rvn-aws-alb · Latest version: 0.1.0
Dependencies and consumers
Every dependency input can be specified manually to reference existing external infrastructure rather than a Ravion module.Readme
Standalone Application Load Balancer (ALB) with HTTP/HTTPS listeners that multiple services can attach listener rules to.Overview
Use this module to create an Application Load Balancer inside a VPC that is shared by one or more services. Select a VPC network and Ravion provisions the load balancer, its security group, HTTP and HTTPS listeners with a fixed default response, optional access logging, and optional WAF association. The load balancer intentionally serves no traffic by itself. Services that reference this module, such as EC2 services, create their own target groups and listener rules on the shared listeners. Terraform source: flightcontrolhq/modules/networking/albUse cases
Placement and security
The load balancer is internet-facing in the public subnets by default. Enable Internal load balancer to place it in the private subnets, reachable only inside the VPC. The module creates a dedicated security group. Internet-facing load balancers allow 0.0.0.0/0 and ::/0 on the listener ports by default. Internal load balancers allow the RFC1918 IPv4 ranges and no IPv6 ingress by default. Restrict or remove access with Ingress IPv4 CIDRs and Ingress IPv6 CIDRs; an explicitly empty list creates no rules for that IP version. Services that attach to the load balancer allow traffic from this security group on their app ports.Listeners and TLS
HTTP is enabled on port 80 by default. Enable HTTPS and select a primary ACM Certificate module in the same AWS account and region. Add Additional certificate ARNs when the listener should serve more certificates through SNI. When both listeners are enabled, HTTP traffic redirects to HTTPS by default. The HTTP and HTTPS listener ports remain configurable for workloads that cannot use ports 80 and 443. Requests that match no service listener rule receive a fixed 503 response, so an unmatched host or path never reaches a service by accident.Access logs and WAF
Enable Access logs to write load balancer access logs to S3. Leave the bucket ARN blank to create a bucket with the configured retention, or point at an existing bucket. Associate a WAFv2 Web ACL by providing its ARN.Configuration
*Required when HTTPS is enabled.
Design decisions
- The default listener action is a fixed 503 response. Routing is owned by the services that attach listener rules, so the load balancer stays service-agnostic.
- Internal placement uses the network’s private subnets and internet-facing placement uses the public subnets; subnet selection is not exposed separately.
- Internal ingress defaults to RFC1918 IPv4 ranges with no IPv6 ingress, while internet-facing ingress defaults to all IPv4 and IPv6 sources.
- HTTP-only is allowed for development, but production load balancers should enable HTTPS with an ACM certificate.
- Advanced ALB behaviors such as desync mitigation, header handling, and HTTP/2 keep their safe Terraform defaults and are available through Advanced Terraform variables.
Learn more
Inputs reference
All inputs forrvn-aws-alb version 0.1.0. Use the name shown for each field as the input key in module config.
$ref:rvn-aws-network
required
VPC network.
- Immutable after creation
Load balancer
string
required
Name slug. Name for the load balancer and related resources.
- Default:
<<project.given_id>>-<<environment.given_id>>-<<module.given_id>> - Immutable after creation
- Pattern:
^[a-z0-9]([a-z0-9-]{0,30}[a-z0-9])?$— 1-32 lowercase letters, numbers, and hyphens. Start and end with a letter or number.
boolean
Internal load balancer. Create an internal load balancer reachable only inside the VPC. Turn off for an internet-facing load balancer in the public subnets.
- Default:
false
boolean
Deletion protection. Prevent accidental deletion of the load balancer via the AWS API.
- Default:
true
number
Idle timeout (seconds). Seconds a connection is allowed to be idle before the load balancer closes it.
- Default:
60 - Min:
1 - Max:
4000
Listeners
boolean
HTTP. Create an HTTP listener.
- Default:
true
number
HTTP port.
- Default:
80 - Min:
1 - Max:
65535 - Shown when:
{"http_listener_enabled":true}
boolean
HTTPS. Create an HTTPS listener. Select an ACM certificate when enabled.
- Default:
false
number
HTTPS port.
- Default:
443 - Min:
1 - Max:
65535 - Shown when:
{"https_listener_enabled":true}
$ref:rvn-acm-certificate
required
Certificate. Primary ACM certificate module for HTTPS. The certificate must use the same AWS account and region as the load balancer.
- Shown when:
{"https_listener_enabled":true}
string_array
Additional certificate ARNs. Additional ACM certificate ARNs attached to the HTTPS listener for SNI.
- Default:
[] - Shown when:
{"https_listener_enabled":true}
string
SSL policy. SSL policy for the HTTPS listener.
- Shown when:
{"https_listener_enabled":true}
boolean
Redirect HTTP to HTTPS. Redirect HTTP traffic to the HTTPS listener. Applies only when both listeners are enabled.
- Default:
true - Shown when:
{"http_listener_enabled":true,"https_listener_enabled":true}
Security
string_array
Ingress IPv4 CIDRs. IPv4 CIDR blocks allowed to reach the load balancer. Defaults to public internet access for an internet-facing load balancer and RFC1918 private ranges for an internal load balancer. Use an empty list to allow no IPv4 ingress.
string_array
Ingress IPv6 CIDRs. IPv6 CIDR blocks allowed to reach the load balancer. Defaults to public internet access for an internet-facing load balancer and no IPv6 ingress for an internal load balancer. Use an empty list to allow no IPv6 ingress.
string
WAF web ACL ARN. WAFv2 Web ACL to associate with the load balancer.
Access logs
boolean
Access logs. Write load balancer access logs to S3.
- Default:
false
string
Access logs bucket ARN. Existing S3 bucket for access logs. Leave blank to create a bucket.
- Shown when:
{"access_logs_enabled":true}
number
Access logs retention (days). Days to retain access logs in the created bucket.
- Default:
90 - Min:
1 - Shown when:
{"access_logs_enabled":true}
Misc
keyvalue
Tags. A map of tags to assign to all resources. Default tags are
Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleIdTerraform settings
string
OpenTofu version override. Override the environment’s default version for this module
string
Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
- Immutable after creation
object
Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
- Default:
{}