Skip to content

Commit 564401f

Browse files
tobyclemsontobyclemson
committed
Update README.md and CHANGELOG.md.
1 parent 0135728 commit 564401f

File tree

3 files changed

+102
-86
lines changed

3 files changed

+102
-86
lines changed

‎CHANGELOG.md

+8
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,14 @@ BACKWARDS INCOMPATIBILITIES / NOTES:
2020
been removed in favour of the `dns` variable which allows an arbitrary number
2121
of records to be created.
2222

23+
IMPROVEMENTS:
24+
25+
* An `enable_deletion_protection` variable has been added, allowing deletion
26+
protection to be enabled for the load balancer.
27+
* An `enable_access_logs` variable has been added, along with
28+
`access_logs_bucket_name` and `access_logs_bucket_prefix` variables, allowing
29+
access logs to be configured for the load balancer.
30+
2331
## 2.0.0 (May 28th, 2021)
2432

2533
BACKWARDS INCOMPATIBILITIES / NOTES:

‎README.md

+92-85
Original file line numberDiff line numberDiff line change
@@ -6,23 +6,25 @@ Terraform AWS Network Load Balancer
66
A Terraform module for building a network load balancer in AWS.
77

88
The load balancer requires:
9+
910
* An existing VPC
1011
* Some existing subnets
1112
* A domain name and public and private hosted zones
12-
13+
1314
The ECS load balancer consists of:
15+
1416
* An NLB
15-
* Deployed across the provided subnet IDs
16-
* Either internal or internet-facing as specified
17-
* With a health check using the specified target
18-
* With connection draining as specified
19-
* A security group allowing access to/from the load balancer according to the
17+
* Deployed across the provided subnet IDs
18+
* Either internal or internet-facing as specified
19+
* With a health check using the specified target
20+
* With connection draining as specified
21+
* A security group allowing access to/from the load balancer according to the
2022
specified access control and egress CIDRs configuration
2123
* A security group for use by instances allowing access from the load balancer
2224
according to the specified access control configuration
2325
* A DNS entry
24-
* In the public hosted zone if specified
25-
* In the private hosted zone if specified
26+
* In the public hosted zone if specified
27+
* In the private hosted zone if specified
2628

2729
![Diagram of infrastructure managed by this module](https://raw.githubusercontent.com/infrablocks/terraform-aws-network-load-balancer/main/docs/architecture.png)
2830

@@ -37,130 +39,134 @@ module "network_load_balancer" {
3739
source = "infrablocks/network-load-balancer/aws"
3840
version = "0.1.7"
3941
40-
region = "eu-west-2"
41-
vpc_id = "vpc-fb7dc365"
42+
region = "eu-west-2"
43+
vpc_id = "vpc-fb7dc365"
4244
subnet_ids = "subnet-ae4533c4,subnet-443e6b12"
43-
44-
component = "important-component"
45+
46+
component = "important-component"
4547
deployment_identifier = "production"
46-
47-
domain_name = "example.com"
48-
public_zone_id = "Z1WA3EVJBXSQ2V"
48+
49+
domain_name = "example.com"
50+
public_zone_id = "Z1WA3EVJBXSQ2V"
4951
private_zone_id = "Z3CVA9QD5NHSW3"
50-
52+
5153
listeners = [
5254
{
53-
lb_port = 443
54-
lb_protocol = "HTTPS"
55-
instance_port = 443
56-
instance_protocol = "HTTPS"
55+
lb_port = 443
56+
lb_protocol = "HTTPS"
57+
instance_port = 443
58+
instance_protocol = "HTTPS"
5759
ssl_certificate_id = "arn:aws:iam::123456789012:server-certificate/default"
5860
},
5961
{
60-
lb_port = 6567
61-
lb_protocol = "TCP"
62-
instance_port = 6567
62+
lb_port = 6567
63+
lb_protocol = "TCP"
64+
instance_port = 6567
6365
instance_protocol = "TCP"
6466
}
6567
]
66-
68+
6769
access_control = [
6870
{
69-
lb_port = 443
71+
lb_port = 443
7072
instance_port = 443
71-
allow_cidr = '0.0.0.0/0'
73+
allow_cidr = '0.0.0.0/0'
7274
},
7375
{
74-
lb_port = 6567
76+
lb_port = 6567
7577
instance_port = 6567
76-
allow_cidr = '10.0.0.0/8'
78+
allow_cidr = '10.0.0.0/8'
7779
}
7880
]
79-
81+
8082
egress_cidrs = '10.0.0.0/8'
81-
82-
health_check_target = 'HTTPS:443/ping'
83-
health_check_timeout = 10
84-
health_check_interval = 30
83+
84+
health_check_target = 'HTTPS:443/ping'
85+
health_check_timeout = 10
86+
health_check_interval = 30
8587
health_check_unhealthy_threshold = 5
86-
health_check_healthy_threshold = 5
88+
health_check_healthy_threshold = 5
8789
8890
enable_cross_zone_load_balancing = 'yes'
8991
90-
enable_connection_draining = 'yes'
92+
enable_connection_draining = 'yes'
9193
connection_draining_timeout = 60
9294
9395
idle_timeout = 60
9496
95-
include_public_dns_record = 'yes'
97+
include_public_dns_record = 'yes'
9698
include_private_dns_record = 'yes'
9799
98100
expose_to_public_internet = 'yes'
99101
}
100102
```
101103

102-
As mentioned above, the load balancer deploys into an existing base network.
103-
Whilst the base network can be created using any mechanism you like, the
104+
As mentioned above, the load balancer deploys into an existing base network.
105+
Whilst the base network can be created using any mechanism you like, the
104106
[AWS Base Networking](https://github.com/infrablocks/terraform-aws-base-networking)
105-
module will create everything you need. See the
107+
module will create everything you need. See the
106108
[docs](https://github.com/infrablocks/terraform-aws-base-networking/blob/main/README.md)
107109
for usage instructions.
108110

109-
See the
110-
[Terraform registry entry](https://registry.terraform.io/modules/infrablocks/network-load-balancer/aws/latest)
111+
See the
112+
[Terraform registry entry](https://registry.terraform.io/modules/infrablocks/network-load-balancer/aws/latest)
111113
for more details.
112114

113115
### Inputs
114116

115-
| Name | Description | Default | Required |
116-
|----------------------------------|-------------------------------------------------------------------------------|:-------------------:|:------------------------------------:|
117-
|region| The region into which to deploy the load balancer|-| yes|
118-
|vpc_id| The ID of the VPC into which to deploy the load balancer |-| yes|
119-
|subnet_ids| The IDs of the subnets for the NLB |-| yes|
120-
|component| The component for which the load balancer is being created |-| yes|
121-
|deployment_identifier| An identifier for this instantiation |-| yes|
122-
|domain_name|The domain name of the supplied Route 53 zones |-| yes|
123-
|public_zone_id| The ID of the public Route 53 zone |-| yes|
124-
|private_zone_id| The ID of the private Route 53 zone |-| yes|
125-
|enable_cross_zone_load_balancing| Whether or not to enable cross zone load balancing (\"yes\" or \"no\").|no| no|
126-
|idle_timeout| The time after which idle connections are closed.|60| no|
127-
|include_public_dns_record| Whether or not to create a public DNS entry (\"yes\" or \"no\").|no| no|
128-
|include_private_dns_record| Whether or not to create a private DNS entry (\"yes\" or \"no\").|yes| no|
129-
|expose_to_public_internet| Whether or not to the NLB should be internet facing (\"yes\" or \"no\").|no| no|
130-
|use_https| whether or not to use HTTPS|no| no|
131-
|target_group_port|The port that the application is listening on|-| yes|
132-
|target_group_type|The type of target that you must specify when registering targets with this target group.|instance| no|
133-
|target_group_protocol| The protocol to use for routing traffic to the targets. Should be either TCP or TLS|TCP| no|
134-
|health_check_port|The port to use to connect with the target. Either ports 1-65536, or traffic-port|traffic-port|no|
135-
|health_check_protocol| The protocol to use for health checks |TLS| no|
136-
|health_check_interval|The time between health check attempts in seconds |30| no|
137-
|health_check_unhealthy_threshold| The number of failed health checks before an instance is taken out of service |2| no|
138-
|health_check_healthy_threshold| The number of successful health checks before an instance is put into service |10| no|
139-
|listener_port| Port that NLB listens on|443| no|
140-
|listener_protocol| Protocol that the NLB listens on|TLS| no|
141-
|listener_certificate_arn|certificate ARN to be used by the certificate|-| yes|
117+
| Name | Description | Default | Required |
118+
|----------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|:------------:|:--------:|
119+
| region | The region into which to deploy the load balancer | - | yes |
120+
| vpc_id | The ID of the VPC into which to deploy the load balancer | - | yes |
121+
| subnet_ids | The IDs of the subnets for the NLB | - | yes |
122+
| component | The component for which the load balancer is being created | - | yes |
123+
| deployment_identifier | An identifier for this instantiation | - | yes |
124+
| domain_name | The domain name of the supplied Route 53 zones | - | yes |
125+
| public_zone_id | The ID of the public Route 53 zone | - | yes |
126+
| private_zone_id | The ID of the private Route 53 zone | - | yes |
127+
| enable_cross_zone_load_balancing | Whether or not to enable cross zone load balancing (\"yes\" or \"no\"). | no | no |
128+
| enable_deletion_protection | Whether or not to enable deletion protection for the load balancer. | false | no |
129+
| enable_access_logs | Whether or not to enable access logs on the load balancer. | false | no |
130+
| access_logs_bucket_name | The name of the S3 bucket in which to store access logs when `enable_access_logs` is `true`. | false | no |
131+
| access_logs_bucket_prefix | The prefix to use for objects in the access logs S3 bucket when `enable_access_logs` is `true`. Logs are stored in the root if `null`. | false | no |
132+
| idle_timeout | The time after which idle connections are closed. | 60 | no |
133+
| include_public_dns_record | Whether or not to create a public DNS entry (\"yes\" or \"no\"). | no | no |
134+
| include_private_dns_record | Whether or not to create a private DNS entry (\"yes\" or \"no\"). | yes | no |
135+
| expose_to_public_internet | Whether or not to the NLB should be internet facing (\"yes\" or \"no\"). | no | no |
136+
| use_https | whether or not to use HTTPS | no | no |
137+
| target_group_port | The port that the application is listening on | - | yes |
138+
| target_group_type | The type of target that you must specify when registering targets with this target group. | instance | no |
139+
| target_group_protocol | The protocol to use for routing traffic to the targets. Should be either TCP or TLS | TCP | no |
140+
| health_check_port | The port to use to connect with the target. Either ports 1-65536, or traffic-port | traffic-port | no |
141+
| health_check_protocol | The protocol to use for health checks | TLS | no |
142+
| health_check_interval | The time between health check attempts in seconds | 30 | no |
143+
| health_check_unhealthy_threshold | The number of failed health checks before an instance is taken out of service | 2 | no |
144+
| health_check_healthy_threshold | The number of successful health checks before an instance is put into service | 10 | no |
145+
| listener_port | Port that NLB listens on | 443 | no |
146+
| listener_protocol | Protocol that the NLB listens on | TLS | no |
147+
| listener_certificate_arn | certificate ARN to be used by the certificate | - | yes |
142148

143149
### Outputs
144150

145-
| Name | Description |
146-
|-----------------------------------------|-----------------------------------------------------------|
147-
| name | The name of the created NLB |
148-
| arn | The arn of the created NLB |
149-
| zone_id | The zone ID of the created NLB |
150-
| dns_name | The DNS name of the created NLB |
151-
| address | The address of the DNS record(s) for the created NLB |
151+
| Name | Description |
152+
|----------|------------------------------------------------------|
153+
| name | The name of the created NLB |
154+
| arn | The arn of the created NLB |
155+
| zone_id | The zone ID of the created NLB |
156+
| dns_name | The DNS name of the created NLB |
157+
| address | The address of the DNS record(s) for the created NLB |
152158

153159
### Compatibility
154160

155-
This module is compatible with Terraform versions greater than or equal to
161+
This module is compatible with Terraform versions greater than or equal to
156162
Terraform 1.0.
157163

158164
Development
159165
-----------
160166

161167
### Machine Requirements
162168

163-
In order for the build to run correctly, a few tools will need to be installed
169+
In order for the build to run correctly, a few tools will need to be installed
164170
on your development machine:
165171

166172
* Ruby (3.1.1)
@@ -214,13 +220,13 @@ direnv allow <repository-directory>
214220

215221
### Running the build
216222

217-
Running the build requires an AWS account and AWS credentials. You are free to
223+
Running the build requires an AWS account and AWS credentials. You are free to
218224
configure credentials however you like as long as an access key ID and secret
219-
access key are available. These instructions utilise
225+
access key are available. These instructions utilise
220226
[aws-vault](https://github.com/99designs/aws-vault) which makes credential
221227
management easy and secure.
222228

223-
To provision module infrastructure, run tests and then destroy that
229+
To provision module infrastructure, run tests and then destroy that
224230
infrastructure, execute:
225231

226232
```bash
@@ -257,7 +263,7 @@ Configuration parameters can be overridden via environment variables:
257263
DEPLOYMENT_IDENTIFIER=testing aws-vault exec <profile> -- ./go
258264
```
259265

260-
When a deployment identifier is provided via an environment variable,
266+
When a deployment identifier is provided via an environment variable,
261267
infrastructure will not be destroyed at the end of test execution. This can
262268
be useful during development to avoid lengthy provision and destroy cycles.
263269

@@ -281,6 +287,7 @@ ssh-keygen -m PEM -t rsa -b 4096 -C integration-test@example.com -N '' -f config
281287
#### Generating a self-signed certificate
282288

283289
To generate a self signed certificate:
290+
284291
```
285292
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365
286293
```
@@ -317,14 +324,14 @@ openssl aes-256-cbc \
317324
Contributing
318325
------------
319326

320-
Bug reports and pull requests are welcome on GitHub at
327+
Bug reports and pull requests are welcome on GitHub at
321328
https://github.com/infrablocks/terraform-aws-network-load-balancer. This project
322-
is intended to be a safe, welcoming space for collaboration, and contributors
323-
are expected to adhere to the
329+
is intended to be a safe, welcoming space for collaboration, and contributors
330+
are expected to adhere to the
324331
[Contributor Covenant](http://contributor-covenant.org) code of conduct.
325332

326333
License
327334
-------
328335

329-
The library is available as open source under the terms of the
336+
The library is available as open source under the terms of the
330337
[MIT License](http://opensource.org/licenses/MIT).

‎variables.tf

+2-1
Original file line numberDiff line numberDiff line change
@@ -103,12 +103,13 @@ variable "enable_access_logs" {
103103
}
104104

105105
variable "access_logs_bucket_name" {
106-
description = "The S3 bucket prefix. Logs are stored in the root if not configured"
106+
description = "The name of the S3 bucket in which to store access logs when `enable_access_logs` is `true`."
107107
type = string
108108
default = null
109109
}
110110

111111
variable "access_logs_bucket_prefix" {
112+
description = "The prefix to use for objects in the access logs S3 bucket when `enable_access_logs` is `true`. Logs are stored in the root if `null`."
112113
type = string
113114
default = null
114115
}

0 commit comments

Comments
 (0)