Application Load Balancer (ALB)

This document describes the Terraform module used to provision an AWS Application Load Balancer (ALB) for the kattehotell application.

The ALB is deployed using a reusable internal Terraform module from the BYM infrastructure repository.

Overview

The ALB module provisions:

• Application Load Balancer (Layer 7)
• Security Group controlling inbound/outbound access to/from the ALB
• HTTPS listener using ACM certificate
• Route53 DNS record for public access

The module supports both internet-facing and internal Application Load Balancers for HTTP and HTTPS workloads.

Architecture Diagram

flowchart TD

    user@{ label: "Internet / AWS Internal Network" }

    route53@{ label: "Route53 DNS" }
    alb@{ label: "Application Load Balancer (ALB)" }
    sg@{ label: "Security Group" }
    tg@{ label: "Target Group" }

    ec2@{ label: "EC2" }
    ecs@{ label: "ECS Service" }
    lambda@{ label: "Lambda" }

    %% --- Animated-style traffic flow (Zensical feature) ---
    user A@-.->|HTTPS Request| route53
    route53 B@-.->|DNS Resolution| alb
    alb C@-.->|Forward Traffic| tg
    tg D@-.-> ec2
    tg E@-.-> ecs
    tg F@-.-> lambda

    %% --- Control plane (non-traffic) ---
    sg G@-.->|Inbound Rules| alb

    %% --- Animation hints (Zensical extension) ---
    A@{ animation: fast }
    B@{ animation: fast }
    C@{ animation: fast }
    D@{ animation: fast }
    E@{ animation: fast }
    F@{ animation: fast }
    G@{ animation: fast }

    %% --- Styling ---
    classDef user fill:#E3F2FD,stroke:#1E88E5,stroke-width:2px,color:#0D47A1;
    classDef dns fill:#E8F5E9,stroke:#43A047,stroke-width:2px,color:#1B5E20;
    classDef alb fill:#F3E5F5,stroke:#8E24AA,stroke-width:2px,color:#4A148C;
    classDef tg fill:#EDE7F6,stroke:#5E35B1,stroke-width:2px,color:#311B92;
    classDef compute fill:#FCE4EC,stroke:#D81B60,stroke-width:2px,color:#880E4F;
    classDef security fill:#FFF3E0,stroke:#FB8C00,stroke-width:2px,color:#E65100;

    class user user;
    class route53 dns;
    class alb alb;
    class tg tg;
    class ec2,ecs,lambda compute;
    class sg security;

Terraform Module

Environment-Specific Configuration

The Route53 hosted zone depends on the deployment environment.

Update the following values according to the target environment.

data "aws_ssm_parameter" "vpc_information" {
  name = "/bym/vpc"
}

data "aws_route53_zone" "route53_zone" {
  provider = aws.route53
  name     = "<Route53 Zone>"
}

locals {
  vpc                = jsondecode(data.aws_ssm_parameter.vpc_information.insecure_value)
  route53_domain     = "<Route53 Zone>"
  alb_primary_domain = "${lower(replace(var.application_name, "_", "-"))}-alb-default.${data.aws_route53_zone.route53_zone.name}"
}

module "alb" {
  source = "git@github.com:BYM-IKT/terraform-aws-alb.git?ref=v3"
  application_name   = "kattehotell"
  alb_sg_description = "The SecurityGroup of the ALB"
  environment        = var.environment
  is_private         = false # Set it to true for internal ALB
  vpc                = local.vpc

  acm_config = {
    primary_domain = {
      dns_record     = local.alb_primary_domain
      route53_domain = data.aws_route53_zone.route53_zone.name
    }
  }

  providers = {
    aws         = aws.byks
    aws.route53 = aws.route53
  }
}

Configuration

Application Name

application_name = "kattehotell"

• ALB naming
• Resource tagging
• Metrics/log identification

Environment

environment = var.environment

• dev
• test
• prod

Is private

This is one of the most important deployment decisions.

By default, ALBs are internet-facing and publicly accessible. In some cases, applications should only be accessible from within the AWS VPC or through private network connectivity. In these situations, an internal ALB should be used.

If you are unsure whether your application requires a public or internal ALB, contact Team Cloud for guidance.

VPC

vpc = local.vpc

• Subnets
• Routing context
• Network isolation boundary

ACM / TLS Configuration

alb_primary_domain = "${lower(replace(var.application_name, "_", "-"))}-alb-default.${data.aws_route53_zone.route53_zone.name}"

Example:

kattehotell-alb-default.test.bymoslo.net

acm_config = {
  primary_domain = {
    dns_record     = local.alb_primary_domain
    route53_domain = data.aws_route53_zone.route53_zone.name
  }
}

• TLS certificate provisioning via ACM
• DNS validation using Route53
• Enabling HTTPS on ALB

Providers

providers = {
  aws         = aws.byks
  aws.route53 = aws.route53
}

• Multi-account AWS deployments
• Route53 hosted zone separation
• Controlled resource provisioning