Application Load Balancer
Terraform module to create AWS Application/Network Load Balancer (ALB/NLB) resources
Inputs
40 / 50
access_logsoptionalobject({ bucket = string enabled = optional(bool, true) prefix = optional(string…Map containing access logging configuration for load balancer
nulladditional_target_group_attachmentsoptionalmap(object({ target_group_key = string target_id = string target_type = optional…Map of additional target group attachments to create. Use `target_group_key` to attach to the target group created in `target_groups`
nullassociate_web_acloptionalboolIndicates whether a Web Application Firewall (WAF) ACL should be associated with the load balancer
falseclient_keep_aliveoptionalnumberClient keep alive value in seconds. The valid range is 60-604800 seconds. The default is 3600 seconds
nullconnection_logsoptionalobject({ bucket = string enabled = optional(bool, true) prefix = optional(string…Map containing access logging configuration for load balancer
nullcreateoptionalboolControls if resources should be created (affects nearly all resources)
truecreate_security_groupoptionalboolDetermines if a security group is created
truecustomer_owned_ipv4_pooloptionalstringThe ID of the customer owned ipv4 pool to use for this load balancer
nulldefault_portoptionalnumberDefault port used across the listener and target group
80default_protocoloptionalstringDefault protocol used across the listener and target group
HTTPdesync_mitigation_modeoptionalstringDetermines how the load balancer handles requests that might pose a security risk to an application due to HTTP desync. Valid values are `monitor`, `defensive` (default), `strictest`
nulldns_record_client_routing_policyoptionalstringIndicates how traffic is distributed among the load balancer Availability Zones. Possible values are any_availability_zone (default), availability_zone_affinity, or partial_availability_zone_affinity. Only valid for network type load balancers
nulldrop_invalid_header_fieldsoptionalboolIndicates whether HTTP headers with header fields that are not valid are removed by the load balancer (`true`) or routed to targets (`false`). The default is `true`. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens. Only valid for Load Balanc…
trueenable_cross_zone_load_balancingoptionalboolIf `true`, cross-zone load balancing of the load balancer will be enabled. For application load balancer this feature is always enabled (`true`) and cannot be disabled. Defaults to `true`
trueenable_deletion_protectionoptionalboolIf `true`, deletion of the load balancer will be disabled via the AWS API. This will prevent Terraform from deleting the load balancer. Defaults to `true`
trueenable_http2optionalboolIndicates whether HTTP/2 is enabled in application load balancers. Defaults to `true`
nullenable_tls_version_and_cipher_suite_headersoptionalboolIndicates whether the two headers (`x-amzn-tls-version` and `x-amzn-tls-cipher-suite`), which contain information about the negotiated TLS version and cipher suite, are added to the client request before sending it to the target. Only valid for Load Balancers of type `application`. Defaults to `fals…
nullenable_waf_fail_openoptionalboolIndicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`
nullenable_xff_client_portoptionalboolIndicates whether the X-Forwarded-For header should preserve the source port that the client used to connect to the load balancer in `application` load balancers. Defaults to `false`
nullenable_zonal_shiftoptionalboolWhether zonal shift is enabled
nullenforce_security_group_inbound_rules_on_private_link_trafficoptionalstringIndicates whether inbound security group rules are enforced for traffic originating from a PrivateLink. Only valid for Load Balancers of type network. The possible values are on and off
nullhealth_check_logsoptionalobject({ bucket = string enabled = optional(bool, true) prefix = optional(string…Map containing health check logging configuration for application load balancers
nullidle_timeoutoptionalnumberThe time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: `60`
nullinternaloptionalboolIf true, the LB will be internal. Defaults to `false`
nullip_address_typeoptionalstringThe type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`
nullipam_poolsoptionalobject({ ipv4_ipam_pool_id = string })The IPAM pools to use with the load balancer
nulllistenersoptionalmap(object({ alpn_policy = optional(string) certificate_arn = optional(string) a…Map of listener configurations to create
{}load_balancer_typeoptionalstringThe type of load balancer to create. Possible values are `application`, `gateway`, or `network`. The default value is `application`
applicationminimum_load_balancer_capacityoptionalobject({ capacity_units = number })Minimum capacity for a load balancer. Only valid for Load Balancers of type `application` or `network`
nullnameoptionalstringThe name of the LB. This name must be unique within your AWS account, can have a maximum of 32 characters, must contain only alphanumeric characters or hyphens, and must not begin or end with a hyphen
nullname_prefixoptionalstringCreates a unique name beginning with the specified prefix. Conflicts with `name`
nullpreserve_host_headeroptionalboolIndicates whether the Application Load Balancer should preserve the Host header in the HTTP request and send it to the target without any change. Defaults to `false`
nullputin_khuylooptionalboolDo you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!
trueregionoptionalstringRegion where the resource(s) will be managed. Defaults to the Region set in the provider configuration
nullroute53_recordsoptionalmap(object({ zone_id = string name = optional(string) type = string evaluate_tar…Map of Route53 records to create. Each record map should contain `zone_id`, `name`, and `type`
nullsecurity_group_descriptionoptionalstringDescription of the security group created
nullsecurity_group_egress_rulesoptionalmap(object({ name = optional(string) cidr_ipv4 = optional(string) cidr_ipv6 = op…Security group egress rules to add to the security group created
nullsecurity_group_ingress_rulesoptionalmap(object({ name = optional(string) cidr_ipv4 = optional(string) cidr_ipv6 = op…Security group ingress rules to add to the security group created
nullsecurity_group_nameoptionalstringName to use on security group created
nullsecurity_group_tagsoptionalmap(string)A map of additional tags to add to the security group created
{}All 50 are optional — the module deploys with none of them set. Showing 40, so the site stays a static download — the remaining 10 are in the source.
Outputs
11
arnThe ID and ARN of the load balancer we created
arn_suffixARN suffix of our load balancer - can be used with CloudWatch
dns_nameThe DNS name of the load balancer
idThe ID and ARN of the load balancer we created
listener_rulesMap of listeners rules created and their attributes
listenersMap of listeners created and their attributes
route53_recordsThe Route53 records created and attached to the load balancer
security_group_arnAmazon Resource Name (ARN) of the security group
security_group_idID of the security group
target_groupsMap of target groups created and their attributes
zone_idThe zone_id of the load balancer to assist with creating DNS records
What the agent wires into the next module. An edge on the architecture diagram is one of these consumed by something else.