terraform-https-alb-lambda

A Terraform template that provisions HTTPS applications using ALB and Lambda.

This will give you a running endpoint in the following format:

https://${environment}.${app}.${domain}

Note that after terraform apply, you will have a "hello world" function behind an HTTPS endpoint. The template stops after provisioning the cloud infrastructure and assumes that you will use a different tool to do ongoing code deployments.

Components

base

These components are shared by all environments.

Name	Description	Optional
main.tf	AWS provider, output
state.tf	S3 bucket backend for storing Terraform remote state

env/dev

These components are for a specific environment. There should be a corresponding directory for each environment that is needed.

Name	Description	Optional
main.tf	AWS provider
lambda.tf	Lambda function
lb.tf	ALB, Target Group, S3 bucket for access logs
lb-http.tf	HTTP listener, NSG rule	Yes
lb-https.tf	HTTPS listener, NSG rule
dns-cert.tf	Route53 entry and ACM Certificate
nsg.tf	NSG for ALB and function
role.tf	Application Role for function
cicd.tf	IAM user that can be used by CI/CD systems to deploy code	Yes
secretsmanager.tf	Secret in Secrets Manager	Yes
dashboard.tf	CloudWatch dashboard: CPU, memory, and HTTP-related metrics	Yes

Usage

Typically, the base Terraform will only need to be run once, and then should only need changes very infrequently. After the base is built, each environment can be built.

# Move into the base directory
$ cd base

# Sets up Terraform to run
$ terraform init

# Executes the Terraform run
$ terraform apply

# Now, move into the dev environment
$ cd ../env/dev

# Sets up Terraform to run
$ terraform init

# Executes the Terraform run
$ terraform apply

Important (after initial `terraform apply`)

The generated base .tfstate is not stored in the remote state S3 bucket. Ensure the base .tfstate is checked into your infrastructure repo. The default Terraform .gitignore generated by GitHub will ignore all .tfstate files; you'll need to modify this