" { - description = "The Security Group used by the ALB" +output "security_group" { + description = "Security group used by the ALB" value = aws_security_group.this }