aws-shield is now able to protect alb's from ingress-groups (#897)

Co-authored-by: cloudpossebot <[email protected]>
Co-authored-by: Dan Miller <[email protected]>

modules/aws-shield/README.md

@@ -102,6 +102,7 @@ This leads to more simplified inter-component dependencies and minimizes the nee
 
 | Name | Source | Version |
 |------|--------|---------|
+| <a name="module_alb"></a> [alb](#module\_alb) | cloudposse/stack-config/yaml//modules/remote-state | 1.5.0 |
 | <a name="module_iam_roles"></a> [iam\_roles](#module\_iam\_roles) | ../account-map/modules/iam-roles | n/a |
 | <a name="module_this"></a> [this](#module\_this) | cloudposse/label/null | 0.25.0 |
 
@@ -126,6 +127,7 @@ This leads to more simplified inter-component dependencies and minimizes the nee
 |------|-------------|------|---------|:--------:|
 | <a name="input_additional_tag_map"></a> [additional\_tag\_map](#input\_additional\_tag\_map) | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.<br>This is for some rare cases where resources want additional configuration of tags<br>and therefore take a list of maps with tag key, value, and additional configuration. | `map(string)` | `{}` | no |
 | <a name="input_alb_names"></a> [alb\_names](#input\_alb\_names) | list of ALB names which will be protected with AWS Shield Advanced | `list(string)` | `[]` | no |
+| <a name="input_alb_protection_enabled"></a> [alb\_protection\_enabled](#input\_alb\_protection\_enabled) | Enable ALB protection. By default, ALB names are read from the EKS cluster ALB control group | `bool` | `false` | no |
 | <a name="input_attributes"></a> [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,<br>in the order they appear in the list. New attributes are appended to the<br>end of the list. The elements of the list are joined by the `delimiter`<br>and treated as a single ID element. | `list(string)` | `[]` | no |
 | <a name="input_cloudfront_distribution_ids"></a> [cloudfront\_distribution\_ids](#input\_cloudfront\_distribution\_ids) | list of CloudFront Distribution IDs which will be protected with AWS Shield Advanced | `list(string)` | `[]` | no |
 | <a name="input_context"></a> [context](#input\_context) | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | <pre>{<br>  "additional_tag_map": {},<br>  "attributes": [],<br>  "delimiter": null,<br>  "descriptor_formats": {},<br>  "enabled": true,<br>  "environment": null,<br>  "id_length_limit": null,<br>  "label_key_case": null,<br>  "label_order": [],<br>  "label_value_case": null,<br>  "labels_as_tags": [<br>    "unset"<br>  ],<br>  "name": null,<br>  "namespace": null,<br>  "regex_replace_chars": null,<br>  "stage": null,<br>  "tags": {},<br>  "tenant": null<br>}</pre> | no |

modules/aws-shield/alb.tf

@@ -1,5 +1,5 @@
 data "aws_alb" "alb" {
-  for_each = local.alb_protection_enabled ? toset(var.alb_names) : []
+  for_each = local.alb_protection_enabled == false ? [] : length(var.alb_names) > 0 ? toset(var.alb_names) : toset([module.alb[0].outputs.load_balancer_name])
 
   name = each.key
 }

modules/aws-shield/main.tf

@@ -7,7 +7,7 @@ locals {
   # Used to determine correct partition (i.e. - `aws`, `aws-gov`, `aws-cn`, etc.)
   partition = one(data.aws_partition.current[*].partition)
 
-  alb_protection_enabled                     = local.enabled && length(var.alb_names) > 0
+  alb_protection_enabled                     = local.enabled && local.alb_protection_enabled
   cloudfront_distribution_protection_enabled = local.enabled && length(var.cloudfront_distribution_ids) > 0
   eip_protection_enabled                     = local.enabled && length(var.eips) > 0
   route53_protection_enabled                 = local.enabled && length(var.route53_zone_names) > 0

modules/aws-shield/remote-state.tf

@@ -0,0 +1,9 @@
+module "alb" {
+  count   = length(var.alb_names) > 0 ? 0 : 1
+  source  = "cloudposse/stack-config/yaml//modules/remote-state"
+  version = "1.5.0"
+
+  component = "eks/alb-controller-ingress-group"
+
+  context = module.this.context
+}

modules/aws-shield/variables.tf

@@ -9,6 +9,12 @@ variable "alb_names" {
   default     = []
 }
 
+variable "alb_protection_enabled" {
+  description = "Enable ALB protection. By default, ALB names are read from the EKS cluster ALB control group"
+  type        = bool
+  default     = false
+}
+
 variable "cloudfront_distribution_ids" {
   description = "list of CloudFront Distribution IDs which will be protected with AWS Shield Advanced"
   type        = list(string)