resource "aws_lb" "digsys-s3-dsms-rs-clearances" {
  name                                        = "digsys-s3-dsms-rs-clearances"
  internal                                    = true
  load_balancer_type                          = "application"
  security_groups                             = [aws_security_group.DIGSYS-S3-INT-LB-SG.id]
  subnets                                     = [aws_subnet.DIGSYS-S3-IAPP-1A.id, aws_subnet.DIGSYS-S3-IAPP-1B.id]
  enable_cross_zone_load_balancing            = "false"
  enable_deletion_protection                  = "true"
  enable_http2                                = true
  enable_tls_version_and_cipher_suite_headers = false
  enable_waf_fail_open                        = false
  enable_xff_client_port                      = false
  idle_timeout                                = 600
  preserve_host_header                        = false
  xff_header_processing_mode                  = "append"
  access_logs {
    bucket                                    = "digital-systems-dev-frankfurt-elb-logs"
    enabled                                   = true
    prefix                                    = "digsys-s3-dsms-rs-clearances"
  }
  tags                                        = {
    Terraform                                 = "True"
    Business-Unit                             = "DIGITAL SYSTEMS"
    Environment                               = "Stage"
    Name                                      = "digsys-s3-dsms-rs-clearances"
    Owner                                     = "steve.leeds@sonymusic.com"
    Project-Code                              = "SME-2000-0590D+M"
    Project-Name                              = "Digital Systems"
    POC                                       = "eric.mansfield.objectlab@sonymusic.com"
    aws-migration-project-id                  = "MPE22602"
    map-migrated                              = "d-server-02sa4nzuab143a"
  }
}

resource "aws_lb_target_group" "digsys-s3-dsms-rs-clearances" {
  #checkov:skip=CKV_AWS_378: Ensure AWS Load Balancer doesn't use HTTP protocol
  count                 = 1
  name                  = "digsys-s3-dsms-rs-clearances"
  target_type           = "ip"
  port                  = 8102
  protocol              = "HTTP"
  vpc_id                = aws_vpc.DIGSYS-S3.id
  health_check {
    healthy_threshold   = 2
    interval            = 30
    unhealthy_threshold = 3
    timeout             = 5
    path                = "/actuator/health"
    port                = 8102
  }
}


resource "aws_lb_listener" "digsys-s3-dsms-rs-clearances" {
  count             = 1
  load_balancer_arn = aws_lb.digsys-s3-dsms-rs-clearances.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  certificate_arn   = "arn:aws:acm:eu-central-1:718729873097:certificate/7f4c2ec4-d41b-4da1-9487-348c1af743fa"
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.digsys-s3-dsms-rs-clearances[count.index].arn
  }
}