acheraime / terraform-nlb-dynamic-target

Terraform module to create Lambda Function that automatically registers target to a Network Load Balancer

terraform-nlb-dynamic-target

This module creates a lambda function that updates a Network Load Balancer with new IP of a RDS instance. The function is triggered by events emitted by RDS via SNS.

Example of slack notification

NLB Target Updater APP  9:04 AM
event RDS-EVENT-0020 received from RDS instance arn:aws:rds:us-east-1:892274852933:db:example-postgres: {"Event Source":"db-instance","Event Time":"2023-08-14 13:04:12.874","Identifier Link":"https://console.aws.amazon.com/rds/home?region=us-east-1#dbinstance:id=example-postgres","Source ID":"example-postgres","Source ARN":"arn:aws:rds:us-east-1:892274852933:db:example-postgres","Event ID":"http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.Messages.html#RDS-EVENT-0020","Event Message":"Recovery of the DB instance has started. Recovery time will vary with the amount of data to be recovered.","Tags":{}}

docs.aws.amazon.comdocs.aws.amazon.com
Amazon RDS event categories and event messages - Amazon Relational Database Service
Amazon RDS generates a significant number of events in categories that you can subscribe to using the Amazon RDS Console, AWS CLI, or the API.
9:04
event RDS-EVENT-0020 received from RDS instance arn:aws:rds:us-east-1:892274852933:db:example-postgres: {"Event Source":"db-instance","Event Time":"2023-08-14 13:04:43.070","Identifier Link":"https://console.aws.amazon.com/rds/home?region=us-east-1#dbinstance:id=example-postgres","Source ID":"example-postgres","Source ARN":"arn:aws:rds:us-east-1:892274852933:db:example-postgres","Event ID":"http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.Messages.html#RDS-EVENT-0020","Event Message":"Recovery of the DB instance has started. Recovery time will vary with the amount of data to be recovered.","Tags":{}}

Requirements

Name	Version
terraform	>= 1.5.0
archive	2.4.0
aws	5.11.0

Usage

Basic usage of this module is as follows:

module "example" {
	 source  = "<module-path>"

	 # Required variables
	 db_instance_ids  = 
	 lb_target_group_arn  = 
	 rds_host_fqdn  = 

	 # Optional variables
	 extra_function_policy  = null
	 extra_rds_events  = []
	 function_name  = null
	 invoke_from_terraform  = true
	 lambda_log_level  = "info"
	 log_retention_days  = 7
	 max_retries  = 3
	 resource_prefix  = null
	 retry_interval_seconds  = 5
	 security_group_ids  = []
	 slack_channel  = ""
	 slack_token  = ""
	 subnet_ids  = []
}

Resources

Name	Type
aws_cloudwatch_log_group.this	resource
aws_db_event_subscription.this	resource
aws_iam_policy.extra	resource
aws_iam_role.this	resource
aws_iam_role_policy_attachment.extra	resource
aws_iam_role_policy_attachment.lambda	resource
aws_lambda_function.this	resource
aws_lambda_permission.sns	resource
aws_sns_topic.this	resource
aws_sns_topic_subscription.this	resource
archive_file.source	data source
aws_iam_policy_document.extra	data source
aws_iam_policy_document.func	data source
aws_iam_policy_document.this	data source
aws_lambda_invocation.this	data source

Inputs

Name	Description	Type	Default	Required
db_instance_ids	List of RDS instances ID	list(string)	n/a	yes
extra_function_policy	Additional policy document to add to the Lambda Function	string	null	no
extra_rds_events	Additional database events to listen to	list(string)	[]	no
function_name	Name of the Lambda Function.	string	null	no
invoke_from_terraform	Whether to invoke the Lambda Function from terraform	bool	true	no
lambda_log_level	Log verbosity level of the lambda function	string	"info"	no
lb_target_group_arn	ARN of the load balancer target group resource	string	n/a	yes
log_retention_days	Specifies how many days to keep log	number	7	no
max_retries	Maximum times to retry a failed remote call within the range [1-10]	number	3	no
rds_host_fqdn	Fully qualified domain name of the RDS instance	string	n/a	yes
resource_prefix	Specifies the prefix to prepend to resources that will be created/updated	string	null	no
retry_interval_seconds	Interval time in seconds to wait before retry a failed remote call	number	5	no
security_group_ids	List of security group IDs for the Function. Required if subnet_ids is set	list(string)	[]	no
slack_channel	Slack channel to publish notifications to	string	""	no
slack_token	Slack authentication token	string	""	no
subnet_ids	List of subnet IDs to place the Function in. Required if security_groups is provided	list(string)	[]	no

Outputs

Name	Description
function_arn	Amazon Resource Name (ARN) of the Lambda Function
function_invoke_arn	ARN to be used for invoking Lambda Function from API Gateway
function_role_arn	ARN for the IAM role attached to the Lambda Fnction
function_version	Latest published version of the Lambda Function