Skip to content

Instantly share code, notes, and snippets.

@kfigiela

kfigiela/alb.tf

Created June 21, 2021 09:38
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save kfigiela/b65d1be13f89c44ac6044995c18a2cf1 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save kfigiela/b65d1be13f89c44ac6044995c18a2cf1 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. kfigiela created this gist Jun 21, 2021.
    37 changes: 37 additions & 0 deletions alb.tf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,37 @@
    resource "aws_lb_listener" "https" {
    load_balancer_arn = aws_lb.frontend.arn
    port = "443"
    protocol = "HTTPS"
    ssl_policy = "ELBSecurityPolicy-2016-08"
    certificate_arn = "TODO-CERT-ARN"

    default_action {
    type = "authenticate-oidc"
    authenticate_oidc {
    authorization_endpoint = "https://accounts.google.com/o/oauth2/v2/auth"
    client_id = jsondecode(data.aws_secretsmanager_secret_version.google.secret_string)["client_id"]
    client_secret = jsondecode(data.aws_secretsmanager_secret_version.google.secret_string)["client_secret"]
    issuer = "https://accounts.google.com"
    token_endpoint = "https://oauth2.googleapis.com/token"
    user_info_endpoint = "https://www.googleapis.com/oauth2/v3/userinfo"
    session_cookie_name = "AWSELBAuthSessionCookie"
    session_timeout = "84600"
    scope = "https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email"
    on_unauthenticated_request = "authenticate"
    authentication_request_extra_params = { "hosted_domain" = "mydomain.com" }
    }
    }

    default_action {
    type = "forward"
    target_group_arn = aws_lb_target_group.http.arn
    }


    resource "aws_secretsmanager_secret" "google" {
    name = "/grafana/google"
    }

    data "aws_secretsmanager_secret_version" "google" {
    secret_id = aws_secretsmanager_secret.google.id
    }