resource "aws_lb" "aas-prod-tusd-ext-lb" {
  #checkov:skip=CKV2_AWS_28: Ensure public facing ALB are protected by WAF. Migrated existing ALB as-is.
  name                                        = "aas-prod-tusd-ext-lb"
  internal                                    = false
  load_balancer_type                          = "application"
  security_groups                             = [aws_security_group.AMP-AAS-P2-TUSD-SG.id]
  subnets                                     = [aws_subnet.subnet-0a404aac30a12264a.id, aws_subnet.AMP-AAS-P2-XDMZ-1C.id]
  enable_cross_zone_load_balancing            = "false"
  enable_deletion_protection                  = "true"
  enable_http2                                = true
  enable_tls_version_and_cipher_suite_headers = false
  enable_waf_fail_open                        = false
  enable_xff_client_port                      = false
  idle_timeout                                = 600
  preserve_host_header                        = false
  xff_header_processing_mode                  = "append"
  access_logs {
    bucket  = "sme-amp-prod-elb-logs-eu-central-1"
    enabled = true
    prefix  = "554998489284/aas-prod-tusd-ext-lb"
  }
  tags = {
    Terraform     = "True"
    Business-Unit = "AMP"
    Environment   = "Prod"
    Owner         = "nathaniel.lovett@sonymusic.com"
    Project-Code  = "SME-AMP"
    Project-Name  = "Asset Service"
  }
}

resource "aws_lb_target_group" "aas-prod-tusd-ext-lb-8080" {
  #checkov:skip=CKV_AWS_378: Ensure AWS Load Balancer doesn't use HTTP protocol. Backend target group uses HTTP to instances; TLS terminated at the HTTPS listener.
  count       = 1
  name        = "aas-prod-tusd-ext-lb-8080"
  target_type = "instance"
  port        = 8080
  protocol    = "HTTP"
  vpc_id      = aws_vpc.vpc-0869359855245eb83.id
  health_check {
    healthy_threshold   = 2
    interval            = 30
    unhealthy_threshold = 2
    timeout             = 5
    path                = "/index.html"
    port                = 8080
  }
}

resource "aws_lb_target_group_attachment" "aas-prod-tusd-ext-lb-8080" {
  count            = 1
  target_group_arn = aws_lb_target_group.aas-prod-tusd-ext-lb-8080[count.index].arn
  target_id        = aws_instance.ampaasp-tusd01.id
  port             = 8080
}

resource "aws_lb_listener" "aas-prod-tusd-ext-lb" {
  count             = 1
  load_balancer_arn = aws_lb.aas-prod-tusd-ext-lb.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  certificate_arn   = "arn:aws:acm:eu-central-1:554998489284:certificate/17a63f6e-1c08-426c-824a-0cbc14e9ff81"
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.aas-prod-tusd-ext-lb-8080[count.index].arn
  }
}