This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

• chore(deps): update terraform cloudposse/dynamic-subnets/aws to v2.4.2

Detected dependencies

• Check this box to trigger a request for Renovate to run again on this repository

Found a bug? Maybe our Slack Community can help.

Describe the Bug

When enabled = false is set on this module, it produces the following error:

Error: Invalid count argument

  on .terraform/modules/alb.access_logs.s3_bucket/main.tf line 163, in resource "aws_s3_bucket_policy" "default":
 163:   count      = module.this.enabled && (var.allow_ssl_requests_only || var.allow_encrypted_uploads_only || var.policy != "") ? 1 : 0

Expected Behavior

It should produce a valid plan

Steps to Reproduce

Steps to reproduce the behavior:

1. Run init and apply on the .tf file below
2. The first time this runs, it says there are no changes, but each subsequent apply, will yield the error above
3. Run apply again
4. See error

Screenshots

If applicable, add screenshots or logs to help explain your problem.

Environment (please complete the following information):

• This fails on terraform 0.13.7
• It seems to work on 0.14.x and above

Anything that will help us triage the bug will help. Here are some ideas:

• OS: OSX
• Version 11.5.2

Additional Context

Here's a simple .tf file to reproduce the issue

variable "vpc_id" {
  type        = string
  description = "The VPC ID"
}

variable "subnet_ids" {
  type        = list(string)
  description = "The Subnet IDs"
  default     = []
}

module "label" {
  source    = "cloudposse/label/null"
  version   = "0.25.0"
  namespace = "my"
  name      = "alb"
  stage     = "test"
}

module "alb" {
  source  = "cloudposse/alb/aws"
  version = "0.35.3"

  enabled = false
  context = module.label.context

  vpc_id                      = var.vpc_id
  subnet_ids                  = var.subnet_ids
  https_enabled               = false
  access_logs_enabled         = false
  http2_enabled               = false
  deletion_protection_enabled = false
}

I haven't figured out a way to enable/disable sitckness sessions on the ALB. It looks by default you always set it to true with 1 day of expiration.

Thanks

Describe the Feature

Boolean to enable a lifecycle to ignore tags changes outside terraform

Expected Behavior

Boolean to enable a lifecycle to ignore tags changes outside terraform

Use Case

When working with shared load balacners in elastic beanstalk, eb change tags in ALB outside terraform. If you re-apply the code the changes made by elastic beanstalk is deleted. This feature would be only useful when working with shared load balancers in beanstalk

Describe Ideal Solution

A simple boolean to enable the feature to ignore tag changes outside terraform

Alternatives Considered

No response

Additional Context

No response

what

• Add example invocation

why

• We need this so we can soon enable automated continuous integration testing of module

Have a question? Please checkout our Slack Community or visit our Slack Archive.

Describe the Feature

It should be possible to say "do not create this resource if a flag is passed to the module much like the aws elb resource which allows this by way of its create_elb variable, which sets count to 0 or 1 depending. This would allow you to decide to deploy or not deploy the resource based on the config flag.

Expected Behavior

Set enabled or create flag to false and no resource should be created, the default should be true.

Use Case

We have environments where people want some resources and not others deployed for various reasons, this means in some cases we don't want albs deployed because there are no machines deployed for that (usually a sandbox environment where only a few resources from the script are required), at the moment this module only allows for the creation, there is no way to turn that off.

Describe Ideal Solution

The flag should be implemented to disable the creation of the resource.

Alternatives Considered

There are no alternatives I can't set a count parameter on a module right now.

Additional Context

I feel It's a small but worthwhile thing to implement and ultimately makes the module more flexible allowing a default of true will not impact users who currently use the module.

Dependabot couldn't parse the main.tf found at /main.tf.

The error Dependabot encountered was:

unable to parse HCL: At 3:16: Unknown token: 3:16 IDENT var.attributes

Describe the Feature

Add default_target_group_arn_suffix as an output.

Expected Behavior

Simplified Terraform code.

Use Case

We use cloudposse/alb-target-group-cloudwatch-sns-alarms/aws along with this module and have to use a data source to build the target_group_arn_suffix input to that module. By having this module output the data, there should be no need for the data source.

data "aws_lb_target_group" "mytg" {
  arn = module.alb.default_target_group_arn
}

module "alb_alarms" {
  source  = "cloudposse/alb-target-group-cloudwatch-sns-alarms/aws"
  version = "0.15.0"

  alb_arn_suffix          = module.alb.alb_arn_suffix
  target_group_arn_suffix = data.aws_lb_target_group.mytg.arn_suffix # This can be simplified.
}

Describe Ideal Solution

output "default_target_group_arn_suffix" {
  description = "The default target group ARN suffix"
  value       = join("", aws_lb_target_group.default.*.arn_suffix)
}

Have a question? Please checkout our Slack Community or visit our Slack Archive.

Describe the Feature

We would like to have our ALB's log to a single bucket rather then individual ones. Similar to the S3 pattern.

Expected Behavior

Pass a logging bucket in on creation.

Use Case

Centralizing logging for a given env.

Describe Ideal Solution

Extention of the module to support the current default but also accept an existing bucket like the s3 module does.

Alternatives Considered

Writing our own as a fork from yours with this feature.

Additional Context

Add any other context or screenshots about the feature request here.

As per this article: https://stackoverflow.com/questions/51767917/terraform-alb-redirect-http-https

I would like to have support for protocol redirect, it could be here or in ingress alb module, or in both available.

Add preserve_host_header argument to aws_lb

hashicorp/terraform-provider-aws#26056
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb#preserve_host_header

Expected Behavior

ALB created wth preserve_host_header option

Am I just looking wrong, or Listeners are not supported?

Describe the Bug

I am creating an Application Load Balancer and I am setting default_target_group_enabled = false. However, when trying to apply my changes, Terraform outputs:

Error: creating ELBv2 Listener (arn:aws:elasticloadbalancing:us-east-1:xxx:loadbalancer/app/my-alb/f3a3728915895e61): ValidationError: A target group ARN must be specified

Checking the code it seems that a Target Group is required by the https listener.

Expected Behavior

I expected to create an Application Load Balancer without a Target Group. I didn't want to create a TG to make the https listener to work.

Additional Context

I am creating an ALB for redirect purposes.

module "alb" {
  source  = "cloudposse/alb/aws"
  version = "1.7.0"

  namespace   = "my-namespace"
  environment = "my-environment"

  load_balancer_name           = "my-alb-name"
  vpc_id                       = var.vpc_id
  subnet_ids                   = var.subnet_ids
  internal                     = false
  http_enabled                 = true
  https_enabled                = true
  http_redirect                = true
  https_ssl_policy             = "ELBSecurityPolicy-TLS-1-2-2017-01"
  access_logs_enabled          = false
  default_target_group_enabled = false
}

variable "rules" {
  description = "The redirect rules"
  type = map(object({
    host = string
  }))
}

resource "aws_lb_listener_rule" "this" {
  for_each = var.rules

  listener_arn = module.alb.https_listener_arn

  condition {
    host_header {
      values = [each.key]
    }
  }

  action {
    type = "redirect"
    redirect {
      host        = each.value.host
      path        = "/#{path}"
      query       = "#{query}"
      port        = 443
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

Terraform version:

$ tf --version
Terraform v1.3.1
on linux_amd64

We need to make sure the terraform scripts we use are working.
ttps://github.com/cloudposse/terraform-aws-alb/blob/master/main.tf

how can we know this one working before pulling it to our repo ?

Dependabot couldn't parse the context.tf found at /context.tf.

The error Dependabot encountered was:

unable to parse HCL: At 24:25: Unknown token: 24:25 IDENT var.enabled

View the update logs.

Found a bug? Maybe our Slack Community can help.

Describe the Bug

When specifying custom bucket for ALB logging:

access_logs_s3_bucket_id = aws_s3_bucket.alb_s3_logging.id

The terraform apply fails with the following error:

Error: Invalid count argument
│ 
│   on .terraform/modules/alb.access_logs/main.tf line 2, in data "aws_elb_service_account" "default":
│    2:   count = module.this.enabled ? 1 : 0
│ 
│ The "count" value depends on resource attributes that cannot be determined
│ until apply, so Terraform cannot predict how many instances will be
│ created. To work around this, use the -target argument to first apply only
│ the resources that the count depends on.

Expected Behavior

I expect terraform plan to complete successfully.

Steps to Reproduce

Steps to reproduce the behavior:

I've been using this module for while. All working fine. I then enabled logging using a custom bucket and get the above error.

• it works fine if I don't specify a custom bucket (access_logs_s3_bucket_id = aws_s3_bucket.alb_s3_logging.id). However, I need to be able to give the bucket a specific name as opposed to having the name derived from the labels. Is there a way to specify the bucket name when not using access_logs_s3_bucket_id = aws_s3_bucket.alb_s3_logging.id?

ALB configuration
###
module "alb" {
  source        = "https://github.com/cloudposse/terraform-aws-alb.git?ref=1.0.0"
  context       = module.alb-web-label
  vpc_id        = data.aws_vpc.selected.id
  subnet_ids    = [for s in data.aws_subnet.public : s.id]
  internal      = var.alb_internal
  http_enabled  = var.alb_http_enabled
  http_redirect = var.alb_http_redirect
  
  #access_logs_prefix = "alb-web"
  access_logs_enabled = true
  access_logs_s3_bucket_id = aws_s3_bucket.alb_s3_logging.id

  cross_zone_load_balancing_enabled       = var.alb_cross_loadbalancing_enabled
  http2_enabled                           = var.alb_http2_enabled
  health_check_path                       = var.alb_health_check_path
  health_check_matcher                    = var.alb_health_check_matcher
  target_group_port                       = var.alb_target_port
  target_group_target_type                = "ip"
  certificate_arn                         = module.acm_cert.certificate_arn
  security_group_ids = [
    "${data.aws_security_group.common.id}",
    "${data.aws_security_group.specific.id}"
  ]
  security_group_enabled    = var.alb_sg_enabled
  https_enabled             = var.alb_https_enabled
  https_ingress_cidr_blocks = var.https_ingress_cidr_blocks
  target_group_name         = "${module.alb-web-label.id}-tg"
}

S3 bucket configuration
###
resource "aws_s3_bucket" "alb_s3_logging" {
  bucket = "${var.environment}-${data.aws_region.current.name}-alb-s3-logging"
}

resource "aws_s3_bucket_acl" "alb_s3_logging_acl" {
  bucket = aws_s3_bucket.alb_s3_logging.id
  acl    = "private"
}

resource "aws_s3_bucket_policy" "alb_s3_logging_policy" {
  bucket = aws_s3_bucket.alb_s3_logging.id
  policy = templatefile("templates/alb-logging-s3-bucket-policy.tpl", {
    aws_elb_service_account = data.aws_elb_service_account.current.arn,
    s3_bucket = "${var.environment}-${data.aws_region.current.name}-alb-s3-logging"
  })
}

Screenshots

Not applicable here. See error above.

Environment (please complete the following information):

Terraform v1.1.6
on linux_amd64
Initializing plugins and modules...

Additional Context

Add any other context about the problem here.

Hey 👋

This ALB module is awesome, but for our GraphQL server (with subscriptions 😎 ), it'd be essential to have WS target group & security group rule.

Describe the Feature

Add TLS target group & Security Group Rule for TCP access. A simple solution would use the same port for both HTTP and WS

Expected Behavior

Connections from both HTTP, HTTPS, and TCP allowed in through the ALB.

Use Case

Any service that requires both REST & Websocket support on the same endpoint

Describe Ideal Solution

variable "wss_enabled" {
  type        = bool
  description = "Enables WSS target group for ALB"
  default     = false
}

Using variable wss_enabled to add said target group and security group rule

resource "aws_lb_target_group" "wss" {
  count = var.wss_enabled ? 1 : 0

  name                 = var.target_group_name == "" ? module.default_target_group_label.id : var.target_group_name
  port                 = var.target_group_port
  protocol             = "TLS"
  vpc_id               = var.vpc_id
  target_type          = var.target_group_target_type
  deregistration_delay = var.deregistration_delay

  health_check {
    path                = var.health_check_path
  }

  dynamic "stickiness" {
    for_each = var.stickiness == null ? [] : [var.stickiness]
    content {
      type            = "lb_cookie"
      cookie_duration = stickiness.value.cookie_duration
      enabled         = var.target_group_protocol == "TCP" ? false : stickiness.value.enabled
    }
  }

  lifecycle {
    create_before_destroy = true
  }

  tags = merge(
    module.default_target_group_label.tags,
    var.target_group_additional_tags
  )
}

This is my first feature request on terraform modules, please advise if my request is not pertinent. 🙇

Thanks 👋

There is one resource that's stays up and prevents it.

│ Error: error creating ELBv2 Listener (): ValidationError: A load balancer ARN must be specified
│       status code: 400, request id: f12c688c-df3a-4018-a5ae-1d2b6ac52036
│ 

Fixing it would require adding module.context.enabled to count

The Bug

When modifying target group parameters and the target group has to be replaced, terraform apply fails.

Error: error creating LB Target Group: DuplicateTargetGroupName: A target group with the same name 'test-web-application-default' exists, but with different settings
        status code: 400, request id: [redacted]

Expected Behavior

The target group should be replaced without errors

Steps to Reproduce

1. Provision module
2. Update any target group parameters that will force the target group to be replaced ( target_group_port, target_group_protocol, target_group_target_type )
3. terraform apply

Relevant Output

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place
-/+ destroy and then create replacement
+/- create replacement and then destroy

Terraform will perform the following actions:

  # module.test_web_application.aws_security_group_rule.ingress must be replaced
-/+ resource "aws_security_group_rule" "ingress" {
      - cidr_blocks              = [] -> null
      ~ from_port                = 80 -> 8080 # forces replacement
      ~ id                       = "sgrule-19963884" -> (known after apply)
      - ipv6_cidr_blocks         = [] -> null
      - prefix_list_ids          = [] -> null
      ~ to_port                  = 80 -> 8080 # forces replacement
        # (5 unchanged attributes hidden)
    }

  # module.test_web_application.module.web_application.aws_lb_listener.https[0] will be updated in-place
  ~ resource "aws_lb_listener" "https" {
        id                = "arn:aws:elasticloadbalancing:[redacted-region:redacted-account-id]:listener/app/test-web-application/9414d30cd6743a52/264e2cdfabc4d33a"
        tags              = {}
        # (7 unchanged attributes hidden)

      ~ default_action {
          ~ target_group_arn = "arn:aws:elasticloadbalancing:[redacted-region:redacted-account-id]:targetgroup/test-web-application-default/ba3a15c19f97afcc" -> (known after apply)
            # (2 unchanged attributes hidden)
        }
    }

  # module.test_web_application.module.web_application.aws_lb_target_group.default[0] must be replaced
+/- resource "aws_lb_target_group" "default" {
      ~ arn                                = "arn:aws:elasticloadbalancing:[redacted-region:redacted-account-id]:targetgroup/test-web-application-default/ba3a15c19f97afcc" -> (known after apply)
      ~ arn_suffix                         = "targetgroup/test-web-application-default/ba3a15c19f97afcc" -> (known after apply)
      ~ id                                 = "arn:aws:elasticloadbalancing:[redacted-region:redacted-account-id]:targetgroup/test-web-application-default/ba3a15c19f97afcc" -> (known after apply)
      ~ load_balancing_algorithm_type      = "round_robin" -> (known after apply)
        name                               = "test-web-application-default"
      ~ port                               = 80 -> 8080 # forces replacement
      + preserve_client_ip                 = (known after apply)
      ~ protocol_version                   = "HTTP1" -> (known after apply)
        tags                               = {
            "Attributes"  = "default"
            "Environment" = "test"
            "Name"        = "test-web-application-default"
        }
        # (8 unchanged attributes hidden)


      ~ stickiness {
            # (3 unchanged attributes hidden)
        }
        # (1 unchanged block hidden)
    }

Plan: 2 to add, 1 to change, 2 to destroy.

module.test_web_application.aws_security_group_rule.ingress: Destroying... [id=sgrule-19963884]
module.test_web_application.module.web_application.aws_lb_target_group.default[0]: Creating...
module.test_web_application.aws_security_group_rule.ingress: Destruction complete after 1s
module.test_web_application.aws_security_group_rule.ingress: Creating...
module.test_web_application.aws_security_group_rule.ingress: Creation complete after 1s [id=sgrule-1287932633]

Error: error creating LB Target Group: DuplicateTargetGroupName: A target group with the same name 'test-web-application-default' exists, but with different settings
        status code: 400, request id: [redacted]

Environment

• OS: macOS 12.0.1
• Terraform Version : v0.14.5
• Module Version : 0.35.3

Additional Context

I suspect this happens because the resource has a create_before_destroy lifecycle and uses a name argument when it should be using a name_prefix.

Orphaned target group(default) is created when i use "fixed response" for both listeners, http and https..

Describe the Bug

Create an ALB and plan it, and you will get 15 warnings about deprecated S3 arguments. Example:

Warning: Argument is deprecated
with module.project_module.module.alb.module.access_logs.module.s3_bucket.aws_s3_bucket.default
on .terraform/modules/project_module.alb.access_logs.s3_bucket/main.tf line 1, in resource "aws_s3_bucket" "default":

resource "aws_s3_bucket" "default" {

Use the aws_s3_bucket_lifecycle_configuration resource instead

Expected Behavior

No warnings.

Steps to Reproduce

provider "aws" {
  region = var.region
}

# Fetch the pre-existing domain certificate
data "aws_acm_certificate" "domain_cert" {
  domain      = var.domain
  statuses    = ["ISSUED"]
  most_recent = true
}

module "alb" {
  source  = "cloudposse/alb/aws"
  version = "1.1.0"

  attributes = ["alb"]
  tags       = { "declaration" : "alb" }

  vpc_id             = module.vpc.vpc_id
  security_group_ids = [module.vpc.vpc_default_security_group_id]
  subnet_ids         = module.subnets.public_subnet_ids
  internal           = false

  target_group_port = 5000
  http2_enabled   = true
  https_enabled   = true
  certificate_arn = data.aws_acm_certificate.domain_cert.arn
  http_redirect   = true

  access_logs_enabled                     = true
  alb_access_logs_s3_bucket_force_destroy = true
  cross_zone_load_balancing_enabled       = true
  deletion_protection_enabled             = false

  health_check_interval = 30

  context = module.this.context
}

Screenshots

Environment (please complete the following information):

I'm using Terraform Cloud with Terraform 1.1.9

Additional Context

This is presumably related to the changes to the AWS 4 provider. terraform-aws-s3-bucket has been updated (latest version 2.0.1) but the module this module relies upon (aws-lb-s3-bucket) hasn't been updated.

First, awesome module! Given how much it does, I was wondering if it'd be useful to add support for applying basic lifecycle management to the s3 bucket created for ALB logs.

On the one hand, this feels natural to manage in one place since the module is already creating the bucket. On the other hand, given the options for storage tiers/retention/etc it might be a clumsy interface.

Just tossing it out for consideration... If this isn't something you want to include, do you handle this in a common way? Perhaps a one-off resource operating on the module's bucket arn containing only the lifecycle policy?

Describe the Bug

In AWS provider 5.35.0 released 2/1/24 if you have a target group arn on a listener with type 'redirect' it will give this warning:

│ Warning: Invalid Attribute Combination
│
│   with module.alb.aws_lb_listener.http_redirect[0],
│   on .terraform/modules/alb/main.tf line 183, in resource "aws_lb_listener" "http_redirect":
│  183:     target_group_arn = one(aws_lb_target_group.default[*].arn)
│
│ Attribute "default_action[0].target_group_arn" cannot be specified when "default_action[0].type" is "redirect".
│
│ This will be an error in a future release.

Expected Behavior

No warnings (or future errors) when deploying a redirect listener.

Steps to Reproduce

Upgrade to AWS provider 5.35.0 and attempt to deploy an ALB with a redirect listener.

Screenshots

No response

Environment

No response

Additional Context

No response

Describe the Bug

Similar to #103. When access_logs_s3_bucket_id = "bucketname" is set on this module, it produces the following error:

Error: Invalid count argument

  on .terraform/modules/alb.access_logs.s3_bucket/main.tf line 163, in resource "aws_s3_bucket_policy" "default":
 163:   count      = module.this.enabled && (var.allow_ssl_requests_only || var.allow_encrypted_uploads_only || var.policy != "") ? 1 : 0

The "count" value depends on resource attributes that cannot be determined
until apply, so Terraform cannot predict how many instances will be created.
To work around this, use the -target argument to first apply only the
resources that the count depends on.

Expected Behavior

It should produce a valid plan.

Steps to Reproduce

Steps to reproduce the behavior:

1. Run init and apply on the .tf file below
2. The first time this runs, it says there are no changes, but each subsequent apply, will yield the error above
3. Run apply again
4. See error

Environment (please complete the following information):

$ terraform version
Terraform v0.13.7
+ provider registry.terraform.io/hashicorp/aws v3.74.2

Additional Context

Here's a simple .tf file to reproduce the issue

variable "vpc_id" {
  type        = string
  description = "The VPC ID"
}

variable "subnet_ids" {
  type        = list(string)
  description = "The Subnet IDs"
  default     = []
}

variable "bucket_id" {
  type        = string
  description = "The S3 Bucket ID"
}

variable "security_group_ids" {
  type        = list(string)
  description = "The Security Group IDs"
}

module "label" {
  source    = "cloudposse/label/null"
  version   = "0.25.0"
  namespace = "my"
  name      = "alb"
  stage     = "test"
}

module "alb" {
  source  = "cloudposse/alb/aws"
  version = "1.0.0"

  context    = module.label.context
  subnet_ids = var.subnet_ids
  vpc_id     = var.vpc_id

  access_logs_s3_bucket_id                = var.bucket_id
  access_logs_prefix                      = "${module.label.namespace}"
  alb_access_logs_s3_bucket_force_destroy = true
  deletion_protection_enabled             = true
  target_group_port                       = 8080
  internal                                = true
  health_check_path                       = "/health"
  target_group_name                       = module.label.id # Needed as our default name is too long.
  drop_invalid_header_fields              = true
  security_group_enabled                  = false
  security_group_ids                      = var.security_group_ids
}

on init with the new terraform version i receive the following error:

Error: Unsupported Terraform Core version

This configuration does not support Terraform version 0.12.1. To proceed,
either choose another supported Terraform version or update the root module's
version constraint. Version constraints are normally set for good reason, so
updating the constraint may lead to other errors or unexpected behavior.

is there any plan to support version 0.12 and above?

Describe the Feature

Apply fails since there are over 100 CIDRs to set on a single security group as it is now.

Expected Behavior

Rules should be split in groups of 50 let's say and multiple security groups created and assigned then to the ALB.

Use Case

Restrict ALB ingress to CloudFront IPs.

Describe Ideal Solution

Create multiple security groups based on limit of 60 rules per security group.

Alternatives Considered

Create separate security groups based on chunklist(data.aws_ip_ranges.cloudfront.cidr_blocks, 50) and pass them as list to security_group_ids.

Additional Context

Have a question? Please checkout our Slack Community or visit our Slack Archive.

Describe the Feature

Tag all the listeners aws_lb_listener

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener#tags

Describe the Feature

Simple consolidate of two resources that could be done. See conversation here: #140 (comment)

Expected Behavior

One resource is set up for the HTTP protocol and the variables drive how that is configured.

Use Case

Simpler module, less resources.

Describe Ideal Solution

Simpler module, less resources.

Alternatives Considered

No response

Additional Context

No response