Compute

1# heroku-to-aws compute shape that also has a STANDALONE ALB (aws_lb + aws_lb_listener) —
2# e.g. a Fargate-fronted web tier, or an EB env behind a caller-managed ALB. The standalone
3# listener is what the policy gate inspects, so this fixture exercises the ALB TLS + redirect
4# rules on real listener blocks. NOTE: a pure Elastic Beanstalk LoadBalanced env does NOT emit
5# aws_lb/aws_lb_listener (EB provisions the ALB from setting blocks the static checker cannot
6# read) — see good-heroku-eb-only/ for that case, which passes the ALB rules vacuously.
7
8resource "aws_elastic_beanstalk_application" "web" {
9  name = "${var.project_name}-web"
10}
11
12resource "aws_elastic_beanstalk_environment" "web" {
13  name                = "${var.project_name}-web"
14  application         = aws_elastic_beanstalk_application.web.name
15  solution_stack_name = data.aws_elastic_beanstalk_solution_stack.web.name
16  tier                = "WebServer"
17
18  setting {
19    namespace = "aws:autoscaling:launchconfiguration"
20    name      = "IamInstanceProfile"
21    value     = aws_iam_instance_profile.eb.name
22  }
23  setting {
24    namespace = "aws:autoscaling:launchconfiguration"
25    name      = "SecurityGroups"
26    value     = aws_security_group.eb_instances.id
27  }
28  setting {
29    namespace = "aws:autoscaling:launchconfiguration"
30    name      = "InstanceType"
31    value     = var.instance_type_web
32  }
33  setting {
34    namespace = "aws:elasticbeanstalk:environment"
35    name      = "EnvironmentType"
36    value     = "LoadBalanced"
37  }
38  setting {
39    namespace = "aws:elasticbeanstalk:environment"
40    name      = "LoadBalancerType"
41    value     = "application"
42  }
43  setting {
44    namespace = "aws:ec2:vpc"
45    name      = "ELBScheme"
46    value     = "public"
47  }
48}
49
50data "aws_elastic_beanstalk_solution_stack" "web" {
51  most_recent = true
52  name_regex  = "64bit Amazon Linux 2023 (.*) running Python 3.12"
53}
54
55resource "aws_lb" "web" {
56  name               = "${var.project_name}-web"
57  load_balancer_type = "application"
58  security_groups    = [aws_security_group.alb.id]
59  subnets            = var.public_subnet_ids
60}
61
62resource "aws_lb_listener" "https" {
63  load_balancer_arn = aws_lb.web.arn
64  port              = 443
65  protocol          = "HTTPS"
66  certificate_arn   = var.certificate_arn
67
68  default_action {
69    type             = "forward"
70    target_group_arn = aws_lb_target_group.web.arn
71  }
72}
73
74resource "aws_lb_listener" "http_redirect" {
75  load_balancer_arn = aws_lb.web.arn
76  port              = 80
77  protocol          = "HTTP"
78
79  default_action {
80    type = "redirect"
81    redirect {
82      port        = "443"
83      protocol    = "HTTPS"
84      status_code = "HTTP_301"
85    }
86  }
87}