lb-standard

Creates an Application or Network Load Balancer with target groups, listeners, and target attachments.

Provisions a single load balancer along with its target groups, listeners, and target group attachments, supporting both ALB and NLB through one interface. Cross-variable checks enforce the constraints each load balancer type imposes: NLB does not support redirect actions or WAF association, and ALB/NLB differ on which target group protocols and stickiness types are valid. Security groups are supported on both ALB and NLB (NLB security groups govern traffic into the load balancer's ENIs — target-side security groups on the backend instances are managed separately, outside this module).

Usage

Application Load Balancer

module "lb_standard" {
  source  = "hcassc.jfrog.io/iac-tf-modules-virtual__compute/lb-standard/aws"
  version = "0.1.0"

  name_prefix = "acme-prod-web"
  name_suffix = "public"

  load_balancer_type = "application"
  subnet_ids          = ["subnet-0aaa111122223333", "subnet-0bbb444455556666"]
  security_group_ids  = ["sg-0123456789abcdef0"]

  target_groups = {
    web = {
      name_suffix = "web"
      port        = 443
      protocol    = "HTTPS"
      vpc_id      = "vpc-0123456789abcdef0"
    }
  }

  listeners = {
    https = {
      port              = 443
      protocol          = "HTTPS"
      certificate_arn   = "arn:aws:acm:ap-south-1:123456789012:certificate/example"
      target_group_key  = "web"
    }
  }
}

Network Load Balancer with target attachments

module "lb_standard" {
  source  = "hcassc.jfrog.io/iac-tf-modules-virtual__compute/lb-standard/aws"
  version = "0.1.0"

  name_prefix = "acme-prod-dc"
  name_suffix = "ldaps"

  load_balancer_type = "network"
  internal            = true
  subnet_ids          = ["subnet-0aaa111122223333", "subnet-0bbb444455556666"]
  security_group_ids  = ["sg-0123456789abcdef0"]

  cross_zone_load_balancing = true

  target_groups = {
    ldaps = {
      name_suffix = "ldaps"
      port        = 636
      protocol    = "TCP"
      target_type = "ip"
      vpc_id      = "vpc-0123456789abcdef0"

      targets = {
        dc1 = { id = "10.0.1.10", port = 636 }
        dc2 = { id = "10.0.2.10", port = 636 }
      }

      health_check = {
        protocol            = "TCP"
        interval            = 10
        healthy_threshold   = 3
        unhealthy_threshold = 3
      }
    }
  }

  listeners = {
    ldaps_636 = {
      port              = 636
      protocol          = "TCP"
      target_group_key  = "ldaps"
    }
  }
}

Notes

Target attachments are declared inline under each target group's targets map (id + optional port). id is an instance ID when target_type = "instance", or an IP address when target_type = "ip". port is required per-target when target_type = "ip" — enforced by a check block at plan time.
Security groups: this module does not create security groups. security_group_ids attaches existing groups to the load balancer's ENIs. Target-side rules (allowing the load balancer's traffic into backend instances) belong to whatever manages those instances, not this module.
GWLB is out of scope for this module — see lb-gateway for Gateway Load Balancer support.

Requirements

Name	Version
terraform	>= 1.15.0, < 2.0.0
aws	>= 6.0, < 7.0

Providers

Name	Version
aws	>= 6.0, < 7.0

Resources

Name	Type
aws_lb.this	resource
aws_lb_listener.this	resource
aws_lb_target_group.this	resource
aws_lb_target_group_attachment.this	resource
aws_wafv2_web_acl_association.this	resource

Inputs

Name	Description	Type	Default	Required
name_prefix	Prefix prepended to resource names created by this module.	`string`	n/a	yes
name_suffix	Suffix appended to the load balancer resource name to distinguish it within name_prefix.	`string`	n/a	yes
subnet_ids	Subnet IDs for the load balancer. Must span at least two AZs.	`list(string)`	n/a	yes
access_logs_bucket	S3 bucket for access logs (optional).	`string`	`null`	no
access_logs_prefix	S3 prefix for access logs.	`string`	`"lb"`	no
cross_zone_load_balancing	Enable cross-zone load balancing. Valid for NLB only — ALB always has this enabled and it is not configurable.	`bool`	`true`	no
deletion_protection	Enable deletion protection.	`bool`	`true`	no
idle_timeout	Idle timeout in seconds. Valid for ALB only — NLB connections do not have a configurable idle timeout.	`number`	`60`	no
internal	Create an internal (non-internet-facing) load balancer.	`bool`	`false`	no
listeners	Map of load balancer listener definitions.- redirect actions are only valid on ALB listeners — NLB does not support the redirect action type.- certificate_arn is only meaningful for HTTPS/TLS protocol listeners.	map(object({ port = number protocol = string certificate_arn = optional(string, null) ssl_policy = optional(string, "ELBSecurityPolicy-TLS13-1-2-2021-06") default_action_type = optional(string, "forward") target_group_key = optional(string, null) redirect = optional(object({ port = optional(string, "443") protocol = optional(string, "HTTPS") status_code = optional(string, "HTTP_301") }), null) }))	`{}`	no
load_balancer_type	Load balancer type — application or network.	`string`	`"application"`	no
security_group_ids	Security group IDs to attach to the load balancer's ENIs. Supported on ALB always, and on NLB in regions/accounts with the 2023 NLB security groups feature enabled.	`list(string)`	`[]`	no
tags	Tags applied to all resources in this module.	`map(string)`	`{}`	no
target_groups	Map of target group definitions.- name_suffix is combined with name_prefix and region to build the target group name.- protocol must be TCP/UDP/TCP_UDP for NLB target groups, HTTP/HTTPS for ALB.- stickiness.type must be source_ip for NLB, lb_cookie or app_cookie for ALB.- targets is a map of instance IDs (target_type = "instance") or IP addresses (target_type = "ip") to attach. port overrides the target group's port for that specific target; leave null to use the target group's port.	map(object({ name_suffix = string port = number protocol = string target_type = optional(string, "instance") vpc_id = string deregistration_delay = optional(number, 30) tags = optional(map(string), {}) targets = optional(map(object({ id = string port = optional(number, null) })), {}) health_check = optional(object({ enabled = optional(bool, true) path = optional(string, "/health") protocol = optional(string, "HTTP") matcher = optional(string, "200") interval = optional(number, 30) timeout = optional(number, 5) healthy_threshold = optional(number, 2) unhealthy_threshold = optional(number, 2) }), {}) stickiness = optional(object({ enabled = optional(bool, false) cookie_duration = optional(number, 86400) type = optional(string, "lb_cookie") }), null) }))	`{}`	no
waf_web_acl_arn	WAF Web ACL ARN to associate with the load balancer. Valid for ALB only — WAFv2 does not support NLB as an association target.	`string`	`null`	no

Outputs

Name	Description
arn	Load balancer ARN.
dns_name	DNS name of the load balancer.
id	Load balancer ID.
listener_arns	Map of listener logical key to ARN.
name	Generated load balancer name.
target_attachment_ids	Map of flattened attachment key (target_group_key-target_key) to the target_id that was attached.
target_group_arns	Map of target group logical key to ARN.
target_group_health_checks	Map of target group logical key to its resolved health check config, for troubleshooting unhealthy targets without opening the console.
target_group_names	Map of target group logical key to generated name.
zone_id	Hosted zone ID of the load balancer (for Route53 alias records).