An Application Load Balancer (with Optional HTTPS)

1. 1

   Load balancer and target group

   The ALB spans both public subnets. drop_invalid_header_fields is a free hardening setting. The target group uses name_prefix (at most 6 characters) with create_before_destroy, because target groups can't be replaced while a listener points at them. The health check marks a task healthy after 2 passing checks 15 seconds apart. deregistration_delay = 30 lets in-flight requests finish during deploys without waiting the default 5 minutes.

   resource "aws_lb" "main" {
     name                       = "${local.name_prefix}-alb"
     load_balancer_type         = "application"
     security_groups            = [aws_security_group.alb.id]
     subnets                    = [for s in aws_subnet.public : s.id]
     drop_invalid_header_fields = true
   }
   
   resource "aws_lb_target_group" "api" {
     name_prefix          = "api-"
     port                 = var.app_port
     protocol             = "HTTP"
     target_type          = "ip"
     vpc_id               = aws_vpc.main.id
     deregistration_delay = 30
   
     health_check {
       path                = "/healthz"
       matcher             = "200"
       interval            = 15
       healthy_threshold   = 2
       unhealthy_threshold = 3
     }
   
     lifecycle {
       create_before_destroy = true
     }
   }

2. 2

   Optional domain variables

   Both default to null. If you own a domain with a Route 53 hosted zone (for example example.com), set hosted_zone_name = "example.com" and domain_name = "api.dev.example.com" in terraform.tfvars. Otherwise leave them out and everything still works over HTTP.

   variable "domain_name" {
     description = "Optional FQDN for the API, e.g. api.dev.example.com. null = HTTP only."
     type        = string
     default     = null
   }
   
   variable "hosted_zone_name" {
     description = "Route 53 public hosted zone that contains domain_name, e.g. example.com."
     type        = string
     default     = null
   }

3. 3

   The HTTP listener: forward or redirect

   One listener, two behaviours. target_group_arn becomes null in redirect mode, and the redirect block only exists in redirect mode, thanks to the dynamic block.

   locals {
     https_enabled = var.domain_name != null
   }
   
   resource "aws_lb_listener" "http" {
     load_balancer_arn = aws_lb.main.arn
     port              = 80
     protocol          = "HTTP"
   
     default_action {
       type             = local.https_enabled ? "redirect" : "forward"
       target_group_arn = local.https_enabled ? null : aws_lb_target_group.api.arn
   
       dynamic "redirect" {
         for_each = local.https_enabled ? [1] : []
         content {
           port        = "443"
           protocol    = "HTTPS"
           status_code = "HTTP_301"
         }
       }
     }
   }

4. 4

   HTTPS: certificate, DNS validation, listener, record

   All count-gated. ACM gives validation records per domain; the for_each map is keyed by domain name, which is known at plan time, so it avoids the unknown-keys trap from Mission 2.2. aws_acm_certificate_validation waits until ACM reports the certificate issued, and the HTTPS listener uses ITS ARN, so the listener is only created after validation succeeds. ELBSecurityPolicy-TLS13-1-2-2021-06 allows TLS 1.2 and 1.3 only.

   data "aws_route53_zone" "main" {
     count = local.https_enabled ? 1 : 0
     name  = var.hosted_zone_name
   }
   
   resource "aws_acm_certificate" "api" {
     count             = local.https_enabled ? 1 : 0
     domain_name       = var.domain_name
     validation_method = "DNS"
   
     lifecycle {
       create_before_destroy = true
     }
   }
   
   resource "aws_route53_record" "cert_validation" {
     for_each = local.https_enabled ? {
       for dvo in aws_acm_certificate.api[0].domain_validation_options : dvo.domain_name => dvo
     } : {}
   
     zone_id = data.aws_route53_zone.main[0].zone_id
     name    = each.value.resource_record_name
     type    = each.value.resource_record_type
     records = [each.value.resource_record_value]
     ttl     = 60
   }
   
   resource "aws_acm_certificate_validation" "api" {
     count                   = local.https_enabled ? 1 : 0
     certificate_arn         = aws_acm_certificate.api[0].arn
     validation_record_fqdns = [for r in aws_route53_record.cert_validation : r.fqdn]
   }
   
   resource "aws_lb_listener" "https" {
     count             = local.https_enabled ? 1 : 0
     load_balancer_arn = aws_lb.main.arn
     port              = 443
     protocol          = "HTTPS"
     ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
     certificate_arn   = aws_acm_certificate_validation.api[0].certificate_arn
   
     default_action {
       type             = "forward"
       target_group_arn = aws_lb_target_group.api.arn
     }
   }
   
   resource "aws_route53_record" "api" {
     count   = local.https_enabled ? 1 : 0
     zone_id = data.aws_route53_zone.main[0].zone_id
     name    = var.domain_name
     type    = "A"
   
     alias {
       name                   = aws_lb.main.dns_name
       zone_id                = aws_lb.main.zone_id
       evaluate_target_health = true
     }
   }

5. 5

   Output the URL

   The output picks the right URL for either mode.

   output "api_url" {
     value = local.https_enabled ? "https://${var.domain_name}" : "http://${aws_lb.main.dns_name}"
   }

6. 6

   Apply and call it — a 503 is the right answer

   The ALB takes a couple of minutes to become active. With no registered targets yet, it answers 503 Service Temporarily Unavailable, which proves DNS, the listener, and the security group all work. Tasks arrive in Mission 3.3.

   terminalcopy cmd

   $ terraform apply

   curl -si "$(terraform output -raw api_url)" | head -n 1

   ── expected output ──

   Plan: 3 to add, 0 to change, 0 to destroy. # (8 if you set a domain)

   ...

   aws_lb.main: Still creating... [2m0s elapsed]

   aws_lb.main: Creation complete after 2m32s [id=arn:aws:elasticloadbalancing:...:loadbalancer/app/shoplite-dev-alb/5f1c...]

   ...

   Apply complete! Resources: 3 added, 0 changed, 0 destroyed.

    

   HTTP/1.1 503 Service Temporarily Unavailable

Make each change, run the command, and read the error before revealing the diagnosis. Recognising these messages on sight is what makes you fast on a real team. Undo the change afterwards.