feat: update load balancer SSL policy

[patheard]

Summary

Update to the latest recommend ALB SSL policy which is FIPS 140-3 compliant

Related

• https://aws.amazon.com/about-aws/whats-new/2023/11/application-load-balancer-fips-tls-termination/
• https://docs.aws.amazon.com/elasticloadbalancing/latest/network/describe-ssl-policies.html#fips-security-policies

[github-actions]

Staging: load-balancer

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 0 to add, 1 to change, 0 to destroy

Show summary

CHANGE	NAME
update	aws_lb_listener.wordpress

Show plan

Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_lb_listener.wordpress will be updated in-place
  ~ resource "aws_lb_listener" "wordpress" {
        id                = "arn:aws:elasticloadbalancing:ca-central-1:729164266357:listener/app/wordpress/3c7f3e17b6363a06/c956721664f56e5d"
      ~ ssl_policy        = "ELBSecurityPolicy-FS-1-2-Res-2019-08" -> "ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04"
        tags              = {}
        # (6 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Warning: Argument is deprecated

  with aws_s3_bucket.cloudfront_logs,
  on s3.tf line 4, in resource "aws_s3_bucket" "cloudfront_logs":
   4: resource "aws_s3_bucket" "cloudfront_logs" {

Use the aws_s3_bucket_server_side_encryption_configuration resource instead

(and 5 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_acm_certificate.wordpress"]
WARN - plan.json - main - Missing Common Tags: ["aws_acm_certificate.wordpress_cloudfront"]
WARN - plan.json - main - Missing Common Tags: ["aws_cloudfront_distribution.wordpress"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.cache_buster"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.firehose_waf_logs"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.firehose_waf_logs"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_user.cache_buster"]
WARN - plan.json - main - Missing Common Tags: ["aws_lb.wordpress"]
WARN - plan.json - main - Missing Common Tags: ["aws_lb_listener.wordpress"]
WARN - plan.json - main - Missing Common Tags: ["aws_lb_target_group.wordpress"]
WARN - plan.json - main - Missing Common Tags: ["aws_s3_bucket.cloudfront_logs"]
WARN - plan.json - main - Missing Common Tags: ["aws_wafv2_web_acl.wordpress_waf"]
WARN - plan.json - main - Missing Common Tags: ["aws_wafv2_web_acl.wordpress_waf_alb"]

32 tests, 19 passed, 13 warnings, 0 failures, 0 exceptions