resource "aws_lb" "gwlb" {
  load_balancer_type               = "gateway"
  subnets                          = [for k, v in aws_subnet.fwdata : v.id]
  enable_cross_zone_load_balancing = false
}

resource "aws_lb_target_group" "fw" {
  target_type = "ip"
  protocol    = "GENEVE"
  port        = 6081

  health_check {
    protocol = "TCP"
    port     = 80
  }

  # El firewall no reescribe la 5-tupla: el flujo debe volver
  # siempre a la misma instancia.
  stickiness {
    type    = "source_ip_dest_ip_proto"
    enabled = true
  }
}

resource "aws_lb_target_group_attachment" "fw" {
  for_each          = local.subnets
  target_id         = aws_network_interface.fw_data[each.key].private_ip
  availability_zone = local.az[each.key]
  port              = 6081
}