-
Notifications
You must be signed in to change notification settings - Fork 3
/
elb.tf
98 lines (80 loc) · 2.63 KB
/
elb.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
resource "aws_security_group" "elb" {
count = local.create_elb ? 1 : 0
name_prefix = "${var.scanner_name}-elb"
description = "Security Group for Nessus ELB"
vpc_id = var.vpc_id
tags = merge(
var.tags,
var.elb_additional_sg_tags,
{ "Name" : "${var.scanner_name}-elb" }
)
lifecycle {
create_before_destroy = true
}
}
resource "aws_security_group_rule" "elb_egress" {
count = local.create_elb ? 1 : 0
description = "Allow traffic from the ELB to the instances"
from_port = 8834
protocol = "tcp"
security_group_id = aws_security_group.elb[0].id
source_security_group_id = aws_security_group.this.id
to_port = 8834
type = "egress"
}
resource "aws_security_group_rule" "elb_ingress" {
count = length(var.elb_allowed_cidr_blocks) > 0 && local.create_elb ? 1 : 0
cidr_blocks = var.elb_allowed_cidr_blocks #tfsec:ignore:AWS006
description = "Allow traffic from the allowed ranges"
from_port = 443
protocol = "tcp"
security_group_id = aws_security_group.elb[0].id
to_port = 443
type = "ingress"
}
resource "aws_lb" "this" {
count = local.create_elb ? 1 : 0
name_prefix = substr(var.scanner_name, 0, 6)
enable_cross_zone_load_balancing = "true"
internal = var.elb_internal
load_balancer_type = "application"
security_groups = [aws_security_group.elb[0].id]
subnets = var.elb_subnets
tags = var.tags
}
resource "aws_lb_listener" "this" {
count = local.create_elb ? 1 : 0
certificate_arn = var.elb_certificate
load_balancer_arn = aws_lb.this[0].id
port = 443
protocol = "HTTPS"
ssl_policy = "ELBSecurityPolicy-TLS-1-2-2017-01"
default_action {
target_group_arn = aws_lb_target_group.this[0].id
type = "forward"
}
}
resource "aws_lb_target_group" "this" {
count = local.create_elb ? 1 : 0
name_prefix = substr(var.scanner_name, 0, 6)
port = 8834
protocol = "HTTPS"
tags = var.tags
vpc_id = var.vpc_id
health_check {
healthy_threshold = 2
interval = 15
matcher = "200-299,302"
protocol = "HTTPS"
port = 8834
}
lifecycle {
create_before_destroy = true
}
}
resource "aws_lb_target_group_attachment" "this" {
count = local.create_elb ? 1 : 0
target_group_arn = aws_lb_target_group.this[0].arn
target_id = aws_instance.this.id
port = 8834
}