Module library

Application Load Balancer

Terraform module to create AWS Application/Network Load Balancer (ALB/NLB) resources

Version
Submodules
lb_trust_store

Inputs

40 / 50
access_logsoptionalobject({ bucket = string enabled = optional(bool, true) prefix = optional(string…

Map containing access logging configuration for load balancer

Defaultnull
additional_target_group_attachmentsoptionalmap(object({ target_group_key = string target_id = string target_type = optional…

Map of additional target group attachments to create. Use `target_group_key` to attach to the target group created in `target_groups`

Defaultnull
associate_web_acloptionalbool

Indicates whether a Web Application Firewall (WAF) ACL should be associated with the load balancer

Defaultfalse
client_keep_aliveoptionalnumber

Client keep alive value in seconds. The valid range is 60-604800 seconds. The default is 3600 seconds

Defaultnull
connection_logsoptionalobject({ bucket = string enabled = optional(bool, true) prefix = optional(string…

Map containing access logging configuration for load balancer

Defaultnull
createoptionalbool

Controls if resources should be created (affects nearly all resources)

Defaulttrue
create_security_groupoptionalbool

Determines if a security group is created

Defaulttrue
customer_owned_ipv4_pooloptionalstring

The ID of the customer owned ipv4 pool to use for this load balancer

Defaultnull
default_portoptionalnumber

Default port used across the listener and target group

Default80
default_protocoloptionalstring

Default protocol used across the listener and target group

DefaultHTTP
desync_mitigation_modeoptionalstring

Determines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`

Defaultnull
dns_record_client_routing_policyoptionalstring

Indicates how traffic is distributed among the load balancer Availability Zones. Possible values are any_availability_zone (default), availability_zone_affinity, or partial_availability_zone_affinity. Only valid for network type load balancers

Defaultnull
drop_invalid_header_fieldsoptionalbool

Indicates whether HTTP headers with header fields that are not valid are removed by the load balancer (`true`) or routed to targets (`false`). The default is `true`. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balanc…

Defaulttrue
enable_cross_zone_load_balancingoptionalbool

If `true`, cross-zone load balancing of the load balancer will be enabled. For application load balancer this feature is always enabled (`true`) and cannot be disabled. Defaults to `true`

Defaulttrue
enable_deletion_protectionoptionalbool

If `true`, deletion of the load balancer will be disabled via the AWS API. This will prevent Terraform from deleting the load balancer. Defaults to `true`

Defaulttrue
enable_http2optionalbool

Indicates whether HTTP/2 is enabled in application load balancers. Defaults to `true`

Defaultnull
enable_tls_version_and_cipher_suite_headersoptionalbool

Indicates whether the two headers (`x-amzn-tls-version` and `x-amzn-tls-cipher-suite`), which contain information about the negotiated TLS version and cipher suite, are added to the client request before sending it to the target. Only valid for Load Balancers of type `application`. Defaults to `fals…

Defaultnull
enable_waf_fail_openoptionalbool

Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`

Defaultnull
enable_xff_client_portoptionalbool

Indicates whether the X-Forwarded-For header should preserve the source port that the client used to connect to the load balancer in `application` load balancers. Defaults to `false`

Defaultnull
enable_zonal_shiftoptionalbool

Whether zonal shift is enabled

Defaultnull
enforce_security_group_inbound_rules_on_private_link_trafficoptionalstring

Indicates whether inbound security group rules are enforced for traffic originating from a PrivateLink. Only valid for Load Balancers of type network. The possible values are on and off

Defaultnull
health_check_logsoptionalobject({ bucket = string enabled = optional(bool, true) prefix = optional(string…

Map containing health check logging configuration for application load balancers

Defaultnull
idle_timeoutoptionalnumber

The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: `60`

Defaultnull
internaloptionalbool

If true, the LB will be internal. Defaults to `false`

Defaultnull
ip_address_typeoptionalstring

The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`

Defaultnull
ipam_poolsoptionalobject({ ipv4_ipam_pool_id = string })

The IPAM pools to use with the load balancer

Defaultnull
listenersoptionalmap(object({ alpn_policy = optional(string) certificate_arn = optional(string) a…

Map of listener configurations to create

Default{}
load_balancer_typeoptionalstring

The type of load balancer to create. Possible values are `application`, `gateway`, or `network`. The default value is `application`

Defaultapplication
minimum_load_balancer_capacityoptionalobject({ capacity_units = number })

Minimum capacity for a load balancer. Only valid for Load Balancers of type `application` or `network`

Defaultnull
nameoptionalstring

The name of the LB. This name must be unique within your AWS account, can have a maximum of 32 characters, must contain only alphanumeric characters or hyphens, and must not begin or end with a hyphen

Defaultnull
name_prefixoptionalstring

Creates a unique name beginning with the specified prefix. Conflicts with `name`

Defaultnull
preserve_host_headeroptionalbool

Indicates whether the Application Load Balancer should preserve the Host header in the HTTP request and send it to the target without any change. Defaults to `false`

Defaultnull
putin_khuylooptionalbool

Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!

Defaulttrue
regionoptionalstring

Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration

Defaultnull
route53_recordsoptionalmap(object({ zone_id = string name = optional(string) type = string evaluate_tar…

Map of Route53 records to create. Each record map should contain `zone_id`, `name`, and `type`

Defaultnull
security_group_descriptionoptionalstring

Description of the security group created

Defaultnull
security_group_egress_rulesoptionalmap(object({ name = optional(string) cidr_ipv4 = optional(string) cidr_ipv6 = op…

Security group egress rules to add to the security group created

Defaultnull
security_group_ingress_rulesoptionalmap(object({ name = optional(string) cidr_ipv4 = optional(string) cidr_ipv6 = op…

Security group ingress rules to add to the security group created

Defaultnull
security_group_nameoptionalstring

Name to use on security group created

Defaultnull
security_group_tagsoptionalmap(string)

A map of additional tags to add to the security group created

Default{}

All 50 are optional — the module deploys with none of them set. Showing 40, so the site stays a static download — the remaining 10 are in the source.

Outputs

11
arn

The ID and ARN of the load balancer we created

arn_suffix

ARN suffix of our load balancer - can be used with CloudWatch

dns_name

The DNS name of the load balancer

id

The ID and ARN of the load balancer we created

listener_rules

Map of listeners rules created and their attributes

listeners

Map of listeners created and their attributes

route53_records

The Route53 records created and attached to the load balancer

security_group_arn

Amazon Resource Name (ARN) of the security group

security_group_id

ID of the security group

target_groups

Map of target groups created and their attributes

zone_id

The zone_id of the load balancer to assist with creating DNS records

What the agent wires into the next module. An edge on the architecture diagram is one of these consumed by something else.