Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ensure target group and load balancer names cannot exceed their max length #96

Merged
merged 7 commits into from
Aug 18, 2021
Merged

Ensure target group and load balancer names cannot exceed their max length #96

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
95dc23b
Add max_length and load_balancer_name
nitrocode Aug 2, 2021
c9a3a3f
Add lb name override, tg and lb max lengths
nitrocode Aug 2, 2021
697db30
Update main.tf
nitrocode Aug 2, 2021
0deae82
Auto Format
cloudpossebot Aug 2, 2021
a4e0c6c
Update main.tf
nitrocode Aug 2, 2021
b367031
Merge branch 'master' into max_length
nitrocode Aug 14, 2021
f6d4dad
Auto Format
cloudpossebot Aug 14, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,6 +203,7 @@ Available targets:
| Name | Source | Version |
|------|--------|---------|
| <a name="module_access_logs"></a> [access\_logs](#module\_access\_logs) | cloudposse/lb-s3-bucket/aws | 0.14.0 |
| <a name="module_default_load_balancer_label"></a> [default\_load\_balancer\_label](#module\_default\_load\_balancer\_label) | cloudposse/label/null | 0.24.1 |
| <a name="module_default_target_group_label"></a> [default\_target\_group\_label](#module\_default\_target\_group\_label) | cloudposse/label/null | 0.24.1 |
| <a name="module_this"></a> [this](#module\_this) | cloudposse/label/null | 0.24.1 |

Expand Down Expand Up @@ -272,6 +273,8 @@ Available targets:
| <a name="input_lifecycle_rule_enabled"></a> [lifecycle\_rule\_enabled](#input\_lifecycle\_rule\_enabled) | A boolean that indicates whether the s3 log bucket lifecycle rule should be enabled. | `bool` | `false` | no |
| <a name="input_listener_http_fixed_response"></a> [listener\_http\_fixed\_response](#input\_listener\_http\_fixed\_response) | Have the HTTP listener return a fixed response for the default action. | <pre>object({<br> content_type = string<br> message_body = string<br> status_code = string<br> })</pre> | `null` | no |
| <a name="input_listener_https_fixed_response"></a> [listener\_https\_fixed\_response](#input\_listener\_https\_fixed\_response) | Have the HTTPS listener return a fixed response for the default action. | <pre>object({<br> content_type = string<br> message_body = string<br> status_code = string<br> })</pre> | `null` | no |
| <a name="input_load_balancer_name"></a> [load\_balancer\_name](#input\_load\_balancer\_name) | The name for the default load balancer, uses a module label name if left empty | `string` | `""` | no |
| <a name="input_load_balancer_name_max_length"></a> [load\_balancer\_name\_max\_length](#input\_load\_balancer\_name\_max\_length) | The max length of characters for the load balancer. | `number` | `32` | no |
| <a name="input_name"></a> [name](#input\_name) | Solution name, e.g. 'app' or 'jenkins' | `string` | `null` | no |
| <a name="input_namespace"></a> [namespace](#input\_namespace) | Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp' | `string` | `null` | no |
| <a name="input_noncurrent_version_expiration_days"></a> [noncurrent\_version\_expiration\_days](#input\_noncurrent\_version\_expiration\_days) | Specifies when noncurrent s3 log versions expire | `number` | `90` | no |
Expand All @@ -286,6 +289,7 @@ Available targets:
| <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `map('BusinessUnit','XYZ')` | `map(string)` | `{}` | no |
| <a name="input_target_group_additional_tags"></a> [target\_group\_additional\_tags](#input\_target\_group\_additional\_tags) | The additional tags to apply to the target group | `map(string)` | `{}` | no |
| <a name="input_target_group_name"></a> [target\_group\_name](#input\_target\_group\_name) | The name for the default target group, uses a module label name if left empty | `string` | `""` | no |
| <a name="input_target_group_name_max_length"></a> [target\_group\_name\_max\_length](#input\_target\_group\_name\_max\_length) | The max length of characters for the target group. | `number` | `32` | no |
| <a name="input_target_group_port"></a> [target\_group\_port](#input\_target\_group\_port) | The port for the default target group | `number` | `80` | no |
| <a name="input_target_group_protocol"></a> [target\_group\_protocol](#input\_target\_group\_protocol) | The protocol for the default target group HTTP or HTTPS | `string` | `"HTTP"` | no |
| <a name="input_target_group_target_type"></a> [target\_group\_target\_type](#input\_target\_group\_target\_type) | The type (`instance`, `ip` or `lambda`) of targets that can be registered with the target group | `string` | `"ip"` | no |
Expand Down
4 changes: 4 additions & 0 deletions docs/terraform.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
| Name | Source | Version |
|------|--------|---------|
| <a name="module_access_logs"></a> [access\_logs](#module\_access\_logs) | cloudposse/lb-s3-bucket/aws | 0.14.0 |
| <a name="module_default_load_balancer_label"></a> [default\_load\_balancer\_label](#module\_default\_load\_balancer\_label) | cloudposse/label/null | 0.24.1 |
| <a name="module_default_target_group_label"></a> [default\_target\_group\_label](#module\_default\_target\_group\_label) | cloudposse/label/null | 0.24.1 |
| <a name="module_this"></a> [this](#module\_this) | cloudposse/label/null | 0.24.1 |

Expand Down Expand Up @@ -88,6 +89,8 @@
| <a name="input_lifecycle_rule_enabled"></a> [lifecycle\_rule\_enabled](#input\_lifecycle\_rule\_enabled) | A boolean that indicates whether the s3 log bucket lifecycle rule should be enabled. | `bool` | `false` | no |
| <a name="input_listener_http_fixed_response"></a> [listener\_http\_fixed\_response](#input\_listener\_http\_fixed\_response) | Have the HTTP listener return a fixed response for the default action. | <pre>object({<br> content_type = string<br> message_body = string<br> status_code = string<br> })</pre> | `null` | no |
| <a name="input_listener_https_fixed_response"></a> [listener\_https\_fixed\_response](#input\_listener\_https\_fixed\_response) | Have the HTTPS listener return a fixed response for the default action. | <pre>object({<br> content_type = string<br> message_body = string<br> status_code = string<br> })</pre> | `null` | no |
| <a name="input_load_balancer_name"></a> [load\_balancer\_name](#input\_load\_balancer\_name) | The name for the default load balancer, uses a module label name if left empty | `string` | `""` | no |
| <a name="input_load_balancer_name_max_length"></a> [load\_balancer\_name\_max\_length](#input\_load\_balancer\_name\_max\_length) | The max length of characters for the load balancer. | `number` | `32` | no |
| <a name="input_name"></a> [name](#input\_name) | Solution name, e.g. 'app' or 'jenkins' | `string` | `null` | no |
| <a name="input_namespace"></a> [namespace](#input\_namespace) | Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp' | `string` | `null` | no |
| <a name="input_noncurrent_version_expiration_days"></a> [noncurrent\_version\_expiration\_days](#input\_noncurrent\_version\_expiration\_days) | Specifies when noncurrent s3 log versions expire | `number` | `90` | no |
Expand All @@ -102,6 +105,7 @@
| <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `map('BusinessUnit','XYZ')` | `map(string)` | `{}` | no |
| <a name="input_target_group_additional_tags"></a> [target\_group\_additional\_tags](#input\_target\_group\_additional\_tags) | The additional tags to apply to the target group | `map(string)` | `{}` | no |
| <a name="input_target_group_name"></a> [target\_group\_name](#input\_target\_group\_name) | The name for the default target group, uses a module label name if left empty | `string` | `""` | no |
| <a name="input_target_group_name_max_length"></a> [target\_group\_name\_max\_length](#input\_target\_group\_name\_max\_length) | The max length of characters for the target group. | `number` | `32` | no |
| <a name="input_target_group_port"></a> [target\_group\_port](#input\_target\_group\_port) | The port for the default target group | `number` | `80` | no |
| <a name="input_target_group_protocol"></a> [target\_group\_protocol](#input\_target\_group\_protocol) | The protocol for the default target group HTTP or HTTPS | `string` | `"HTTP"` | no |
| <a name="input_target_group_target_type"></a> [target\_group\_target\_type](#input\_target\_group\_target\_type) | The type (`instance`, `ip` or `lambda`) of targets that can be registered with the target group | `string` | `"ip"` | no |
Expand Down
20 changes: 14 additions & 6 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,11 +54,18 @@ module "access_logs" {
context = module.this.context
}

module "default_load_balancer_label" {
source = "cloudposse/label/null"
version = "0.24.1"
id_length_limit = var.load_balancer_name_max_length
context = module.this.context
}

resource "aws_lb" "default" {
Copy link

@bridgecrew bridgecrew bot Aug 2, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LOW   Ensure that ALB redirects HTTP requests into HTTPS ones
    Resource: aws_lb.default | ID: BC_AWS_NETWORKING_49

How to Fix

resource "aws_lb" "lb_good" {
}


resource "aws_lb_listener" "listener_good" {
  load_balancer_arn = aws_lb.lb_good.arn
  port              = "80"
  protocol          = "HTTP"

  default_action {
    type = "redirect"

    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }

  }
}

Description

TBA

Dependent Resources



Path Resource Connecting Attribute
/main.tf aws_lb_listener.http_forward load_balancer_arn
/main.tf aws_lb_listener.http_redirect load_balancer_arn
/main.tf aws_lb_listener.https load_balancer_arn

#bridgecrew:skip=BC_AWS_NETWORKING_41 - Skipping Ensure that ALB Drops HTTP Headers
#bridgecrew:skip=BC_AWS_LOGGING_22 - Skipping Ensure ELBv2 has Access Logging Enabled
count = module.this.enabled ? 1 : 0
name = module.this.id
name = var.load_balancer_name == "" ? module.default_load_balancer_label.id : substr(var.load_balancer_name, 0, var.load_balancer_name_max_length)
tags = module.this.tags
internal = var.internal
load_balancer_type = "application"
Expand All @@ -83,15 +90,16 @@ resource "aws_lb" "default" {
}

module "default_target_group_label" {
source = "cloudposse/label/null"
version = "0.24.1"
attributes = concat(module.this.attributes, ["default"])
context = module.this.context
source = "cloudposse/label/null"
version = "0.24.1"
attributes = concat(module.this.attributes, ["default"])
id_length_limit = var.target_group_name_max_length
context = module.this.context
}

resource "aws_lb_target_group" "default" {
count = module.this.enabled ? 1 : 0
name = var.target_group_name == "" ? module.default_target_group_label.id : var.target_group_name
name = var.target_group_name == "" ? module.default_target_group_label.id : substr(var.target_group_name, 0, var.target_group_name_max_length)
nitrocode marked this conversation as resolved.
Show resolved Hide resolved
port = var.target_group_port
protocol = var.target_group_protocol
vpc_id = var.vpc_id
Expand Down
18 changes: 18 additions & 0 deletions variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,6 +212,12 @@ variable "target_group_name" {
description = "The name for the default target group, uses a module label name if left empty"
}

variable "target_group_name_max_length" {
type = number
default = 32
description = "The max length of characters for the target group."
}

variable "target_group_target_type" {
type = string
default = "ip"
Expand Down Expand Up @@ -306,3 +312,15 @@ variable "security_group_enabled" {
description = "Enables the security group"
default = true
}

variable "load_balancer_name" {
type = string
default = ""
description = "The name for the default load balancer, uses a module label name if left empty"
}

variable "load_balancer_name_max_length" {
type = number
default = 32
description = "The max length of characters for the load balancer."
}