resource "aws_lb" "maxu3-private-api-forwarder" {
  #checkov:skip=CKV_AWS_152: Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled. Migrated existing load balancer as-is.
  dns_record_client_routing_policy = "any_availability_zone"
  enable_deletion_protection       = false
  internal                         = true
  ip_address_type                  = "ipv4"
  load_balancer_type               = "network"
  name                             = "maxu3-private-api-forwarder"
  security_groups                  = [aws_security_group.MAX-U3-API-GATEWAY-SG.id]
  subnets                          = [aws_subnet.MAX-U3-IAPP-1A.id, aws_subnet.MAX-U3-IAPP-1B.id]
  tags                             = {}
  tags_all                         = {}
  access_logs {
    bucket  = "sme-max-ff-alb-logs-euc"
    prefix  = "maxu3-private-api-forwarder"
    enabled = true
  }
}

resource "aws_lb_listener" "maxu3-private-api-forwarder-listener" {
  certificate_arn   = "arn:aws:acm:eu-central-1:981599956623:certificate/4206dc76-0791-479d-852d-66e6a25ea9bb"
  load_balancer_arn = aws_lb.maxu3-private-api-forwarder.arn
  port              = 443
  protocol          = "TLS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-Res-2021-06"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.maxu3-private-api-forwarder-target-group.arn
  }
}