Support multiple public/private ALBs and NLBs per ECS cluster with per-service selection

README.md

@@ -67,9 +67,9 @@ sync by `node tools/ravion-modules/dist/src/cli.js readme` (enforced in CI, and
 | `rvn-aws-static` | Static Hosting | v1.0.0 | `hosting/static_site/` |
 | `rvn-cloudfront` | CloudFront CDN | v1.0.0 | `cdn/cloudfront/` |
 | `rvn-ec2-service` | EC2 Service | v1.0.0 | `compute/ec2_service/` |
-| `rvn-ecs-cluster` | ECS Cluster | v1.0.0 | `compute/ecs_cluster/` |
-| `rvn-ecs-nlb` | ECS Network Service | v1.0.0 | `compute/ecs_service/` |
-| `rvn-ecs-web` | ECS Web Service | v1.0.0 | `compute/ecs_service/` |
+| `rvn-ecs-cluster` | ECS Cluster | v2.0.0 | `compute/ecs_cluster/` |
+| `rvn-ecs-nlb` | ECS Network Service | v2.0.0 | `compute/ecs_service/` |
+| `rvn-ecs-web` | ECS Web Service | v2.0.0 | `compute/ecs_service/` |
 | `rvn-ecs-worker` | ECS Worker | v1.0.0 | `compute/ecs_service/` |
 | `rvn-efs` | EFS File System | v1.0.0 | `storage/efs/` |
 | `rvn-elasticache` | ElastiCache | v1.0.0 | `cache/elasticache/` |

compute/ecs_cluster/ec2.tf

@@ -66,26 +66,22 @@ module "ecs_instance_security_group" {
   # For ip_protocol="-1" (all protocols), AWS requires from_port/to_port to
   # be -1; setting them to 0 causes update failures.
   ingress_rules = concat(
-    # Allow inbound from public ALB if enabled
-    var.public_alb_enabled ? [
-      {
-        description                  = "Allow inbound from public ALB"
-        from_port                    = -1
-        to_port                      = -1
-        ip_protocol                  = "-1"
-        referenced_security_group_id = module.public_alb[0].security_group_id
-      }
-    ] : [],
-    # Allow inbound from private ALB if enabled
-    var.private_alb_enabled ? [
-      {
-        description                  = "Allow inbound from private ALB"
-        from_port                    = -1
-        to_port                      = -1
-        ip_protocol                  = "-1"
-        referenced_security_group_id = module.private_alb[0].security_group_id
-      }
-    ] : []
+    # Allow inbound from each public ALB
+    [for idx, lb in module.public_alb : {
+      description                  = "Allow inbound from public ALB ${local.public_alb_names[idx]}"
+      from_port                    = -1
+      to_port                      = -1
+      ip_protocol                  = "-1"
+      referenced_security_group_id = lb.security_group_id
+    }],
+    # Allow inbound from each private ALB
+    [for idx, lb in module.private_alb : {
+      description                  = "Allow inbound from private ALB ${local.private_alb_names[idx]}"
+      from_port                    = -1
+      to_port                      = -1
+      ip_protocol                  = "-1"
+      referenced_security_group_id = lb.security_group_id
+    }]
   )
 }
 

compute/ecs_cluster/load_balancers.tf

@@ -1,13 +1,13 @@
 ################################################################################
-# Public Application Load Balancer
+# Public Application Load Balancers
 ################################################################################
 
 module "public_alb" {
-  count = var.public_alb_enabled ? 1 : 0
+  count = length(var.public_albs)
 
   source = "../../networking/alb"
 
-  name   = "${var.name}-pub"
+  name   = local.public_alb_names[count.index]
   tags   = var.tags
   vpc_id = var.vpc_id
 
@@ -16,40 +16,40 @@ module "public_alb" {
 
   # Listener configuration
   http_listener_enabled          = true
-  https_listener_enabled         = var.public_alb_https_enabled
-  http_to_https_redirect_enabled = var.public_alb_https_enabled
+  https_listener_enabled         = var.public_albs[count.index].https_enabled
+  http_to_https_redirect_enabled = var.public_albs[count.index].https_enabled
 
   # SSL/TLS
-  certificate_arns = var.public_alb_certificate_arns
-  ssl_policy       = var.public_alb_ssl_policy
+  certificate_arns = var.public_albs[count.index].certificate_arns
+  ssl_policy       = var.public_albs[count.index].ssl_policy
 
   # ALB settings
-  idle_timeout                = var.public_alb_idle_timeout
+  idle_timeout                = var.public_albs[count.index].idle_timeout
   deletion_protection_enabled = var.load_balancer_deletion_protection_enabled
 
   # Security
-  ingress_cidr_blocks        = var.public_alb_ingress_cidr_blocks
-  ingress_ipv6_cidr_blocks   = var.public_alb_ingress_ipv6_cidr_blocks
-  ingress_security_group_ids = var.public_alb_ingress_security_group_ids
+  ingress_cidr_blocks        = var.public_albs[count.index].ingress_cidr_blocks
+  ingress_ipv6_cidr_blocks   = var.public_albs[count.index].ingress_ipv6_cidr_blocks
+  ingress_security_group_ids = var.public_albs[count.index].ingress_security_group_ids
 
   # Access logs
-  access_logs_enabled    = var.public_alb_access_logs_enabled
-  access_logs_bucket_arn = var.public_alb_access_logs_bucket_arn
+  access_logs_enabled    = var.public_albs[count.index].access_logs_enabled
+  access_logs_bucket_arn = var.public_albs[count.index].access_logs_bucket_arn
 
   # WAF
-  web_acl_arn = var.public_alb_web_acl_arn
+  web_acl_arn = var.public_albs[count.index].web_acl_arn
 }
 
 ################################################################################
-# Private Application Load Balancer
+# Private Application Load Balancers
 ################################################################################
 
 module "private_alb" {
-  count = var.private_alb_enabled ? 1 : 0
+  count = length(var.private_albs)
 
   source = "../../networking/alb"
 
-  name   = "${var.name}-priv"
+  name   = local.private_alb_names[count.index]
   tags   = var.tags
   vpc_id = var.vpc_id
 
@@ -58,37 +58,37 @@ module "private_alb" {
 
   # Listener configuration
   http_listener_enabled          = true
-  https_listener_enabled         = var.private_alb_https_enabled
-  http_to_https_redirect_enabled = var.private_alb_https_enabled
+  https_listener_enabled         = var.private_albs[count.index].https_enabled
+  http_to_https_redirect_enabled = var.private_albs[count.index].https_enabled
 
   # SSL/TLS
-  certificate_arns = var.private_alb_certificate_arns
-  ssl_policy       = var.private_alb_ssl_policy
+  certificate_arns = var.private_albs[count.index].certificate_arns
+  ssl_policy       = var.private_albs[count.index].ssl_policy
 
   # ALB settings
-  idle_timeout                = var.private_alb_idle_timeout
+  idle_timeout                = var.private_albs[count.index].idle_timeout
   deletion_protection_enabled = var.load_balancer_deletion_protection_enabled
 
   # Security
-  ingress_cidr_blocks        = var.private_alb_ingress_cidr_blocks
-  ingress_ipv6_cidr_blocks   = var.private_alb_ingress_ipv6_cidr_blocks
-  ingress_security_group_ids = var.private_alb_ingress_security_group_ids
+  ingress_cidr_blocks        = var.private_albs[count.index].ingress_cidr_blocks
+  ingress_ipv6_cidr_blocks   = var.private_albs[count.index].ingress_ipv6_cidr_blocks
+  ingress_security_group_ids = var.private_albs[count.index].ingress_security_group_ids
 
   # Access logs
-  access_logs_enabled    = var.private_alb_access_logs_enabled
-  access_logs_bucket_arn = var.private_alb_access_logs_bucket_arn
+  access_logs_enabled    = var.private_albs[count.index].access_logs_enabled
+  access_logs_bucket_arn = var.private_albs[count.index].access_logs_bucket_arn
 }
 
 ################################################################################
-# Public Network Load Balancer
+# Public Network Load Balancers
 ################################################################################
 
 module "public_nlb" {
-  count = var.public_nlb_enabled ? 1 : 0
+  count = length(var.public_nlbs)
 
   source = "../../networking/nlb"
 
-  name   = "${var.name}-pub-nlb"
+  name   = local.public_nlb_names[count.index]
   tags   = var.tags
   vpc_id = var.vpc_id
 
@@ -97,30 +97,30 @@ module "public_nlb" {
 
   # NLB settings
   deletion_protection_enabled       = var.load_balancer_deletion_protection_enabled
-  cross_zone_load_balancing_enabled = var.public_nlb_cross_zone_load_balancing_enabled
+  cross_zone_load_balancing_enabled = var.public_nlbs[count.index].cross_zone_load_balancing_enabled
 
   # Security groups
-  additional_security_group_ids = var.public_nlb_security_group_ids
+  additional_security_group_ids = var.public_nlbs[count.index].security_group_ids
 
   # Access logs
-  access_logs_enabled    = var.public_nlb_access_logs_enabled
-  access_logs_bucket_arn = var.public_nlb_access_logs_bucket_arn
+  access_logs_enabled    = var.public_nlbs[count.index].access_logs_enabled
+  access_logs_bucket_arn = var.public_nlbs[count.index].access_logs_bucket_arn
 
   # Elastic IPs
-  elastic_ips_enabled       = var.public_nlb_elastic_ips_enabled
-  elastic_ip_allocation_ids = var.public_nlb_elastic_ip_allocation_ids
+  elastic_ips_enabled       = var.public_nlbs[count.index].elastic_ips_enabled
+  elastic_ip_allocation_ids = var.public_nlbs[count.index].elastic_ip_allocation_ids
 }
 
 ################################################################################
-# Private Network Load Balancer
+# Private Network Load Balancers
 ################################################################################
 
 module "private_nlb" {
-  count = var.private_nlb_enabled ? 1 : 0
+  count = length(var.private_nlbs)
 
   source = "../../networking/nlb"
 
-  name   = "${var.name}-priv-nlb"
+  name   = local.private_nlb_names[count.index]
   tags   = var.tags
   vpc_id = var.vpc_id
 
@@ -129,16 +129,16 @@ module "private_nlb" {
 
   # NLB settings
   deletion_protection_enabled       = var.load_balancer_deletion_protection_enabled
-  cross_zone_load_balancing_enabled = var.private_nlb_cross_zone_load_balancing_enabled
+  cross_zone_load_balancing_enabled = var.private_nlbs[count.index].cross_zone_load_balancing_enabled
 
   # Security groups
-  additional_security_group_ids = var.private_nlb_security_group_ids
+  additional_security_group_ids = var.private_nlbs[count.index].security_group_ids
 
   # Access logs
-  access_logs_enabled    = var.private_nlb_access_logs_enabled
-  access_logs_bucket_arn = var.private_nlb_access_logs_bucket_arn
+  access_logs_enabled    = var.private_nlbs[count.index].access_logs_enabled
+  access_logs_bucket_arn = var.private_nlbs[count.index].access_logs_bucket_arn
 
   # Elastic IPs
-  elastic_ips_enabled       = var.private_nlb_elastic_ips_enabled
-  elastic_ip_allocation_ids = var.private_nlb_elastic_ip_allocation_ids
+  elastic_ips_enabled       = var.private_nlbs[count.index].elastic_ips_enabled
+  elastic_ip_allocation_ids = var.private_nlbs[count.index].elastic_ip_allocation_ids
 }

compute/ecs_cluster/locals.tf

@@ -66,3 +66,14 @@ locals {
     var.ec2_spot_instance_types
   ) : []
 }
+
+################################################################################
+# Load Balancer Names
+################################################################################
+
+locals {
+  public_alb_names  = [for idx, lb in var.public_albs : coalesce(lb.name, idx == 0 ? "${var.name}-pub" : "${var.name}-pub-${idx + 1}")]
+  private_alb_names = [for idx, lb in var.private_albs : coalesce(lb.name, idx == 0 ? "${var.name}-priv" : "${var.name}-priv-${idx + 1}")]
+  public_nlb_names  = [for idx, lb in var.public_nlbs : coalesce(lb.name, idx == 0 ? "${var.name}-pub-nlb" : "${var.name}-pub-nlb-${idx + 1}")]
+  private_nlb_names = [for idx, lb in var.private_nlbs : coalesce(lb.name, idx == 0 ? "${var.name}-priv-nlb" : "${var.name}-priv-nlb-${idx + 1}")]
+}