alb.tf-OLD

###
### ECS Service ALB
###

data "aws_acm_certificate" "alb" {
  count    = "${var.alb_enable_https ? 1 : 0}"
  domain   = "${var.acm_cert_domain}"
  statuses = ["ISSUED"]
}

# TODO: Change to use LB module
resource "aws_alb" "service" {
  count           = "${(var.alb_enable_https || var.alb_enable_http) ? 1 : 0}"
  name            = "${module.label.name}"
  internal        = "${var.alb_internal}"
  security_groups = ["${aws_security_group.alb.id}"]
  subnets         = ["${var.alb_subnet_ids}"]

  tags {
    Application = "${aws_ecs_task_definition.task.family}"
  }
}

resource "aws_alb_listener" "service_https" {
  count             = "${var.alb_enable_https ? 1 : 0}"
  load_balancer_arn = "${aws_alb.service.arn}"
  port              = "443"
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-2015-05"
  certificate_arn   = "${data.aws_acm_certificate.alb.arn}"

  default_action {
    target_group_arn = "${aws_alb_target_group.service.arn}"
    type             = "forward"
  }
}

resource "aws_alb_listener" "service_http" {
  count             = "${var.alb_enable_http ? 1 : 0}"
  load_balancer_arn = "${aws_alb.service.arn}"
  port              = "80"
  protocol          = "HTTP"

  default_action {
    target_group_arn = "${aws_alb_target_group.service.arn}"
    type             = "forward"
  }
}

resource "aws_alb_target_group" "service" {
  name     = "${module.label.name}"
  port     = "${var.app_port}"
  protocol = "HTTP"
  vpc_id   = "${var.vpc_id}"

  health_check {
    interval            = "${var.alb_healthcheck_interval}"
    path                = "${var.alb_healthcheck_path}"
    port                = "${var.alb_healthcheck_port}"
    protocol            = "${var.alb_healthcheck_protocol}"
    timeout             = "${var.alb_healthcheck_timeout}"
    healthy_threshold   = "${var.alb_healthcheck_healthy_threshold}"
    unhealthy_threshold = "${var.alb_healthcheck_unhealthy_threshold}"
    matcher             = "${var.alb_healthcheck_matcher}"
  }

  stickiness {
    enabled         = "${var.alb_stickiness_enabled}"
    type            = "lb_cookie"
    cookie_duration = "${var.alb_cookie_duration}"
  }

  tags {
    Application = "${aws_ecs_task_definition.task.family}"
  }
}

# TODO: Use security group module
resource "aws_security_group" "alb" {
  count       = "${(var.alb_enable_https || var.alb_enable_http) ? 1 : 0}"
  name_prefix = "alb-${module.label.name}-"
  description = "Security group for ${module.label.name} ALB"
  vpc_id      = "${var.vpc_id}"

  tags {
    Application = "${aws_ecs_task_definition.task.family}"
  }
}

resource "aws_security_group_rule" "alb_ingress_https" {
  count             = "${var.alb_enable_https ? 1 : 0}"
  type              = "ingress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = "${aws_security_group.alb.id}"
}

resource "aws_security_group_rule" "alb_ingress_http" {
  count             = "${var.alb_enable_http ? 1 : 0}"
  type              = "ingress"
  from_port         = 80
  to_port           = 80
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = "${aws_security_group.alb.id}"
}

resource "aws_security_group_rule" "alb_egress" {
  count                    = "${(var.alb_enable_https || var.alb_enable_http) ? 1 : 0}"
  type                     = "egress"
  from_port                = 0
  to_port                  = 65535
  protocol                 = "-1"
  source_security_group_id = "${var.ecs_security_group_id}"
  security_group_id        = "${aws_security_group.alb.id}"
}