Application Load Balancer

Why it mattersCopy Anchor Link

The load balancer is the one public address users reach. It upgrades every plain HTTP request to HTTPS, sends traffic only to copies of the app that pass a health check, and drops malformed headers before they reach the code. Federal stacks change one setting to get a FIPS 140-3 TLS policy, and that policy exists in both commercial AWS and GovCloud.

Use it whenCopy Anchor Link

• An app on ecs-service needs a public HTTPS endpoint with an ACM certificate.
• An internal tool needs a private HTTPS endpoint. Set internal = true and pass private subnets.

Reach for something else whenCopy Anchor Link

• The app is a static site with no server. Serve it from S3 behind CloudFront instead. Use s3-bucket.
• You need request filtering, rate limits, or IP allowlists. Add a web ACL on top of this load balancer. Use waf.

What it createsCopy Anchor Link

• aws_security_group (ports 80 and 443 from allowed_cidr_blocks, 443 from allowed_security_group_ids)
• aws_lb (application type, deletion protection on)
• aws_lb_target_group (ip targets, health check on health_check_path)
• aws_lb_listener (HTTP on 80, 301 redirect to HTTPS)
• aws_lb_listener (HTTPS on 443 with ssl_policy and certificate_arn)

Secure by defaultCopy Anchor Link

• HTTP on port 80 always answers with a 301 redirect to HTTPS.
• Deletion protection is on (enable_deletion_protection = true).
• Invalid HTTP header fields are dropped (drop_invalid_header_fields = true, not configurable).
• The HTTPS listener uses ELBSecurityPolicy-TLS13-1-2-Res-2021-06, which allows TLS 1.2 and TLS 1.3 only.

Commercial and GovCloudCopy Anchor Link

module "alb" {
  source = "git::ssh://git@github.com/the-kaizen-labs/terraform-modules.git//alb?ref=v1.7.0"

  app_name          = local.app_name
  vpc_id            = module.networking.vpc_id
  public_subnet_ids = module.networking.public_subnet_ids
  certificate_arn   = local.certificate_arn
  container_port    = 3000
  health_check_path = "/api/health"

  tags = local.tags
}

How it connectsCopy Anchor Link

• From networking: vpc_id, public_subnet_ids
• From s3-bucket: bucket_name (as access_logs_bucket)
• To ecs-service: target_group_arn, alb_security_group_id
• To waf: alb_arn
• To bastion: alb_dns_name (as tls_passthrough_target)

InputsCopy Anchor Link

OutputsCopy Anchor Link

Used byCopy Anchor Link