Support multiple public/private ALBs and NLBs per ECS cluster with per-service selection

README.md

@@ -66,10 +66,10 @@ sync by `node tools/ravion-modules/dist/src/cli.js readme` (enforced in CI, and
 | `rvn-aws-network` | VPC Network | v1.0.0 | `networking/vpc/` |
 | `rvn-aws-static` | Static Hosting | v1.0.0 | `hosting/static_site/` |
 | `rvn-cloudfront` | CloudFront CDN | v1.0.0 | `cdn/cloudfront/` |
-| `rvn-ec2-service` | EC2 Service | v1.0.0 | `compute/ec2_service/` |
-| `rvn-ecs-cluster` | ECS Cluster | v1.0.0 | `compute/ecs_cluster/` |
-| `rvn-ecs-nlb` | ECS Network Service | v1.0.0 | `compute/ecs_service/` |
-| `rvn-ecs-web` | ECS Web Service | v1.0.0 | `compute/ecs_service/` |
+| `rvn-ec2-service` | EC2 Service | v2.0.0 | `compute/ec2_service/` |
+| `rvn-ecs-cluster` | ECS Cluster | v2.0.0 | `compute/ecs_cluster/` |
+| `rvn-ecs-nlb` | ECS Network Service | v2.0.0 | `compute/ecs_service/` |
+| `rvn-ecs-web` | ECS Web Service | v2.0.0 | `compute/ecs_service/` |
 | `rvn-ecs-worker` | ECS Worker | v1.0.0 | `compute/ecs_service/` |
 | `rvn-efs` | EFS File System | v1.0.0 | `storage/efs/` |
 | `rvn-elasticache` | ElastiCache | v1.0.0 | `cache/elasticache/` |

compute/ec2_service/rvn-ec2-service-definition.yml

@@ -3,8 +3,8 @@ definition:
   name: EC2 Service
   description: Runs supervised workloads on a stable EC2 Auto Scaling Group, with optional shared ALB routing and switchable container or manual in-place deploys.
 release:
-  version: 1.0.0
-  description: First stable release.
+  version: 2.0.0
+  description: ECS cluster references now expose the cluster's load balancer arrays; the shared ALB fields default to the cluster's first public or private load balancer.
 module:
   inputs:
     - id: network
@@ -271,16 +271,6 @@ module:
       description: Attach listener rules to the ALB in this cluster.
       mapped_inputs:
         - $include: ../../partials/inputs/ecs-service-cluster-alb-mapped-inputs.yml
-        - default: <<ref.stack.output.public_alb_arn_suffix>>
-          id: public_alb_arn_suffix
-          immutable: true
-          label: Public ALB ARN suffix
-          type: string
-        - default: <<ref.stack.output.private_alb_arn_suffix>>
-          id: private_alb_arn_suffix
-          immutable: true
-          label: Private ALB ARN suffix
-          type: string
       required: true
       show_when:
         http_traffic_enabled: true

compute/ecs_cluster/ec2.tf

@@ -66,26 +66,22 @@ module "ecs_instance_security_group" {
   # For ip_protocol="-1" (all protocols), AWS requires from_port/to_port to
   # be -1; setting them to 0 causes update failures.
   ingress_rules = concat(
-    # Allow inbound from public ALB if enabled
-    var.public_alb_enabled ? [
-      {
-        description                  = "Allow inbound from public ALB"
-        from_port                    = -1
-        to_port                      = -1
-        ip_protocol                  = "-1"
-        referenced_security_group_id = module.public_alb[0].security_group_id
-      }
-    ] : [],
-    # Allow inbound from private ALB if enabled
-    var.private_alb_enabled ? [
-      {
-        description                  = "Allow inbound from private ALB"
-        from_port                    = -1
-        to_port                      = -1
-        ip_protocol                  = "-1"
-        referenced_security_group_id = module.private_alb[0].security_group_id
-      }
-    ] : []
+    # Allow inbound from each public ALB
+    [for name, lb in module.public_alb : {
+      description                  = "Allow inbound from public ALB ${name}"
+      from_port                    = -1
+      to_port                      = -1
+      ip_protocol                  = "-1"
+      referenced_security_group_id = lb.security_group_id
+    }],
+    # Allow inbound from each private ALB
+    [for name, lb in module.private_alb : {
+      description                  = "Allow inbound from private ALB ${name}"
+      from_port                    = -1
+      to_port                      = -1
+      ip_protocol                  = "-1"
+      referenced_security_group_id = lb.security_group_id
+    }]
   )
 }
 

compute/ecs_cluster/load_balancers.tf

@@ -1,13 +1,13 @@
 ################################################################################
-# Public Application Load Balancer
+# Public Application Load Balancers
 ################################################################################
 
 module "public_alb" {
-  count = var.public_alb_enabled ? 1 : 0
+  for_each = local.public_albs_by_name
 
   source = "../../networking/alb"
 
-  name   = "${var.name}-pub"
+  name   = each.key
   tags   = var.tags
   vpc_id = var.vpc_id
 
@@ -16,40 +16,40 @@ module "public_alb" {
 
   # Listener configuration
   http_listener_enabled          = true
-  https_listener_enabled         = var.public_alb_https_enabled
-  http_to_https_redirect_enabled = var.public_alb_https_enabled
+  https_listener_enabled         = each.value.https_enabled
+  http_to_https_redirect_enabled = each.value.https_enabled
 
   # SSL/TLS
-  certificate_arns = var.public_alb_certificate_arns
-  ssl_policy       = var.public_alb_ssl_policy
+  certificate_arns = each.value.certificate_arns
+  ssl_policy       = each.value.ssl_policy
 
   # ALB settings
-  idle_timeout                = var.public_alb_idle_timeout
+  idle_timeout                = each.value.idle_timeout
   deletion_protection_enabled = var.load_balancer_deletion_protection_enabled
 
   # Security
-  ingress_cidr_blocks        = var.public_alb_ingress_cidr_blocks
-  ingress_ipv6_cidr_blocks   = var.public_alb_ingress_ipv6_cidr_blocks
-  ingress_security_group_ids = var.public_alb_ingress_security_group_ids
+  ingress_cidr_blocks        = each.value.ingress_cidr_blocks
+  ingress_ipv6_cidr_blocks   = each.value.ingress_ipv6_cidr_blocks
+  ingress_security_group_ids = each.value.ingress_security_group_ids
 
   # Access logs
-  access_logs_enabled    = var.public_alb_access_logs_enabled
-  access_logs_bucket_arn = var.public_alb_access_logs_bucket_arn
+  access_logs_enabled    = each.value.access_logs_enabled
+  access_logs_bucket_arn = each.value.access_logs_bucket_arn
 
   # WAF
-  web_acl_arn = var.public_alb_web_acl_arn
+  web_acl_arn = each.value.web_acl_arn
 }
 
 ################################################################################
-# Private Application Load Balancer
+# Private Application Load Balancers
 ################################################################################
 
 module "private_alb" {
-  count = var.private_alb_enabled ? 1 : 0
+  for_each = local.private_albs_by_name
 
   source = "../../networking/alb"
 
-  name   = "${var.name}-priv"
+  name   = each.key
   tags   = var.tags
   vpc_id = var.vpc_id
 
@@ -58,37 +58,37 @@ module "private_alb" {
 
   # Listener configuration
   http_listener_enabled          = true
-  https_listener_enabled         = var.private_alb_https_enabled
-  http_to_https_redirect_enabled = var.private_alb_https_enabled
+  https_listener_enabled         = each.value.https_enabled
+  http_to_https_redirect_enabled = each.value.https_enabled
 
   # SSL/TLS
-  certificate_arns = var.private_alb_certificate_arns
-  ssl_policy       = var.private_alb_ssl_policy
+  certificate_arns = each.value.certificate_arns
+  ssl_policy       = each.value.ssl_policy
 
   # ALB settings
-  idle_timeout                = var.private_alb_idle_timeout
+  idle_timeout                = each.value.idle_timeout
   deletion_protection_enabled = var.load_balancer_deletion_protection_enabled
 
   # Security
-  ingress_cidr_blocks        = var.private_alb_ingress_cidr_blocks
-  ingress_ipv6_cidr_blocks   = var.private_alb_ingress_ipv6_cidr_blocks
-  ingress_security_group_ids = var.private_alb_ingress_security_group_ids
+  ingress_cidr_blocks        = each.value.ingress_cidr_blocks
+  ingress_ipv6_cidr_blocks   = each.value.ingress_ipv6_cidr_blocks
+  ingress_security_group_ids = each.value.ingress_security_group_ids
 
   # Access logs
-  access_logs_enabled    = var.private_alb_access_logs_enabled
-  access_logs_bucket_arn = var.private_alb_access_logs_bucket_arn
+  access_logs_enabled    = each.value.access_logs_enabled
+  access_logs_bucket_arn = each.value.access_logs_bucket_arn
 }
 
 ################################################################################
-# Public Network Load Balancer
+# Public Network Load Balancers
 ################################################################################
 
 module "public_nlb" {
-  count = var.public_nlb_enabled ? 1 : 0
+  for_each = local.public_nlbs_by_name
 
   source = "../../networking/nlb"
 
-  name   = "${var.name}-pub-nlb"
+  name   = each.key
   tags   = var.tags
   vpc_id = var.vpc_id
 
@@ -97,30 +97,30 @@ module "public_nlb" {
 
   # NLB settings
   deletion_protection_enabled       = var.load_balancer_deletion_protection_enabled
-  cross_zone_load_balancing_enabled = var.public_nlb_cross_zone_load_balancing_enabled
+  cross_zone_load_balancing_enabled = each.value.cross_zone_load_balancing_enabled
 
   # Security groups
-  additional_security_group_ids = var.public_nlb_security_group_ids
+  additional_security_group_ids = each.value.security_group_ids
 
   # Access logs
-  access_logs_enabled    = var.public_nlb_access_logs_enabled
-  access_logs_bucket_arn = var.public_nlb_access_logs_bucket_arn
+  access_logs_enabled    = each.value.access_logs_enabled
+  access_logs_bucket_arn = each.value.access_logs_bucket_arn
 
   # Elastic IPs
-  elastic_ips_enabled       = var.public_nlb_elastic_ips_enabled
-  elastic_ip_allocation_ids = var.public_nlb_elastic_ip_allocation_ids
+  elastic_ips_enabled       = each.value.elastic_ips_enabled
+  elastic_ip_allocation_ids = each.value.elastic_ip_allocation_ids
 }
 
 ################################################################################
-# Private Network Load Balancer
+# Private Network Load Balancers
 ################################################################################
 
 module "private_nlb" {
-  count = var.private_nlb_enabled ? 1 : 0
+  for_each = local.private_nlbs_by_name
 
   source = "../../networking/nlb"
 
-  name   = "${var.name}-priv-nlb"
+  name   = each.key
   tags   = var.tags
   vpc_id = var.vpc_id
 
@@ -129,16 +129,16 @@ module "private_nlb" {
 
   # NLB settings
   deletion_protection_enabled       = var.load_balancer_deletion_protection_enabled
-  cross_zone_load_balancing_enabled = var.private_nlb_cross_zone_load_balancing_enabled
+  cross_zone_load_balancing_enabled = each.value.cross_zone_load_balancing_enabled
 
   # Security groups
-  additional_security_group_ids = var.private_nlb_security_group_ids
+  additional_security_group_ids = each.value.security_group_ids
 
   # Access logs
-  access_logs_enabled    = var.private_nlb_access_logs_enabled
-  access_logs_bucket_arn = var.private_nlb_access_logs_bucket_arn
+  access_logs_enabled    = each.value.access_logs_enabled
+  access_logs_bucket_arn = each.value.access_logs_bucket_arn
 
   # Elastic IPs
-  elastic_ips_enabled       = var.private_nlb_elastic_ips_enabled
-  elastic_ip_allocation_ids = var.private_nlb_elastic_ip_allocation_ids
+  elastic_ips_enabled       = each.value.elastic_ips_enabled
+  elastic_ip_allocation_ids = each.value.elastic_ip_allocation_ids
 }

compute/ecs_cluster/locals.tf

@@ -66,3 +66,21 @@ locals {
     var.ec2_spot_instance_types
   ) : []
 }
+
+################################################################################
+# Load Balancer Names
+################################################################################
+
+locals {
+  public_alb_names  = [for idx, lb in var.public_albs : coalesce(lb.name, idx == 0 ? "${var.name}-pub" : "${var.name}-pub-${idx + 1}")]
+  private_alb_names = [for idx, lb in var.private_albs : coalesce(lb.name, idx == 0 ? "${var.name}-priv" : "${var.name}-priv-${idx + 1}")]
+  public_nlb_names  = [for idx, lb in var.public_nlbs : coalesce(lb.name, idx == 0 ? "${var.name}-pub-nlb" : "${var.name}-pub-nlb-${idx + 1}")]
+  private_nlb_names = [for idx, lb in var.private_nlbs : coalesce(lb.name, idx == 0 ? "${var.name}-priv-nlb" : "${var.name}-priv-nlb-${idx + 1}")]
+
+  # Load balancer configs keyed by resolved name so Terraform addresses stay
+  # stable when entries are inserted, removed, or reordered.
+  public_albs_by_name  = { for idx, lb in var.public_albs : local.public_alb_names[idx] => lb }
+  private_albs_by_name = { for idx, lb in var.private_albs : local.private_alb_names[idx] => lb }
+  public_nlbs_by_name  = { for idx, lb in var.public_nlbs : local.public_nlb_names[idx] => lb }
+  private_nlbs_by_name = { for idx, lb in var.private_nlbs : local.private_nlb_names[idx] => lb }
+}