resource "aws_lb" "maxp3-private-api-forwarder" {
  #checkov:skip=CKV_AWS_152: Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled. Migrated existing load balancer as-is.
  enable_deletion_protection = false
  internal                   = true
  ip_address_type            = "ipv4"
  load_balancer_type         = "network"
  name                       = "maxp3-private-api-forwarder"
  security_groups            = [aws_security_group.MAX-P3-API-GATEWAY-SG.id]
  subnets                    = [aws_subnet.MAX-P3-IAPP-1A.id, aws_subnet.MAX-P3-IAPP-1B.id]
  tags                       = {}
  tags_all                   = {}
  access_logs {
    bucket  = "sme-supply-chain-max-prod-elb-euc1-logs"
    prefix  = "maxp3-private-api-forwarder"
    enabled = true
  }
}

resource "aws_lb_listener" "maxp3-private-api-forwarder-listener" {
  certificate_arn   = "arn:aws:acm:eu-central-1:504436705349:certificate/fc9b3e8c-4f29-4576-85dd-6e1e37407452"
  load_balancer_arn = aws_lb.maxp3-private-api-forwarder.arn
  port              = 443
  protocol          = "TLS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-Res-2021-06"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.maxp3-private-api-forwarder-target-group.arn
  }
}