-
Notifications
You must be signed in to change notification settings - Fork 0
/
lb.tf
107 lines (91 loc) · 3.14 KB
/
lb.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
# ###======================== CTF ALB ====================== ###
resource "aws_lb" "owaspjs" {
# checkov:skip=CKV_AWS_150: Ensure that Load Balancer has deletion protection enabled
# checkov:skip=CKV_AWS_91: Ensure the ELBv2 (Application/Network) has access logging enabled
# checkov:skip=CKV_AWS_131: Ensure that ALB drops HTTP headers
load_balancer_type = "application"
enable_deletion_protection = false
enable_http2 = true
ip_address_type = "ipv4"
drop_invalid_header_fields = false
internal = false
name = "owaspjs-alb"
security_groups = [aws_security_group.alb.id]
subnets = [aws_subnet.public_a.id, aws_subnet.public_b.id]
}
resource "aws_lb_target_group" "owaspjs" {
name = "owasp-js-lb-tg"
port = 80
protocol = "HTTP"
vpc_id = aws_vpc.ctf.id
health_check {
healthy_threshold = 2
unhealthy_threshold = 2
timeout = 3
interval = 30
path = "/"
port = "80"
protocol = "HTTP"
matcher = "200,403"
}
}
resource "aws_lb_target_group_attachment" "owaspjs" {
target_group_arn = aws_lb_target_group.owaspjs.arn
target_id = aws_instance.owaspjs.id
port = 80
}
resource "aws_lb_listener" "owaspjs" {
# checkov:skip=CKV_AWS_2: Ensure ALB protocol is HTTPS
load_balancer_arn = aws_lb.owaspjs.arn
port = "80"
protocol = "HTTP"
default_action {
type = "forward"
target_group_arn = aws_lb_target_group.owaspjs.arn
}
}
resource "aws_lb" "cftd" {
# checkov:skip=CKV_AWS_150: Ensure that Load Balancer has deletion protection enabled
# checkov:skip=CKV_AWS_91: Ensure the ELBv2 (Application/Network) has access logging enabled
# checkov:skip=CKV_AWS_131: Ensure that ALB drops HTTP headers
load_balancer_type = "application"
enable_deletion_protection = false
enable_http2 = true
ip_address_type = "ipv4"
drop_invalid_header_fields = false
internal = false
name = "cftd-alb"
security_groups = [aws_security_group.alb.id]
subnets = [aws_subnet.public_a.id, aws_subnet.public_b.id]
}
resource "aws_lb_target_group" "cftd" {
name = "cftd-lb-tg"
port = 80
protocol = "HTTP"
vpc_id = aws_vpc.ctf.id
health_check {
healthy_threshold = 2
unhealthy_threshold = 2
timeout = 3
interval = 30
path = "/"
port = "80"
protocol = "HTTP"
matcher = "200,403"
}
}
resource "aws_lb_target_group_attachment" "cftd" {
target_group_arn = aws_lb_target_group.cftd.arn
target_id = aws_instance.ctfd.id
port = 80
}
resource "aws_lb_listener" "cftd" {
# checkov:skip=CKV_AWS_2: Ensure ALB protocol is HTTPS
load_balancer_arn = aws_lb.cftd.arn
port = "80"
protocol = "HTTP"
default_action {
type = "forward"
target_group_arn = aws_lb_target_group.cftd.arn
}
}