module.yml

---
# Copyright 2018 widdix GmbH
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
AWSTemplateFormatVersion: '2010-09-09'
Description: 'cfn-modules: ALB listener'
# cfn-modules:implements(ExposeArn)
Parameters:
  AlbModule:
    Description: 'Stack name of alb module.'
    Type: String
  Port:
    Description: 'The port on which the listener listens for requests.'
    Type: Number
    Default: 80
  CertificateArn:
    Description: 'Optional Amazon Resource Name (ARN) of the certificate to associate with the listener.'
    Type: String
    Default: ''
  ClientSgModule:
    Description: 'Optional stack name of client-sg module (requires ALB Scheme := internal).'
    Type: String
    Default: ''
Conditions:
  HasCertificateArn: !Not [!Equals [!Ref CertificateArn, '']]
  HasClientSgModule: !Not [!Equals [!Ref ClientSgModule, '']]
  HasNotClientSgModule: !Not [!Condition HasClientSgModule]
Resources:
  Listener:
    Type: 'AWS::ElasticLoadBalancingV2::Listener'
    Properties:
      Certificates: !If [HasCertificateArn, [{CertificateArn: !Ref CertificateArn}], !Ref 'AWS::NoValue']
      DefaultActions:
      - FixedResponseConfig:
          ContentType: 'text/plain'
          MessageBody: default
          StatusCode: '404'
        Type: 'fixed-response'
      LoadBalancerArn: {'Fn::ImportValue': !Sub '${AlbModule}-Arn'}
      Port: !Ref Port
      Protocol: !If [HasCertificateArn, HTTPS, HTTP]
      SslPolicy: !If [HasCertificateArn, 'ELBSecurityPolicy-FS-1-2-Res-2019-08', !Ref 'AWS::NoValue']
  SecurityGroupInWorld:
    Type: 'AWS::EC2::SecurityGroupIngress'
    Condition: HasNotClientSgModule
    Properties:
      GroupId: {'Fn::ImportValue': !Sub '${AlbModule}-SecurityGroupId'}
      IpProtocol: tcp
      FromPort: !Ref Port
      ToPort: !Ref Port
      CidrIp: '0.0.0.0/0'
  SecurityGroupInWorldIpv6:
    Type: 'AWS::EC2::SecurityGroupIngress'
    Condition: HasNotClientSgModule
    Properties:
      GroupId: {'Fn::ImportValue': !Sub '${AlbModule}-SecurityGroupId'}
      IpProtocol: tcp
      FromPort: !Ref Port
      ToPort: !Ref Port
      CidrIpv6: '::/0'
  SecurityGroupInClientSg:
    Type: 'AWS::EC2::SecurityGroupIngress'
    Condition: HasClientSgModule
    Properties:
      GroupId: {'Fn::ImportValue': !Sub '${AlbModule}-SecurityGroupId'}
      IpProtocol: tcp
      FromPort: !Ref Port
      ToPort: !Ref Port
      SourceSecurityGroupId: {'Fn::ImportValue': !Sub '${ClientSgModule}-SecurityGroupId'}
Outputs:
  ModuleId:
    Value: 'alb-listener'
  ModuleVersion:
    Value: '1.4.0'
  StackName:
    Value: !Ref 'AWS::StackName'
  Arn:
    Value: !Ref Listener
    Export:
      Name: !Sub '${AWS::StackName}-Arn'