An Application Platform That Patches Itself

aws-elastic-beanstalk

An AWS Elastic Beanstalk application and environment. Works with Terraform and OpenTofu (>= 1.6), aws provider >= 6.0, < 7.0.

It patches itself. Managed platform updates are off by default (ManagedActionsEnabled defaults to false), so an environment created from Terraform never gets a platform patch. This module turns them on with a weekly window and a minor-version level.

Health reporting is enhanced, not basic. AWS's default is basic, which knows whether an instance answers and nothing about the application. The console quietly overrides that for you; Terraform does not, so an environment built this way is usually less observable than the same environment built by clicking. Health and instance logs stream to CloudWatch Logs (both default to off) and are kept when the environment is terminated, because an environment is often terminated precisely when something went wrong.

IMDSv1 is disabled. On Amazon Linux 2 and Windows Server 2019 platforms DisableIMDSv1 defaults to false, which leaves the credential-stealing path that SSRF bugs use. Setting it can migrate an existing environment from launch configurations to launch templates.

Deployments do not take the application down. The default deployment policy is AllAtOnce. This module deploys in batches and rolls configuration changes instance by instance, waiting for health.

Versions are pruned. With no lifecycle policy an application keeps every version until it hits its quota, and then no deployment can start at all. This module keeps the most recent versions and deletes their S3 bundles with them.

TLS is a decision. Give certificate_arn and the environment gets an HTTPS listener on 443 with a TLS 1.2+ policy (the load balancer's own default still admits TLS 1.0), and the plain HTTP listener is switched off - Elastic Beanstalk cannot redirect HTTP to HTTPS at the load balancer without a platform configuration file, so it does not pretend to. A public environment with no certificate is refused unless you set allow_plain_http.

Secrets stay out of the configuration. environment_variables are stored in the environment configuration and shown as written. environment_secrets take the ARN of a Secrets Manager secret or an SSM parameter, which the instance reads at bootstrap; the module grants its instance role read on exactly those ARNs.

Verification

Static validation runs tofu fmt, init, validate, tflint and checkov. This module has not yet had a live test, so it is published as statically validated with its live test pending and does not carry the live-tested mark.