Skip to content

Commit 451ee71

Browse files
LeoDiazLLeoDiazL
committed
add-alb-and-waf-to-ec2
1 parent fe8dc6f commit 451ee71

File tree

7 files changed

+437
-1
lines changed

7 files changed

+437
-1
lines changed

‎action.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -280,6 +280,44 @@ inputs:
280280
description: 'A JSON object of additional tags that will be included on created resources. Example: `{"key1": "value1", "key2": "value2"}`'
281281
required: false
282282

283+
# AWS ALB
284+
aws_alb_create:
285+
description: "Global toggle for ALB creation"
286+
required: false
287+
aws_alb_security_group_name:
288+
description: "Name of the security group to use for ALB"
289+
required: false
290+
aws_alb_app_port:
291+
description: "Comma-separated list of application ports for ALB target group"
292+
required: false
293+
aws_alb_app_protocol:
294+
description: "Comma-separated list of protocols for ALB target group (HTTP/HTTPS)"
295+
required: false
296+
aws_alb_listen_port:
297+
description: "Comma-separated list of listener ports for ALB"
298+
required: false
299+
aws_alb_listen_protocol:
300+
description: "Comma-separated list of listener protocols for ALB (HTTP/HTTPS)"
301+
required: false
302+
aws_alb_healthcheck_path:
303+
description: "Health check path for ALB target group"
304+
required: false
305+
aws_alb_healthcheck_protocol:
306+
description: "Health check protocol for ALB target group"
307+
required: false
308+
aws_alb_ssl_policy:
309+
description: "SSL policy for HTTPS listeners"
310+
required: false
311+
aws_alb_access_log_enabled:
312+
description: "Enable ALB access logs"
313+
required: false
314+
aws_alb_access_log_bucket_name:
315+
description: "S3 bucket name to store the ALB access logs"
316+
required: false
317+
aws_alb_access_log_expire:
318+
description: "Delete the access logs after this amount of days"
319+
required: false
320+
283321
# AWS WAF
284322
aws_waf_enable:
285323
description: 'Enable WAF for load balancer.'
@@ -1307,6 +1345,20 @@ runs:
13071345
AWS_ELB_ACCESS_LOG_EXPIRE: ${{ inputs.aws_elb_access_log_expire }}
13081346
AWS_ELB_ADDITIONAL_TAGS: ${{ inputs.aws_elb_additional_tags }}
13091347

1348+
# AWS ALB
1349+
AWS_ALB_CREATE: ${{ inputs.aws_alb_create }}
1350+
AWS_ALB_SECURITY_GROUP_NAME: ${{ inputs.aws_alb_security_group_name }}
1351+
AWS_ALB_APP_PORT: ${{ inputs.aws_alb_app_port }}
1352+
AWS_ALB_APP_PROTOCOL: ${{ inputs.aws_alb_app_protocol }}
1353+
AWS_ALB_LISTEN_PORT: ${{ inputs.aws_alb_listen_port }}
1354+
AWS_ALB_LISTEN_PROTOCOL: ${{ inputs.aws_alb_listen_protocol }}
1355+
AWS_ALB_HEALTHCHECK_PATH: ${{ inputs.aws_alb_healthcheck_path }}
1356+
AWS_ALB_HEALTHCHECK_PROTOCOL: ${{ inputs.aws_alb_healthcheck_protocol }}
1357+
AWS_ALB_SSL_POLICY: ${{ inputs.aws_alb_ssl_policy }}
1358+
AWS_ALB_ACCESS_LOG_ENABLED: ${{ inputs.aws_alb_access_log_enabled }}
1359+
AWS_ALB_ACCESS_LOG_BUCKET_NAME: ${{ inputs.aws_alb_access_log_bucket_name }}
1360+
AWS_ALB_ACCESS_LOG_EXPIRE: ${{ inputs.aws_alb_access_log_expire }}
1361+
13101362
# AWS WAF
13111363
AWS_WAF_ENABLE: ${{ inputs.aws_waf_enable }}
13121364
AWS_WAF_LOGGING_ENABLE: ${{ inputs.aws_waf_logging_enable }}

‎operations/_scripts/generate/generate_vars_terraform.sh‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,22 @@ if [[ $(alpha_only "$AWS_ELB_CREATE") == true ]]; then
132132
aws_elb_additional_tags=$(generate_var aws_elb_additional_tags $AWS_ELB_ADDITIONAL_TAGS)
133133
fi
134134

135+
#-- AWS ALB --#
136+
if [[ $(alpha_only "$AWS_ALB_CREATE") == true ]]; then
137+
aws_alb_create=$(generate_var aws_alb_create $AWS_ALB_CREATE)
138+
aws_alb_security_group_name=$(generate_var aws_alb_security_group_name $AWS_ALB_SECURITY_GROUP_NAME)
139+
aws_alb_app_port=$(generate_var aws_alb_app_port $AWS_ALB_APP_PORT)
140+
aws_alb_app_protocol=$(generate_var aws_alb_app_protocol $AWS_ALB_APP_PROTOCOL)
141+
aws_alb_listen_port=$(generate_var aws_alb_listen_port $AWS_ALB_LISTEN_PORT)
142+
aws_alb_listen_protocol=$(generate_var aws_alb_listen_protocol $AWS_ALB_LISTEN_PROTOCOL)
143+
aws_alb_healthcheck_path=$(generate_var aws_alb_healthcheck_path $AWS_ALB_HEALTHCHECK_PATH)
144+
aws_alb_healthcheck_protocol=$(generate_var aws_alb_healthcheck_protocol $AWS_ALB_HEALTHCHECK_PROTOCOL)
145+
aws_alb_ssl_policy=$(generate_var aws_alb_ssl_policy $AWS_ALB_SSL_POLICY)
146+
aws_alb_access_log_enabled=$(generate_var aws_alb_access_log_enabled $AWS_ALB_ACCESS_LOG_ENABLED)
147+
aws_alb_access_log_bucket_name=$(generate_var aws_alb_access_log_bucket_name $AWS_ALB_ACCESS_LOG_BUCKET_NAME)
148+
aws_alb_access_log_expire=$(generate_var aws_alb_access_log_expire $AWS_ALB_ACCESS_LOG_EXPIRE)
149+
fi
150+
135151
#-- AWS WAF --#
136152
if [[ $(alpha_only "$AWS_WAF_ENABLE") == true ]]; then
137153
aws_waf_enable=$(generate_var aws_waf_enable $AWS_WAF_ENABLE)
@@ -509,6 +525,20 @@ $aws_elb_access_log_expire
509525
$aws_elb_access_log_bucket_name
510526
$aws_elb_additional_tags
511527
528+
#-- ALB --#
529+
$aws_alb_create
530+
$aws_alb_security_group_name
531+
$aws_alb_app_port
532+
$aws_alb_app_protocol
533+
$aws_alb_listen_port
534+
$aws_alb_listen_protocol
535+
$aws_alb_healthcheck_path
536+
$aws_alb_healthcheck_protocol
537+
$aws_alb_ssl_policy
538+
$aws_alb_access_log_enabled
539+
$aws_alb_access_log_bucket_name
540+
$aws_alb_access_log_expire
541+
512542
#-- WAF --#
513543
$aws_waf_enable
514544
$aws_waf_logging_enable

‎operations/deployment/terraform/aws/aws_variables.tf‎

Lines changed: 73 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -327,7 +327,79 @@ variable "aws_elb_additional_tags" {
327327
default = "{}"
328328
}
329329

330-
# AWS LB
330+
# AWS ALB
331+
variable "aws_alb_create" {
332+
type = bool
333+
description = "Global toggle for ALB creation"
334+
default = false
335+
}
336+
337+
variable "aws_alb_security_group_name" {
338+
type = string
339+
description = "Name of the security group to use for ALB"
340+
default = ""
341+
}
342+
343+
variable "aws_alb_app_port" {
344+
type = string
345+
description = "Comma-separated list of application ports for ALB target group"
346+
default = ""
347+
}
348+
349+
variable "aws_alb_app_protocol" {
350+
type = string
351+
description = "Comma-separated list of protocols for ALB target group (HTTP/HTTPS)"
352+
default = ""
353+
}
354+
355+
variable "aws_alb_listen_port" {
356+
type = string
357+
description = "Comma-separated list of listener ports for ALB"
358+
default = ""
359+
}
360+
361+
variable "aws_alb_listen_protocol" {
362+
type = string
363+
description = "Comma-separated list of listener protocols for ALB (HTTP/HTTPS)"
364+
default = ""
365+
}
366+
367+
# Healthcheck
368+
variable "aws_alb_healthcheck_path" {
369+
type = string
370+
description = "Health check path for ALB target group"
371+
default = "/"
372+
}
373+
374+
variable "aws_alb_healthcheck_protocol" {
375+
type = string
376+
description = "Health check protocol for ALB target group"
377+
default = "HTTP"
378+
}
379+
380+
variable "aws_alb_ssl_policy" {
381+
type = string
382+
description = "SSL policy for HTTPS listeners"
383+
default = null
384+
}
385+
# Logging
386+
variable "aws_alb_access_log_enabled" {
387+
type = bool
388+
description = "Enable ALB access logs"
389+
default = false
390+
}
391+
392+
variable "aws_alb_access_log_bucket_name" {
393+
type = string
394+
description = "S3 bucket name to store the ALB access logs"
395+
default = ""
396+
}
397+
398+
variable "aws_alb_access_log_expire" {
399+
type = string
400+
description = "Delete the access logs after this amount of days"
401+
default = "90"
402+
}
331403

332404
# AWS WAF
333405
variable "aws_waf_enable" {

‎operations/deployment/terraform/aws/bitovi_main.tf‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,70 @@ module "aws_elb" {
130130
}
131131
}
132132

133+
module "aws_lb" {
134+
source = "../modules/aws/lb"
135+
count = var.aws_ec2_instance_create && var.aws_alb_create ? 1 : 0
136+
# ALB Values
137+
aws_alb_security_group_name = var.aws_alb_security_group_name
138+
aws_alb_app_port = var.aws_alb_app_port
139+
aws_alb_app_protocol = var.aws_alb_app_protocol
140+
aws_alb_listen_port = var.aws_alb_listen_port
141+
aws_alb_listen_protocol = var.aws_alb_listen_protocol
142+
aws_alb_healthcheck_path = var.aws_alb_healthcheck_path
143+
aws_alb_healthcheck_protocol = var.aws_alb_healthcheck_protocol
144+
aws_alb_ssl_policy = var.aws_alb_ssl_policy
145+
# Logging
146+
aws_alb_access_log_enabled = var.aws_alb_access_log_enabled
147+
aws_alb_access_log_bucket_name = var.aws_alb_access_log_bucket_name
148+
aws_alb_access_log_expire = var.aws_alb_access_log_expire
149+
# EC2
150+
aws_vpc_selected_id = module.vpc.aws_selected_vpc_id
151+
aws_vpc_subnet_selected = module.vpc.aws_vpc_subnet_selected
152+
aws_instance_server_id = module.ec2[0].aws_instance_server_id
153+
aws_alb_target_sg_id = module.ec2[0].aws_security_group_ec2_sg_id
154+
# Certs
155+
aws_certificates_selected_arn = var.aws_r53_enable_cert && var.aws_r53_domain_name != "" ? module.aws_certificates[0].selected_arn : ""
156+
# Others
157+
aws_resource_identifier = var.aws_resource_identifier
158+
aws_resource_identifier_supershort = var.aws_resource_identifier_supershort
159+
# Module dependencies
160+
depends_on = [module.vpc, module.ec2]
161+
162+
providers = {
163+
aws = aws.lb
164+
}
165+
}
166+
167+
module "aws_waf_ec2_alb" {
168+
source = "../modules/aws/waf"
169+
count = var.aws_waf_enable && var.aws_ec2_instance_create && var.aws_alb_create ? 1 : 0
170+
aws_waf_enable = var.aws_waf_enable
171+
aws_waf_logging_enable = var.aws_waf_logging_enable
172+
aws_waf_log_retention_days = var.aws_waf_log_retention_days
173+
aws_resource_identifier = var.aws_resource_identifier
174+
# Rules
175+
aws_waf_rule_rate_limit = var.aws_waf_rule_rate_limit
176+
aws_waf_rule_managed_rules = var.aws_waf_rule_managed_rules
177+
aws_waf_rule_managed_bad_inputs = var.aws_waf_rule_managed_bad_inputs
178+
aws_waf_rule_ip_reputation = var.aws_waf_rule_ip_reputation
179+
aws_waf_rule_anonymous_ip = var.aws_waf_rule_anonymous_ip
180+
aws_waf_rule_bot_control = var.aws_waf_rule_bot_control
181+
aws_waf_rule_geo_block_countries = var.aws_waf_rule_geo_block_countries
182+
aws_waf_rule_geo_allow_only_countries = var.aws_waf_rule_geo_allow_only_countries
183+
aws_waf_rule_user_arn = var.aws_waf_rule_user_arn
184+
aws_waf_rule_sqli = var.aws_waf_rule_sqli
185+
aws_waf_rule_linux = var.aws_waf_rule_linux
186+
aws_waf_rule_unix = var.aws_waf_rule_unix
187+
aws_waf_rule_admin_protection = var.aws_waf_rule_admin_protection
188+
# Incoming
189+
aws_lb_resource_arn = module.aws_lb[0].aws_lb_resource_arn
190+
# Others
191+
depends_on = [module.aws_lb]
192+
providers = {
193+
aws = aws.waf
194+
}
195+
}
196+
133197
module "efs" {
134198
source = "../modules/aws/efs"
135199
count = var.aws_efs_enable ? 1 : 0

0 commit comments

Comments
 (0)