Chris CoutinhoandClaude Opus 4.7
e4c552cd19
Deployer role: - Add servicediscovery actions; module always creates Cloud Map namespace and service so the policy must grant CreatePrivateDnsNamespace etc. - Make Route53 + ACM permissions unconditional. The server module always issues an ACM cert and writes Route53 records (no CloudFront default-cert path exists), so gating these on route53_zone_ids was broken. Split Route53 into hosted-zone management (always) plus record-set mutation (scoped to caller-supplied zones, falls back to *). - Remove unused cloudfront:* statement; no CloudFront resources in module. - Replace acm:* wildcard with explicit cert-management action set. Server module: - qdrant_image_tag is now nullable with default null and validated against use_external_qdrant, so external-qdrant callers can omit it instead of passing a sentinel "unused" value. - task_role_arn and efs_id outputs marked sensitive; qdrant_dns_name returns null when use_external_qdrant = true. - ALB SG now has matching IPv6 egress rule (was v4-only). - nextcloud_url validates the https:// scheme. - random_pet.subdomain keeper includes zone_name so a zone migration that preserves zone_id still triggers regeneration. - Pin required_version >= 1.9 on both modules. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
112 lines
2.9 KiB
Terraform
112 lines
2.9 KiB
Terraform
resource "aws_security_group" "alb" {
|
|
name = "${var.name}-alb"
|
|
description = "Public HTTPS ingress for ${var.name}"
|
|
vpc_id = var.vpc_id
|
|
}
|
|
|
|
resource "aws_vpc_security_group_ingress_rule" "alb_https_v4" {
|
|
security_group_id = aws_security_group.alb.id
|
|
cidr_ipv4 = "0.0.0.0/0"
|
|
from_port = 443
|
|
to_port = 443
|
|
ip_protocol = "tcp"
|
|
description = "HTTPS"
|
|
}
|
|
|
|
resource "aws_vpc_security_group_ingress_rule" "alb_https_v6" {
|
|
security_group_id = aws_security_group.alb.id
|
|
cidr_ipv6 = "::/0"
|
|
from_port = 443
|
|
to_port = 443
|
|
ip_protocol = "tcp"
|
|
description = "HTTPS (IPv6)"
|
|
}
|
|
|
|
resource "aws_vpc_security_group_ingress_rule" "alb_http_v4" {
|
|
security_group_id = aws_security_group.alb.id
|
|
cidr_ipv4 = "0.0.0.0/0"
|
|
from_port = 80
|
|
to_port = 80
|
|
ip_protocol = "tcp"
|
|
description = "HTTP (redirects to HTTPS)"
|
|
}
|
|
|
|
resource "aws_vpc_security_group_ingress_rule" "alb_http_v6" {
|
|
security_group_id = aws_security_group.alb.id
|
|
cidr_ipv6 = "::/0"
|
|
from_port = 80
|
|
to_port = 80
|
|
ip_protocol = "tcp"
|
|
description = "HTTP (IPv6, redirects to HTTPS)"
|
|
}
|
|
|
|
resource "aws_vpc_security_group_egress_rule" "alb_all_v4" {
|
|
security_group_id = aws_security_group.alb.id
|
|
cidr_ipv4 = "0.0.0.0/0"
|
|
ip_protocol = "-1"
|
|
}
|
|
|
|
resource "aws_vpc_security_group_egress_rule" "alb_all_v6" {
|
|
security_group_id = aws_security_group.alb.id
|
|
cidr_ipv6 = "::/0"
|
|
ip_protocol = "-1"
|
|
}
|
|
|
|
resource "aws_lb" "this" {
|
|
name = var.name
|
|
load_balancer_type = "application"
|
|
internal = false
|
|
subnets = var.public_subnet_ids
|
|
security_groups = [aws_security_group.alb.id]
|
|
|
|
drop_invalid_header_fields = true
|
|
}
|
|
|
|
resource "aws_lb_target_group" "this" {
|
|
name = var.name
|
|
port = var.container_port
|
|
protocol = "HTTP"
|
|
target_type = "ip"
|
|
vpc_id = var.vpc_id
|
|
|
|
deregistration_delay = 30
|
|
|
|
health_check {
|
|
path = "/health/live"
|
|
protocol = "HTTP"
|
|
matcher = "200"
|
|
interval = 30
|
|
timeout = 5
|
|
healthy_threshold = 2
|
|
unhealthy_threshold = 3
|
|
}
|
|
}
|
|
|
|
resource "aws_lb_listener" "https" {
|
|
load_balancer_arn = aws_lb.this.arn
|
|
port = 443
|
|
protocol = "HTTPS"
|
|
ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06"
|
|
certificate_arn = aws_acm_certificate_validation.this.certificate_arn
|
|
|
|
default_action {
|
|
type = "forward"
|
|
target_group_arn = aws_lb_target_group.this.arn
|
|
}
|
|
}
|
|
|
|
resource "aws_lb_listener" "http_redirect" {
|
|
load_balancer_arn = aws_lb.this.arn
|
|
port = 80
|
|
protocol = "HTTP"
|
|
|
|
default_action {
|
|
type = "redirect"
|
|
redirect {
|
|
protocol = "HTTPS"
|
|
port = "443"
|
|
status_code = "HTTP_301"
|
|
}
|
|
}
|
|
}
|