allowed_cidrs = concat(local.vpn_exits, local.nat_cidrs, data.github_ip_ranges.gh_ips.hooks_ipv4)
  # Once we have a list of allowed CIDRs, we need to create rule entries
  # for each of these that we'll pass to the Atlantis module's ALB param
  # later. This is kind of a mess, but it creates one rule per CIDR per
  # port, because `aws_vpc_security_group_rule` only takes a single CIDR.
  http_rules = {
    for cidr in local.allowed_cidrs :
    "http_${cidr}" => {
      from_port   = 80
      to_port     = 80
      ip_protocol = "tcp"
      cidr_ipv4   = cidr
    }
  }
  https_rules = {
    for cidr in local.allowed_cidrs :
    "https_${cidr}" => {
      from_port   = 443
      to_port     = 443
      ip_protocol = "tcp"
      cidr_ipv4   = cidr
    }
  }

alb.security_group_ingress_rules

alb {
  security_group_ingress_rules = merge(local.http_rules, local.https_rules)
  ...
}

/events

alb.https_listener

alb {
  ...
    https_listener = {
      # This makes the default path for the https_listener use cognito for
      # authentication, which means any connection to Atlantis will use that
      # workflow unless it falls under one of the other rules listed below.
      authenticate_cognito = {
        user_pool_arn       = aws_cognito_user_pool.atlantis_nonprod.arn
        user_pool_client_id = aws_cognito_user_pool_client.atlantis_nonprod.id
        user_pool_domain    = aws_cognito_user_pool_domain.atlantis_nonprod.domain
      }

      rules = {
        # This rule allows the `/events` endpoint to receive unauthenticated
        # traffic because GitHub webhooks do not use an auth workflow,
        # instead we rely on the shared webhook secret to guarantee that the
        # request is actually legitimate.
        events = {
          actions = [
            {
              type             = "forward"
              target_group_key = "atlantis"
            }
          ]

          conditions = [{
            path_pattern = {
              values = ["/events"]
            }
          }]
        }
      }
    }
  }