1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

# Cross-variable guardrails =====================================================
# validation blocks can only see the variable they're attached to, so anything
# spanning load_balancer_type + another variable is enforced here instead.

check "nlb_no_alb_only_listener_features" {
  assert {
    condition = local.is_alb || alltrue([
      for k, v in var.listeners : v.redirect == null
    ])
    error_message = <<-EOT
      One or more listeners set 'redirect', which is not supported on
      network load balancers.
    EOT
  }
}

check "alb_no_nlb_only_stickiness" {
  assert {
    condition = alltrue([
      for k, v in var.target_groups :
      v.stickiness == null || local.is_alb || v.stickiness.type == "source_ip"
    ])
    error_message = <<-EOT
      One or more target groups set stickiness.type other than 'source_ip'
      on a network load balancer.
    EOT
  }
}

check "alb_target_group_protocol" {
  assert {
    condition = alltrue([
      for k, v in var.target_groups :
      !local.is_alb || contains(["HTTP", "HTTPS"], v.protocol)
    ])
    error_message = <<-EOT
      One or more target groups use a non-HTTP(S) protocol on an
      application load balancer.
    EOT
  }
}

check "nlb_target_group_protocol" {
  assert {
    condition = alltrue([
      for k, v in var.target_groups :
      !local.is_nlb || contains(["TCP", "UDP", "TCP_UDP", "TLS"], v.protocol)
    ])
    error_message = <<-EOT
      One or more target groups use an HTTP(S) protocol on a network load
      balancer — use TCP, UDP, TCP_UDP, or TLS.
    EOT
  }
}

check "waf_only_on_alb" {
  assert {
    condition     = var.waf_web_acl_arn == null || local.is_alb
    error_message = <<-EOT
      waf_web_acl_arn was set but load_balancer_type is network — WAFv2
      does not support NLB as an association target.
    EOT
  }
}

check "ip_targets_require_port" {
  assert {
    condition = alltrue([
      for tg_key, tg in var.target_groups :
      tg.target_type != "ip" || alltrue([
        for target_key, target in tg.targets : target.port != null
      ])
    ])
    error_message = <<-EOT
      Targets on an ip-type target group must set an explicit port — AWS
      requires it when target_type is 'ip'.
    EOT
  }
}

check "security_group_count_within_default_quota" {
  assert {
    condition     = length(var.security_group_ids) <= 5
    error_message = <<-EOT
      security_group_ids has more than 5 entries. AWS's default per-ENI
      security group quota is 5 (soft limit). If your account has a raised
      quota, this check is being overly cautious — otherwise apply will
      fail at the AWS API. Verify your account's actual quota before
      proceeding.
    EOT
  }
}