Skip to content

Commit a721e2a

Browse files
saumitra-devsaumitra-dev
committed
feat(modules/alb): listener rule configuration for alb listeners
1 parent b5df255 commit a721e2a

File tree

4 files changed

+131
-1
lines changed

4 files changed

+131
-1
lines changed

‎modules/alb/README.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111

1212
| Name | Version |
1313
|------|---------|
14-
| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
14+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.58.0 |
1515

1616
## Modules
1717

@@ -23,6 +23,7 @@ No modules.
2323
|------|------|
2424
| [aws_lb.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb) | resource |
2525
| [aws_lb_listener.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener) | resource |
26+
| [aws_lb_listener_rule.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener_rule) | resource |
2627
| [aws_lb_target_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_target_group) | resource |
2728

2829
## Inputs
@@ -31,6 +32,7 @@ No modules.
3132
|------|-------------|------|---------|:--------:|
3233
| <a name="input_enable_deletion_protection"></a> [enable\_deletion\_protection](#input\_enable\_deletion\_protection) | (Optional) If true, deletion of the load balancer will be disabled via the AWS API. | `bool` | `false` | no |
3334
| <a name="input_internal"></a> [internal](#input\_internal) | (Optional) If true, the LB will be internal. | `bool` | `false` | no |
35+
| <a name="input_listener_rules"></a> [listener\_rules](#input\_listener\_rules) | Listener rules to associate with the the ALB Listeners. | <pre>map(object({<br> listener = string<br> priority = optional(number)<br> action = list(object({<br> type = string<br> authenticate_oidc = optional(object({<br> authorization_endpoint = string<br> client_id = string<br> client_secret = string<br> issuer = string<br> on_unauthenticated_request = optional(string)<br> scope = optional(string)<br> session_cookie_name = optional(string)<br> token_endpoint = string<br> user_info_endpoint = string<br> }))<br> target_group = optional(string)<br> }))<br> condition = set(object({<br> host_header = optional(object({<br> values = set(string)<br> }))<br> path_pattern = optional(object({<br> values = set(string)<br> }))<br> http_request_method = optional(object({<br> values = set(string)<br> }))<br> }))<br> tags = optional(map(string), {})<br> }))</pre> | `{}` | no |
3436
| <a name="input_listeners"></a> [listeners](#input\_listeners) | Listeners to forward ALB ingress to desired Target Groups. | <pre>map(object({<br> default_action = list(object({<br> type = string<br> target_group = string<br> fixed_response = optional(any, null)<br> forward = optional(any, null)<br> order = optional(number)<br> redirect = optional(any, null)<br> }))<br> certificate_arn = optional(string)<br> port = optional(number)<br> protocol = optional(string)<br> ssl_policy = optional(string)<br> tags = optional(map(string), {})<br> }))</pre> | n/a | yes |
3537
| <a name="input_name"></a> [name](#input\_name) | (Optional) Name of the LB. | `string` | `""` | no |
3638
| <a name="input_preserve_host_header"></a> [preserve\_host\_header](#input\_preserve\_host\_header) | (Optional) Whether the Application Load Balancer should preserve the Host header in the HTTP request and send it to the target without any change. | `bool` | `false` | no |
@@ -45,6 +47,8 @@ No modules.
4547
|------|-------------|
4648
| <a name="output_arn"></a> [arn](#output\_arn) | ARN of the load balancer. |
4749
| <a name="output_dns_name"></a> [dns\_name](#output\_dns\_name) | DNS name of the load balancer. |
50+
| <a name="output_listener_rules_arns"></a> [listener\_rules\_arns](#output\_listener\_rules\_arns) | ARNs of the Listener Rules. |
51+
| <a name="output_listener_rules_ids"></a> [listener\_rules\_ids](#output\_listener\_rules\_ids) | Identifiers of the Listener Rules. |
4852
| <a name="output_listeners_arns"></a> [listeners\_arns](#output\_listeners\_arns) | ARNs of the Listeners. |
4953
| <a name="output_listeners_ids"></a> [listeners\_ids](#output\_listeners\_ids) | Identifiers of the Listeners. |
5054
| <a name="output_target_groups_arns"></a> [target\_groups\_arns](#output\_target\_groups\_arns) | ARNs of the Target Groups. |

‎modules/alb/main.tf‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,3 +128,75 @@ resource "aws_lb_listener" "this" {
128128

129129
tags = each.value.tags
130130
}
131+
132+
################################################################################
133+
# Load Balancer Listener Rule
134+
################################################################################
135+
136+
resource "aws_lb_listener_rule" "this" {
137+
for_each = var.listener_rules
138+
139+
listener_arn = aws_lb_listener.this[each.value.listener].arn
140+
priority = try(each.value.priority, null)
141+
142+
dynamic "action" {
143+
for_each = each.value.action
144+
145+
content {
146+
type = action.value.type
147+
target_group_arn = lookup(
148+
aws_lb_target_group.this,
149+
try(action.value.target_group, ""),
150+
null
151+
) != null ? aws_lb_target_group.this[try(action.value.target_group, null)].arn : null
152+
153+
dynamic "authenticate_oidc" {
154+
for_each = try(action.value.authenticate_oidc, null) != null ? [1] : []
155+
156+
content {
157+
authorization_endpoint = action.value.authenticate_oidc.authorization_endpoint
158+
client_id = action.value.authenticate_oidc.client_id
159+
client_secret = action.value.authenticate_oidc.client_secret
160+
issuer = action.value.authenticate_oidc.issuer
161+
on_unauthenticated_request = try(action.value.authenticate_oidc.on_unauthenticated_request, null)
162+
scope = try(action.value.authenticate_oidc.scope, null)
163+
session_cookie_name = try(action.value.authenticate_oidc.session_cookie_name, null)
164+
token_endpoint = action.value.authenticate_oidc.token_endpoint
165+
user_info_endpoint = action.value.authenticate_oidc.user_info_endpoint
166+
}
167+
}
168+
}
169+
}
170+
171+
dynamic "condition" {
172+
for_each = each.value.condition
173+
174+
content {
175+
dynamic "host_header" {
176+
for_each = try(condition.value.host_header, null) != null ? [1] : []
177+
178+
content {
179+
values = condition.value.host_header.values
180+
}
181+
}
182+
183+
dynamic "path_pattern" {
184+
for_each = try(condition.value.path_pattern, null) != null ? [1] : []
185+
186+
content {
187+
values = condition.value.path_pattern.values
188+
}
189+
}
190+
191+
dynamic "http_request_method" {
192+
for_each = try(condition.value.http_request_method, null) != null ? [1] : []
193+
194+
content {
195+
values = condition.value.http_request_method.values
196+
}
197+
}
198+
}
199+
}
200+
201+
tags = each.value.tags
202+
}

‎modules/alb/outputs.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,3 +44,17 @@ output "listeners_arns" {
4444
description = "ARNs of the Listeners."
4545
value = { for k, v in aws_lb_listener.this : k => v.arn }
4646
}
47+
48+
################################################################################
49+
# Load Balancer Listener Rules
50+
################################################################################
51+
52+
output "listener_rules_ids" {
53+
description = "Identifiers of the Listener Rules."
54+
value = { for k, v in aws_lb_listener_rule.this : k => v.id }
55+
}
56+
57+
output "listener_rules_arns" {
58+
description = "ARNs of the Listener Rules."
59+
value = { for k, v in aws_lb_listener_rule.this : k => v.arn }
60+
}

‎modules/alb/variables.tf‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,3 +83,43 @@ variable "listeners" {
8383
tags = optional(map(string), {})
8484
}))
8585
}
86+
87+
################################################################################
88+
# Load Balancer Listener Rule
89+
################################################################################
90+
91+
variable "listener_rules" {
92+
description = "Listener rules to associate with the the ALB Listeners."
93+
type = map(object({
94+
listener = string
95+
priority = optional(number)
96+
action = list(object({
97+
type = string
98+
authenticate_oidc = optional(object({
99+
authorization_endpoint = string
100+
client_id = string
101+
client_secret = string
102+
issuer = string
103+
on_unauthenticated_request = optional(string)
104+
scope = optional(string)
105+
session_cookie_name = optional(string)
106+
token_endpoint = string
107+
user_info_endpoint = string
108+
}))
109+
target_group = optional(string)
110+
}))
111+
condition = set(object({
112+
host_header = optional(object({
113+
values = set(string)
114+
}))
115+
path_pattern = optional(object({
116+
values = set(string)
117+
}))
118+
http_request_method = optional(object({
119+
values = set(string)
120+
}))
121+
}))
122+
tags = optional(map(string), {})
123+
}))
124+
default = {}
125+
}

0 commit comments

Comments
 (0)