Add authentication action to ALB listener rules (cloudposse#12)

* Bump `terraform-terraform-label` version

* Add authentication action to ALB listener rules

* Rename local var

Author: aknysh

LICENSE

@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2018 Cloud Posse, LLC
+   Copyright 2018-2019 Cloud Posse, LLC
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

main.tf

@@ -1,18 +1,16 @@
 locals {
-  create_target_group = "${var.target_group_arn == "" ? "true" : "false"}"
-}
-
-locals {
-  target_group_arn = "${local.create_target_group == "true" ? aws_lb_target_group.default.arn : var.target_group_arn}"
+  target_group_enabled   = "${var.target_group_arn == "" ? "true" : "false"}"
+  target_group_arn       = "${local.target_group_enabled == "true" ? aws_lb_target_group.default.arn : var.target_group_arn}"
+  authentication_enabled = "${var.authentication_enabled == "true" ? true : false}"
 }
 
 data "aws_lb_target_group" "default" {
   arn = "${local.target_group_arn}"
 }
 
 module "default_label" {
-  enabled    = "${local.create_target_group}"
-  source     = "git::https://github.com/cloudposse/terraform-terraform-label.git?ref=tags/0.1.3"
+  enabled    = "${local.target_group_enabled}"
+  source     = "git::https://github.com/cloudposse/terraform-terraform-label.git?ref=tags/0.2.1"
   attributes = "${var.attributes}"
   delimiter  = "${var.delimiter}"
   name       = "${var.name}"
@@ -22,7 +20,7 @@ module "default_label" {
 }
 
 resource "aws_lb_target_group" "default" {
-  count       = "${local.create_target_group == "true" ? 1 : 0}"
+  count       = "${local.target_group_enabled == "true" ? 1 : 0}"
   name        = "${module.default_label.id}"
   port        = "${var.port}"
   protocol    = "${var.protocol}"
@@ -45,48 +43,116 @@ resource "aws_lb_target_group" "default" {
   }
 }
 
-resource "aws_lb_listener_rule" "paths" {
-  count        = "${length(var.paths) > 0 && length(var.hosts) == 0 ? var.listener_arns_count : 0}"
+resource "aws_lb_listener_rule" "paths_no_authentication" {
+  count        = "${length(var.paths) > 0 && length(var.hosts) == 0 && local.authentication_enabled == false ? var.listener_arns_count : 0}"
   listener_arn = "${var.listener_arns[count.index]}"
   priority     = "${var.priority + count.index}"
 
-  action {
-    type             = "forward"
-    target_group_arn = "${local.target_group_arn}"
+  action = [
+    {
+      type             = "forward"
+      target_group_arn = "${local.target_group_arn}"
+    },
+  ]
+
+  condition {
+    field  = "path-pattern"
+    values = ["${var.paths}"]
   }
+}
+
+resource "aws_lb_listener_rule" "paths_with_authentication" {
+  count        = "${length(var.paths) > 0 && length(var.hosts) == 0 && local.authentication_enabled == true ? var.listener_arns_count : 0}"
+  listener_arn = "${var.listener_arns[count.index]}"
+  priority     = "${var.priority + count.index}"
+
+  action = [
+    "${var.authentication_action}",
+    {
+      type             = "forward"
+      target_group_arn = "${local.target_group_arn}"
+    },
+  ]
 
   condition {
     field  = "path-pattern"
     values = ["${var.paths}"]
   }
 }
 
-resource "aws_lb_listener_rule" "hosts" {
-  count        = "${length(var.hosts) > 0 && length(var.paths) == 0 ? var.listener_arns_count : 0}"
+resource "aws_lb_listener_rule" "hosts_no_authentication" {
+  count        = "${length(var.hosts) > 0 && length(var.paths) == 0 && local.authentication_enabled == false ? var.listener_arns_count : 0}"
   listener_arn = "${var.listener_arns[count.index]}"
   priority     = "${var.priority + count.index}"
 
-  action {
-    type             = "forward"
-    target_group_arn = "${local.target_group_arn}"
+  action = [
+    {
+      type             = "forward"
+      target_group_arn = "${local.target_group_arn}"
+    },
+  ]
+
+  condition {
+    field  = "host-header"
+    values = ["${var.hosts}"]
   }
+}
+
+resource "aws_lb_listener_rule" "hosts_with_authentication" {
+  count        = "${length(var.hosts) > 0 && length(var.paths) == 0 && local.authentication_enabled == true ? var.listener_arns_count : 0}"
+  listener_arn = "${var.listener_arns[count.index]}"
+  priority     = "${var.priority + count.index}"
+
+  action = [
+    "${var.authentication_action}",
+    {
+      type             = "forward"
+      target_group_arn = "${local.target_group_arn}"
+    },
+  ]
 
   condition {
     field  = "host-header"
     values = ["${var.hosts}"]
   }
 }
 
-resource "aws_lb_listener_rule" "hosts_paths" {
-  count        = "${length(var.paths) > 0 && length(var.hosts) > 0 ? var.listener_arns_count : 0}"
+resource "aws_lb_listener_rule" "hosts_paths_no_authentication" {
+  count        = "${length(var.paths) > 0 && length(var.hosts) > 0 && local.authentication_enabled == false ? var.listener_arns_count : 0}"
   listener_arn = "${var.listener_arns[count.index]}"
   priority     = "${var.priority + count.index}"
 
-  action {
-    type             = "forward"
-    target_group_arn = "${local.target_group_arn}"
+  action = [
+    {
+      type             = "forward"
+      target_group_arn = "${local.target_group_arn}"
+    },
+  ]
+
+  condition {
+    field  = "host-header"
+    values = ["${var.hosts}"]
   }
 
+  condition {
+    field  = "path-pattern"
+    values = ["${var.paths}"]
+  }
+}
+
+resource "aws_lb_listener_rule" "hosts_paths_with_authentication" {
+  count        = "${length(var.paths) > 0 && length(var.hosts) > 0 && local.authentication_enabled == true ? var.listener_arns_count : 0}"
+  listener_arn = "${var.listener_arns[count.index]}"
+  priority     = "${var.priority + count.index}"
+
+  action = [
+    "${var.authentication_action}",
+    {
+      type             = "forward"
+      target_group_arn = "${local.target_group_arn}"
+    },
+  ]
+
   condition {
     field  = "host-header"
     values = ["${var.hosts}"]

variables.tf

@@ -46,7 +46,7 @@ variable "listener_arns" {
 variable "listener_arns_count" {
   type        = "string"
   default     = "0"
-  description = "The number of ARNs in listener_arns, this is necessary to work around a limitation in Terraform where counts cannot be computed"
+  description = "The number of ARNs in `listener_arns`. This is necessary to work around a limitation in Terraform where counts cannot be computed"
 }
 
 variable "deregistration_delay" {
@@ -130,3 +130,15 @@ variable "paths" {
   default     = []
   description = "Path pattern to match (a maximum of 1 can be defined), at least one of hosts or paths must be set"
 }
+
+variable "authentication_enabled" {
+  type        = "string"
+  default     = "false"
+  description = "Whether to enable authentication action for ALB listener to authenticate users with Cognito or OIDC"
+}
+
+variable "authentication_action" {
+  type        = "map"
+  default     = {}
+  description = "Authentication action to be placed in front of all other ALB listener actions to authenticate users with Cognito or OIDC. Required when `authentication_enabled=true`"
+}