providers/aws: Add ELB Access Logs (supersedes #3708)

[catsby]

Builds off of #3708, adding tests and fixing some issues that I found to cause panics if not done perfectly right.

[catsby]

@tpounds I made a few revisions, let me know if you have questions or see something I shouldn't have done 😄

[tpounds]

@catsby LGTM. Thanks for picking this back up! I forgot to push the website docs change to by pull request last night. Feel free to cherry-pick it if you like.

https://github.com/tpounds/terraform/commit/a93212e1dba7212f6655efbbb3456494e8d84049

[catsby]

@tpounds ah, duh, totally forgot I was supposed to add docs 😆 I cherry-picked yours and updated them to remove the enabled bit. That was the biggest change I made to your original work, I think. To disable, you simply remove the block.

[tpounds]

@catsby Still LGTM. Thanks again!

[phinze]

If we end up with an error here - we probably want to return it, no? Seems like an error here would be a bug we'd need to fix, so better to make it obvious.

[catsby]

Makes sense; updated in 8c32536

[phinze]

Looks good! 🚢

[tonygyerr]

I've been trying to see exactly where this is resolved. Any help?

Error Message

• aws_s3_bucket.a: Error putting S3 logging: InvalidTargetBucketForLogging: You must give the log-delivery group WRITE and READ_ACP permissions to the target bucket

Configuration files
/*
application loadbalancer public
/
resource "aws_alb" "app-pub-alb" {
name = "app-pub-alb"
internal = false
security_groups = ["${aws_security_group.app-lb-pub-sg.id}"]
subnets = ["${element(aws_subnet.lb01_subnet_pub..id, count.index)}", "${element(aws_subnet.lb02_subnet_pub..id, count.index)}", "${element(aws_subnet.lb03_subnet_pub..id, count.index)}"]
idle_timeout = 400
ip_address_type = "ipv4"

enable_deletion_protection = false

tags {
project = "${var.project}"
environment = "${var.environment}"
}
access_logs {
bucket = "${var.alb_pub_log_bucket}"
prefix = "${var.alb_pub_log_prefix}"
enabled = "true"
}
depends_on = ["aws_s3_bucket_policy.sitecore_s3_alb_pub_bucket_policy"]
}

/*
target group for alb public
*/
resource "aws_alb_target_group" "app-alb-tg" {
name = "app-alb-tg"
port = 80
protocol = "HTTP"
vpc_id = "${aws_vpc.app-east-vpc.id}"

stickiness {
type = "lb_cookie"
}

health_check {
path = "${var.alb_health_check_path}"
port = "traffic-port"
healthy_threshold = 2
unhealthy_threshold = 6
timeout = 20
interval = 30
protocol = "${var.alb_health_check_backend_protocol}"
}

tags {
project = "${var.project}"
environment = "${var.environment}"
}
}

/*
target group for alb public 443
*/
resource "aws_alb_target_group" "app-alb-443-tg" {
name = "app-alb-443-tg"
port = 443
protocol = "HTTPS"
vpc_id = "${aws_vpc.app-east-vpc.id}"

stickiness {
type = "lb_cookie"
}

health_check {
path = "${var.alb_health_check_path}"
port = "traffic-port"
healthy_threshold = 2
unhealthy_threshold = 6
timeout = 20
interval = 30
protocol = "${var.alb_health_check_backend_protocol}"
}

tags {
project = "${var.project}"
environment = "${var.environment}"
}
}

/*
http listener for alb public
*/
resource "aws_alb_listener" "app-pub-alb-80" {
load_balancer_arn = "${aws_alb.app-pub-alb.arn}"
port = "80"
protocol = "HTTP"
default_action {
target_group_arn = "${aws_alb_target_group.app-alb-tg.arn}"
type = "forward"
}
}

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.