Skip to content

Commit abcd8bf

Browse files
evan-clearyevan-cleary
committed
r/aws_lb: Add enforce_security_group_inbound_rules_on_private_link_traffic
1 parent b5b5301 commit abcd8bf

File tree

5 files changed

+130
-1
lines changed

5 files changed

+130
-1
lines changed

‎.changelog/33767.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
resource/aws_lb: Add `enforce_security_group_inbound_rules_on_private_link_traffic` attribute
3+
```

‎internal/service/elbv2/load_balancer.go

+16-1
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,13 @@ func ResourceLoadBalancer() *schema.Resource {
160160
Default: false,
161161
DiffSuppressFunc: suppressIfLBTypeNot(elbv2.LoadBalancerTypeEnumApplication),
162162
},
163+
"enforce_security_group_inbound_rules_on_private_link_traffic": {
164+
Type: schema.TypeString,
165+
Optional: true,
166+
Computed: true,
167+
ValidateFunc: validation.StringInSlice(elbv2.EnforceSecurityGroupInboundRulesOnPrivateLinkTrafficEnum_Values(), false),
168+
DiffSuppressFunc: suppressIfLBTypeNot(elbv2.LoadBalancerTypeEnumNetwork),
169+
},
163170
"idle_timeout": {
164171
Type: schema.TypeInt,
165172
Optional: true,
@@ -574,13 +581,20 @@ func resourceLoadBalancerUpdate(ctx context.Context, d *schema.ResourceData, met
574581
}
575582
}
576583

577-
if d.HasChange("security_groups") {
584+
if d.HasChanges("security_groups", "enforce_security_group_inbound_rules_on_private_link_traffic") {
578585
sgs := flex.ExpandStringSet(d.Get("security_groups").(*schema.Set))
579586

580587
params := &elbv2.SetSecurityGroupsInput{
581588
LoadBalancerArn: aws.String(d.Id()),
582589
SecurityGroups: sgs,
583590
}
591+
592+
if v := d.Get("load_balancer_type"); v == elbv2.LoadBalancerTypeEnumNetwork {
593+
if v, ok := d.GetOk("enforce_security_group_inbound_rules_on_private_link_traffic"); ok {
594+
params.EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic = aws.String(v.(string))
595+
}
596+
}
597+
584598
_, err := conn.SetSecurityGroupsWithContext(ctx, params)
585599
if err != nil {
586600
return sdkdiag.AppendErrorf(diags, "failure Setting LB Security Groups: %s", err)
@@ -918,6 +932,7 @@ func flattenResource(ctx context.Context, d *schema.ResourceData, meta interface
918932
d.Set("arn_suffix", SuffixFromARN(lb.LoadBalancerArn))
919933
d.Set("customer_owned_ipv4_pool", lb.CustomerOwnedIpv4Pool)
920934
d.Set("dns_name", lb.DNSName)
935+
d.Set("enforce_security_group_inbound_rules_on_private_link_traffic", lb.EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic)
921936
d.Set("internal", aws.StringValue(lb.Scheme) == elbv2.LoadBalancerSchemeEnumInternal)
922937
d.Set("ip_address_type", lb.IpAddressType)
923938
d.Set("load_balancer_type", lb.Type)

‎internal/service/elbv2/load_balancer_data_source.go

+5
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,10 @@ func DataSourceLoadBalancer() *schema.Resource {
102102
Type: schema.TypeBool,
103103
Computed: true,
104104
},
105+
"enforce_security_group_inbound_rules_on_private_link_traffic": {
106+
Type: schema.TypeString,
107+
Computed: true,
108+
},
105109
"idle_timeout": {
106110
Type: schema.TypeInt,
107111
Computed: true,
@@ -247,6 +251,7 @@ func dataSourceLoadBalancerRead(ctx context.Context, d *schema.ResourceData, met
247251
d.Set("ip_address_type", lb.IpAddressType)
248252
d.Set("load_balancer_type", lb.Type)
249253
d.Set("customer_owned_ipv4_pool", lb.CustomerOwnedIpv4Pool)
254+
d.Set("enforce_security_group_inbound_rules_on_private_link_traffic", lb.EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic)
250255

251256
if err := d.Set("subnets", flattenSubnetsFromAvailabilityZones(lb.AvailabilityZones)); err != nil {
252257
return sdkdiag.AppendErrorf(diags, "setting subnets: %s", err)

‎internal/service/elbv2/load_balancer_test.go

+105
Original file line numberDiff line numberDiff line change
@@ -889,13 +889,15 @@ func TestAccELBV2LoadBalancer_ApplicationLoadBalancer_updatedSecurityGroups(t *t
889889
Check: resource.ComposeAggregateTestCheckFunc(
890890
testAccCheckLoadBalancerExists(ctx, resourceName, &pre),
891891
resource.TestCheckResourceAttr(resourceName, "security_groups.#", "1"),
892+
resource.TestCheckResourceAttr(resourceName, "enforce_security_group_inbound_rules_on_private_link_traffic", ""),
892893
),
893894
},
894895
{
895896
Config: testAccLoadBalancerConfig_albUpdateSecurityGroups(rName),
896897
Check: resource.ComposeAggregateTestCheckFunc(
897898
testAccCheckLoadBalancerExists(ctx, resourceName, &post),
898899
resource.TestCheckResourceAttr(resourceName, "security_groups.#", "2"),
900+
resource.TestCheckResourceAttr(resourceName, "enforce_security_group_inbound_rules_on_private_link_traffic", ""),
899901
testAccCheckLoadBalancerNotRecreated(&pre, &post),
900902
),
901903
},
@@ -1321,6 +1323,7 @@ func TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateSecurityGroups(t *testin
13211323
Check: resource.ComposeAggregateTestCheckFunc(
13221324
testAccCheckLoadBalancerExists(ctx, resourceName, &lb1),
13231325
resource.TestCheckResourceAttr(resourceName, "security_groups.#", "0"),
1326+
resource.TestCheckResourceAttr(resourceName, "enforce_security_group_inbound_rules_on_private_link_traffic", ""),
13241327
),
13251328
},
13261329
{
@@ -1329,6 +1332,7 @@ func TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateSecurityGroups(t *testin
13291332
testAccCheckLoadBalancerExists(ctx, resourceName, &lb2),
13301333
testAccCheckLoadBalancerRecreated(&lb2, &lb1),
13311334
resource.TestCheckResourceAttr(resourceName, "security_groups.#", "1"),
1335+
resource.TestCheckResourceAttr(resourceName, "enforce_security_group_inbound_rules_on_private_link_traffic", ""),
13321336
),
13331337
},
13341338
{
@@ -1337,6 +1341,7 @@ func TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateSecurityGroups(t *testin
13371341
testAccCheckLoadBalancerExists(ctx, resourceName, &lb3),
13381342
testAccCheckLoadBalancerNotRecreated(&lb3, &lb2),
13391343
resource.TestCheckResourceAttr(resourceName, "security_groups.#", "2"),
1344+
resource.TestCheckResourceAttr(resourceName, "enforce_security_group_inbound_rules_on_private_link_traffic", ""),
13401345
),
13411346
},
13421347
{
@@ -1345,6 +1350,67 @@ func TestAccELBV2LoadBalancer_NetworkLoadBalancer_updateSecurityGroups(t *testin
13451350
testAccCheckLoadBalancerExists(ctx, resourceName, &lb4),
13461351
testAccCheckLoadBalancerRecreated(&lb4, &lb3),
13471352
resource.TestCheckResourceAttr(resourceName, "security_groups.#", "0"),
1353+
resource.TestCheckResourceAttr(resourceName, "enforce_security_group_inbound_rules_on_private_link_traffic", ""),
1354+
),
1355+
},
1356+
},
1357+
})
1358+
}
1359+
1360+
func TestAccELBV2LoadBalancer_NetworkLoadBalancer_enforcePrivateLink(t *testing.T) {
1361+
ctx := acctest.Context(t)
1362+
var lb1 elbv2.LoadBalancer
1363+
rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
1364+
resourceName := "aws_lb.test"
1365+
1366+
resource.ParallelTest(t, resource.TestCase{
1367+
PreCheck: func() { acctest.PreCheck(ctx, t) },
1368+
ErrorCheck: acctest.ErrorCheck(t, elbv2.EndpointsID),
1369+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
1370+
CheckDestroy: testAccCheckLoadBalancerDestroy(ctx),
1371+
Steps: []resource.TestStep{
1372+
{
1373+
Config: testAccLoadBalancerConfig_nlbSecurityGroupsEnforcePrivateLink(rName, 1, "off"),
1374+
Check: resource.ComposeAggregateTestCheckFunc(
1375+
testAccCheckLoadBalancerExists(ctx, resourceName, &lb1),
1376+
resource.TestCheckResourceAttr(resourceName, "security_groups.#", "1"),
1377+
resource.TestCheckResourceAttr(resourceName, "enforce_security_group_inbound_rules_on_private_link_traffic", "off")),
1378+
},
1379+
{
1380+
ResourceName: resourceName,
1381+
ImportState: true,
1382+
ImportStateVerify: true,
1383+
},
1384+
{
1385+
Config: testAccLoadBalancerConfig_nlbSecurityGroups(rName, 1),
1386+
Check: resource.ComposeAggregateTestCheckFunc(
1387+
testAccCheckLoadBalancerExists(ctx, resourceName, &lb1),
1388+
resource.TestCheckResourceAttr(resourceName, "security_groups.#", "1"),
1389+
resource.TestCheckResourceAttr(resourceName, "enforce_security_group_inbound_rules_on_private_link_traffic", "off"),
1390+
),
1391+
},
1392+
{
1393+
Config: testAccLoadBalancerConfig_nlbSecurityGroupsEnforcePrivateLink(rName, 1, "on"),
1394+
Check: resource.ComposeAggregateTestCheckFunc(
1395+
testAccCheckLoadBalancerExists(ctx, resourceName, &lb1),
1396+
resource.TestCheckResourceAttr(resourceName, "security_groups.#", "1"),
1397+
resource.TestCheckResourceAttr(resourceName, "enforce_security_group_inbound_rules_on_private_link_traffic", "on"),
1398+
),
1399+
},
1400+
{
1401+
Config: testAccLoadBalancerConfig_nlbSecurityGroupsEnforcePrivateLink(rName, 1, "off"),
1402+
Check: resource.ComposeAggregateTestCheckFunc(
1403+
testAccCheckLoadBalancerExists(ctx, resourceName, &lb1),
1404+
resource.TestCheckResourceAttr(resourceName, "security_groups.#", "1"),
1405+
resource.TestCheckResourceAttr(resourceName, "enforce_security_group_inbound_rules_on_private_link_traffic", "off"),
1406+
),
1407+
},
1408+
{
1409+
Config: testAccLoadBalancerConfig_nlbSecurityGroups(rName, 1),
1410+
Check: resource.ComposeAggregateTestCheckFunc(
1411+
testAccCheckLoadBalancerExists(ctx, resourceName, &lb1),
1412+
resource.TestCheckResourceAttr(resourceName, "security_groups.#", "1"),
1413+
resource.TestCheckResourceAttr(resourceName, "enforce_security_group_inbound_rules_on_private_link_traffic", "off"),
13481414
),
13491415
},
13501416
},
@@ -2531,6 +2597,45 @@ resource "aws_lb" "test" {
25312597
`, rName, n))
25322598
}
25332599

2600+
func testAccLoadBalancerConfig_nlbSecurityGroupsEnforcePrivateLink(rName string, n int, enforcePrivateLink string) string {
2601+
return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, 2), fmt.Sprintf(`
2602+
resource "aws_security_group" "test" {
2603+
count = 3
2604+
2605+
name = "%[1]s-${count.index}"
2606+
vpc_id = aws_vpc.test.id
2607+
2608+
ingress {
2609+
from_port = 0
2610+
to_port = 0
2611+
protocol = "-1"
2612+
cidr_blocks = ["0.0.0.0/0"]
2613+
}
2614+
2615+
egress {
2616+
from_port = 0
2617+
to_port = 0
2618+
protocol = "-1"
2619+
cidr_blocks = ["0.0.0.0/0"]
2620+
}
2621+
2622+
tags = {
2623+
Name = %[1]q
2624+
}
2625+
}
2626+
2627+
resource "aws_lb" "test" {
2628+
internal = true
2629+
load_balancer_type = "network"
2630+
name = %[1]q
2631+
subnets = aws_subnet.test[*].id
2632+
security_groups = slice(aws_security_group.test[*].id, 0, %[2]d)
2633+
2634+
enforce_security_group_inbound_rules_on_private_link_traffic = %[3]q
2635+
}
2636+
`, rName, n, enforcePrivateLink))
2637+
}
2638+
25342639
func testAccLoadBalancerConfig_nlbSubnets(rName string, subnetCount int) string {
25352640
return acctest.ConfigCompose(acctest.ConfigVPCWithSubnets(rName, subnetCount), fmt.Sprintf(`
25362641
resource "aws_lb" "test" {

‎website/docs/r/lb.html.markdown

+1
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,7 @@ This argument supports the following arguments:
111111
* `enable_tls_version_and_cipher_suite_headers` - (Optional) Indicates whether the two headers (`x-amzn-tls-version` and `x-amzn-tls-cipher-suite`), which contain information about the negotiated TLS version and cipher suite, are added to the client request before sending it to the target. Only valid for Load Balancers of type `application`. Defaults to `false`
112112
* `enable_xff_client_port` - (Optional) Indicates whether the X-Forwarded-For header should preserve the source port that the client used to connect to the load balancer in `application` load balancers. Defaults to `false`.
113113
* `enable_waf_fail_open` - (Optional) Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. Defaults to `false`.
114+
* `enforce_security_group_inbound_rules_on_private_link_traffic` - (Optional) Indicates whether inbound security group rules are enforced for traffic originating from a PrivateLink. Only valid for Load Balancers of type `network`. The possible values are `on` and `off`.
114115
* `idle_timeout` - (Optional) The time in seconds that the connection is allowed to be idle. Only valid for Load Balancers of type `application`. Default: 60.
115116
* `internal` - (Optional) If true, the LB will be internal. Defaults to `false`.
116117
* `ip_address_type` - (Optional) The type of IP addresses used by the subnets for your load balancer. The possible values are `ipv4` and `dualstack`.

0 commit comments

Comments
 (0)