Update cn-terraform/ecs-alb/aws to 1.0.36 (#109)

Author: nickreynke

README.md

@@ -66,7 +66,7 @@ In order to run all checks at any point run the following command:
 
 | Name | Source | Version |
 |------|--------|---------|
-| <a name="module_ecs-alb"></a> [ecs-alb](#module\_ecs-alb) | cn-terraform/ecs-alb/aws | 1.0.35 |
+| <a name="module_ecs-alb"></a> [ecs-alb](#module\_ecs-alb) | cn-terraform/ecs-alb/aws | 1.0.36 |
 | <a name="module_ecs-autoscaling"></a> [ecs-autoscaling](#module\_ecs-autoscaling) | cn-terraform/ecs-service-autoscaling/aws | 1.0.10 |
 
 ## Resources
@@ -113,10 +113,10 @@ In order to run all checks at any point run the following command:
 | <a name="input_lb_enable_http2"></a> [lb\_enable\_http2](#input\_lb\_enable\_http2) | (Optional) Indicates whether HTTP/2 is enabled in the load balancer. Defaults to true. | `bool` | `true` | no |
 | <a name="input_lb_http_ingress_cidr_blocks"></a> [lb\_http\_ingress\_cidr\_blocks](#input\_lb\_http\_ingress\_cidr\_blocks) | List of CIDR blocks to allowed to access the Load Balancer through HTTP | `list(string)` | <pre>[<br/>  "0.0.0.0/0"<br/>]</pre> | no |
 | <a name="input_lb_http_ingress_prefix_list_ids"></a> [lb\_http\_ingress\_prefix\_list\_ids](#input\_lb\_http\_ingress\_prefix\_list\_ids) | List of prefix list IDs blocks to allowed to access the Load Balancer through HTTP | `list(string)` | `[]` | no |
-| <a name="input_lb_http_ports"></a> [lb\_http\_ports](#input\_lb\_http\_ports) | Map containing objects to define listeners behaviour based on type field. If type field is `forward`, include listener\_port and the target\_group\_port. For `redirect` type, include listener port, host, path, port, protocol, query and status\_code. For `fixed-response`, include listener\_port, content\_type, message\_body and status\_code | <pre>map(object({<br/>    type = optional(string)<br/><br/>    listener_port     = number<br/>    target_group_port = number<br/><br/>    target_group_protocol         = optional(string, "HTTP")<br/>    target_group_protocol_version = optional(string, "HTTP1") # HTTP1, HTTP2 or GRPC<br/><br/>    # Health check options, overriding default values provided as module variables<br/>    target_group_health_check_enabled             = optional(bool)<br/>    target_group_health_check_interval            = optional(number)<br/>    target_group_health_check_path                = optional(string)<br/>    target_group_health_check_port                = optional(string)<br/>    target_group_health_check_protocol            = optional(string, "HTTP")<br/>    target_group_health_check_timeout             = optional(number)<br/>    target_group_health_check_healthy_threshold   = optional(number)<br/>    target_group_health_check_unhealthy_threshold = optional(number)<br/>    target_group_health_check_matcher             = optional(string)<br/><br/>    host         = optional(string, "#{host}")<br/>    path         = optional(string, "/#{path}")<br/>    port         = optional(string, "#{port}")<br/>    protocol     = optional(string, "#{protocol}")<br/>    query        = optional(string, "#{query}")<br/>    status_code  = optional(string) # Default for `type=redirect`: "HTTP_301". Default for `type=fixed-response`: "200".<br/>    content_type = optional(string, "text/plain")<br/>    message_body = optional(string, "Fixed response content")<br/>  }))</pre> | <pre>{<br/>  "default": {<br/>    "listener_port": 80,<br/>    "target_group_port": 80,<br/>    "type": "forward"<br/>  }<br/>}</pre> | no |
+| <a name="input_lb_http_ports"></a> [lb\_http\_ports](#input\_lb\_http\_ports) | Map containing objects to define listeners behaviour based on type field. If type field is `forward`, include listener\_port and the target\_group\_port. For `redirect` type, include listener\_port, host, path, port, protocol, query and status\_code. For `fixed-response`, include listener\_port, content\_type, message\_body and status\_code | <pre>map(object({<br/>    type = optional(string)<br/><br/>    listener_port = number<br/><br/>    target_group_port             = optional(number)<br/>    target_group_protocol         = optional(string, "HTTP")<br/>    target_group_protocol_version = optional(string, "HTTP1") # HTTP1, HTTP2 or GRPC<br/><br/>    # Health check options, overriding default values provided as module variables<br/>    target_group_health_check_enabled             = optional(bool)<br/>    target_group_health_check_interval            = optional(number)<br/>    target_group_health_check_path                = optional(string)<br/>    target_group_health_check_port                = optional(string)<br/>    target_group_health_check_protocol            = optional(string, "HTTP")<br/>    target_group_health_check_timeout             = optional(number)<br/>    target_group_health_check_healthy_threshold   = optional(number)<br/>    target_group_health_check_unhealthy_threshold = optional(number)<br/>    target_group_health_check_matcher             = optional(string)<br/><br/>    host         = optional(string, "#{host}")<br/>    path         = optional(string, "/#{path}")<br/>    port         = optional(string, "#{port}")<br/>    protocol     = optional(string, "#{protocol}")<br/>    query        = optional(string, "#{query}")<br/>    status_code  = optional(string) # Default for `type=redirect`: "HTTP_301". Default for `type=fixed-response`: "200".<br/>    content_type = optional(string, "text/plain")<br/>    message_body = optional(string, "Fixed response content")<br/>  }))</pre> | <pre>{<br/>  "default": {<br/>    "listener_port": 80,<br/>    "target_group_port": 80,<br/>    "type": "forward"<br/>  }<br/>}</pre> | no |
 | <a name="input_lb_https_ingress_cidr_blocks"></a> [lb\_https\_ingress\_cidr\_blocks](#input\_lb\_https\_ingress\_cidr\_blocks) | List of CIDR blocks to allowed to access the Load Balancer through HTTPS | `list(string)` | <pre>[<br/>  "0.0.0.0/0"<br/>]</pre> | no |
 | <a name="input_lb_https_ingress_prefix_list_ids"></a> [lb\_https\_ingress\_prefix\_list\_ids](#input\_lb\_https\_ingress\_prefix\_list\_ids) | List of prefix list IDs blocks to allowed to access the Load Balancer through HTTPS | `list(string)` | `[]` | no |
-| <a name="input_lb_https_ports"></a> [lb\_https\_ports](#input\_lb\_https\_ports) | Map containing objects to define listeners behaviour based on type field. If type field is `forward`, include listener\_port and the target\_group\_port. For `redirect` type, include listener port, host, path, port, protocol, query and status\_code. For `fixed-response`, include listener\_port, content\_type, message\_body and status\_code | <pre>map(object({<br/>    type = optional(string)<br/><br/>    listener_port     = number<br/>    target_group_port = number<br/><br/>    target_group_protocol         = optional(string, "HTTP")<br/>    target_group_protocol_version = optional(string, "HTTP1") # HTTP1, HTTP2 or GRPC<br/><br/>    # Health check options, overriding default values provided as module variables<br/>    target_group_health_check_enabled             = optional(bool)<br/>    target_group_health_check_interval            = optional(number)<br/>    target_group_health_check_path                = optional(string)<br/>    target_group_health_check_port                = optional(string)<br/>    target_group_health_check_protocol            = optional(string, "HTTP")<br/>    target_group_health_check_timeout             = optional(number)<br/>    target_group_health_check_healthy_threshold   = optional(number)<br/>    target_group_health_check_unhealthy_threshold = optional(number)<br/>    target_group_health_check_matcher             = optional(string)<br/><br/>    host         = optional(string, "#{host}")<br/>    path         = optional(string, "/#{path}")<br/>    port         = optional(string, "#{port}")<br/>    protocol     = optional(string, "#{protocol}")<br/>    query        = optional(string, "#{query}")<br/>    status_code  = optional(string) # Default for `type=redirect`: "HTTP_301". Default for `type=fixed-response`: "200".<br/>    content_type = optional(string, "text/plain")<br/>    message_body = optional(string, "Fixed response content")<br/>  }))</pre> | <pre>{<br/>  "default-https": {<br/>    "listener_port": 443,<br/>    "target_group_port": 443,<br/>    "type": "forward"<br/>  }<br/>}</pre> | no |
+| <a name="input_lb_https_ports"></a> [lb\_https\_ports](#input\_lb\_https\_ports) | Map containing objects to define listeners behaviour based on type field. If type field is `forward`, include listener\_port and the target\_group\_port. For `redirect` type, include listener\_port, host, path, port, protocol, query and status\_code. For `fixed-response`, include listener\_port, content\_type, message\_body and status\_code | <pre>map(object({<br/>    type = optional(string)<br/><br/>    listener_port = number<br/><br/>    target_group_port             = optional(number)<br/>    target_group_protocol         = optional(string, "HTTP")<br/>    target_group_protocol_version = optional(string, "HTTP1") # HTTP1, HTTP2 or GRPC<br/><br/>    # Health check options, overriding default values provided as module variables<br/>    target_group_health_check_enabled             = optional(bool)<br/>    target_group_health_check_interval            = optional(number)<br/>    target_group_health_check_path                = optional(string)<br/>    target_group_health_check_port                = optional(string)<br/>    target_group_health_check_protocol            = optional(string, "HTTP")<br/>    target_group_health_check_timeout             = optional(number)<br/>    target_group_health_check_healthy_threshold   = optional(number)<br/>    target_group_health_check_unhealthy_threshold = optional(number)<br/>    target_group_health_check_matcher             = optional(string)<br/><br/>    host         = optional(string, "#{host}")<br/>    path         = optional(string, "/#{path}")<br/>    port         = optional(string, "#{port}")<br/>    protocol     = optional(string, "#{protocol}")<br/>    query        = optional(string, "#{query}")<br/>    status_code  = optional(string) # Default for `type=redirect`: "HTTP_301". Default for `type=fixed-response`: "200".<br/>    content_type = optional(string, "text/plain")<br/>    message_body = optional(string, "Fixed response content")<br/>  }))</pre> | <pre>{<br/>  "default-https": {<br/>    "listener_port": 443,<br/>    "target_group_port": 443,<br/>    "type": "forward"<br/>  }<br/>}</pre> | no |
 | <a name="input_lb_idle_timeout"></a> [lb\_idle\_timeout](#input\_lb\_idle\_timeout) | (Optional) The time in seconds that the connection is allowed to be idle. Default: 60. | `number` | `60` | no |
 | <a name="input_lb_internal"></a> [lb\_internal](#input\_lb\_internal) | (Optional) If true, the LB will be internal. | `bool` | `false` | no |
 | <a name="input_lb_ip_address_type"></a> [lb\_ip\_address\_type](#input\_lb\_ip\_address\_type) | (Optional) The type of IP addresses used by the subnets for your load balancer. The possible values are ipv4 and dualstack. Defaults to ipv4 | `string` | `"ipv4"` | no |

main.tf

@@ -5,7 +5,7 @@ module "ecs-alb" {
   count = var.custom_lb_arn == null ? 1 : 0
 
   source  = "cn-terraform/ecs-alb/aws"
-  version = "1.0.35"
+  version = "1.0.36"
 
   name_prefix = var.name_prefix
   vpc_id      = var.vpc_id

variables.tf

@@ -306,13 +306,13 @@ variable "waf_web_acl_arn" {
 # ACCESS CONTROL TO APPLICATION LOAD BALANCER
 #------------------------------------------------------------------------------
 variable "lb_http_ports" {
-  description = "Map containing objects to define listeners behaviour based on type field. If type field is `forward`, include listener_port and the target_group_port. For `redirect` type, include listener port, host, path, port, protocol, query and status_code. For `fixed-response`, include listener_port, content_type, message_body and status_code"
+  description = "Map containing objects to define listeners behaviour based on type field. If type field is `forward`, include listener_port and the target_group_port. For `redirect` type, include listener_port, host, path, port, protocol, query and status_code. For `fixed-response`, include listener_port, content_type, message_body and status_code"
   type = map(object({
     type = optional(string)
 
-    listener_port     = number
-    target_group_port = number
+    listener_port = number
 
+    target_group_port             = optional(number)
     target_group_protocol         = optional(string, "HTTP")
     target_group_protocol_version = optional(string, "HTTP1") # HTTP1, HTTP2 or GRPC
 
@@ -343,6 +343,14 @@ variable "lb_http_ports" {
       target_group_port = 80
     }
   }
+  validation {
+    condition     = alltrue([for _, v in var.lb_http_ports : v.type != "forward" || v.target_group_port != null])
+    error_message = "target_group_port must be set if type is forward"
+  }
+  validation {
+    condition     = alltrue([for _, v in var.lb_http_ports : (v.type == "redirect" || v.type == "fixed-response") ? v.status_code != null : true])
+    error_message = "status_code must be set if type is redirect or fixed-response"
+  }
 }
 
 variable "lb_http_ingress_cidr_blocks" {
@@ -358,13 +366,13 @@ variable "lb_http_ingress_prefix_list_ids" {
 }
 
 variable "lb_https_ports" {
-  description = "Map containing objects to define listeners behaviour based on type field. If type field is `forward`, include listener_port and the target_group_port. For `redirect` type, include listener port, host, path, port, protocol, query and status_code. For `fixed-response`, include listener_port, content_type, message_body and status_code"
+  description = "Map containing objects to define listeners behaviour based on type field. If type field is `forward`, include listener_port and the target_group_port. For `redirect` type, include listener_port, host, path, port, protocol, query and status_code. For `fixed-response`, include listener_port, content_type, message_body and status_code"
   type = map(object({
     type = optional(string)
 
-    listener_port     = number
-    target_group_port = number
+    listener_port = number
 
+    target_group_port             = optional(number)
     target_group_protocol         = optional(string, "HTTP")
     target_group_protocol_version = optional(string, "HTTP1") # HTTP1, HTTP2 or GRPC
 
@@ -395,6 +403,14 @@ variable "lb_https_ports" {
       target_group_port = 443
     }
   }
+  validation {
+    condition     = alltrue([for _, v in var.lb_https_ports : v.type != "forward" || v.target_group_port != null])
+    error_message = "target_group_port must be set if type is forward"
+  }
+  validation {
+    condition     = alltrue([for _, v in var.lb_https_ports : (v.type == "redirect" || v.type == "fixed-response") ? v.status_code != null : true])
+    error_message = "status_code must be set if type is redirect or fixed-response"
+  }
 }
 
 variable "lb_https_ingress_cidr_blocks" {