Setting the cipher for an elastic load balance from an elastic beanstalk app with terraform

user_5543950 0
Viewed 290

My terraform code doesn't do what I expect when I try to set the cipher on the load balancer listener...

Rev1, if I don't set the cipher I can use namespace settings like this (several of them really) in the body of the aws_elastic_beanstalk_environment resource:

setting {
    namespace = "aws:elb:listener:443"
    name      = "ListenerProtocol"
    value     = "HTTPS"
  }

And that works as expected, but the listeners get the default cipher.

There isn't an option in that namespace for the cipher. There is one however in the aws:elbv2:listener:443 namespace

setting {
    namespace = "aws:elbv2:listener:443"
    name      = "SSLPolicy"
    value     = "ELBSecurityPolicy-TLS-1-2-2017-01"
  }

But when I switch to using elbv2 the resulting elastic beanstalk app only has the default port 80 listener on http. It's like my elbv2 namesspace had no effect at all and it just feel back to the default.

Could be a bug in terraform I guess, but I am more inclined to believe I am doing something wrong. Anyone have any ideas?

terraform amazon-elb amazon-web-services
1 Answers

Based on the comments.

The issue was that the aws:elbv2:listener is only for Application Load Balancer. However, the EB environment used utilizes the Classic Load Balancer.

This explains why the option did not have an expected effect.

CLB supports SSL security policies:

The setting for CLB in EB is aws:elb:policies:policy_name, with options of SSLProtocols and SSLReferencePolicy.

How to use them is shown in the following SO answer.

user_2488230
Related