Repository: ansible-collections/community.aws

Issue:
elb_network_lb - Add support for ALPN policies
### Summary

Add support for Latency graphs (MeasureLatency) during creation of a Route53 Health Check

**References**
* https://docs.aws.amazon.com/elasticloadbalancing/latest/network/create-tls-listener.html#alpn-policies
* https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/elbv2.html#ElasticLoadBalancingv2.Client.create_listener

> **AlpnPolicy (list)**
> [TLS listeners] The name of the Application-Layer Protocol Negotiation (ALPN) policy. You can specify one policy name. The following are the possible values:
> 
> * HTTP1Only
> * HTTP2Only
> * HTTP2Optional
> * HTTP2Preferred
> * None

### Issue Type

Feature Idea

### Component Name

elb_network_lb

### Additional Information

**Example Input**
<!--- Paste example playbooks or commands between quotes below -->
```yaml (paste below)
AlpnPolicy: 
  - HTTP2Optional
```

**Example Code Change**

Add
```
AlpnPolicy=dict(type='list', elements='str')
```

to

https://github.com/ansible-collections/community.aws/blob/5.0.0/plugins/modules/elb_network_lb.py#L442-L447

### Code of Conduct

- [X] I agree to follow the Ansible Code of Conduct


Discussion:
Files identified in the description:
* [`plugins/modules/elb_network_lb.py`](https://github.com/['ansible-collections/amazon.aws', 'ansible-collections/community.aws', 'ansible-collections/community.vmware']/blob/main/plugins/modules/elb_network_lb.py)

If these files are inaccurate, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->
cc @jillr @markuman @s-hertel @tremble
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->

Resolving patch:
diff --git a/plugins/modules/elb_network_lb.py b/plugins/modules/elb_network_lb.py
--- a/plugins/modules/elb_network_lb.py
+++ b/plugins/modules/elb_network_lb.py
@@ -69,6 +69,17 @@
                     description:
                       - The name of the target group.
                       - Mutually exclusive with I(TargetGroupArn).
+        AlpnPolicy:
+            description:
+              - The name of the Application-Layer Protocol Negotiation (ALPN) policy.
+            type: str
+            choices:
+              - HTTP1Only
+              - HTTP2Only
+              - HTTP2Optional
+              - HTTP2Preferred
+              - None
+            version_added: 7.1.0
   name:
     description:
       - The name of the load balancer. This name must be unique within your AWS account, can have a maximum of 32 characters, must contain only alphanumeric
@@ -283,6 +294,13 @@
                             returned: when state is present
                             type: str
                             sample: ""
+                alpn_policy:
+                    description: The name of the Application-Layer Protocol Negotiation (ALPN) policy.
+                    returned: when state is present
+                    type: list
+                    elements: str
+                    version_added: 7.1.0
+                    sample: ["HTTP1Only", "HTTP2Only"]
         load_balancer_arn:
             description: The Amazon Resource Name (ARN) of the load balancer.
             returned: when state is present
@@ -449,6 +467,10 @@ def main():
                 SslPolicy=dict(type="str"),
                 Certificates=dict(type="list", elements="dict"),
                 DefaultActions=dict(type="list", required=True, elements="dict"),
+                AlpnPolicy=dict(
+                    type="str",
+                    choices=["HTTP1Only", "HTTP2Only", "HTTP2Optional", "HTTP2Preferred", "None"],
+                ),
             ),
         ),
         name=dict(required=True, type="str"),


Test patch:
diff --git a/tests/integration/targets/elb_network_lb/tasks/test_modifying_nlb_listeners.yml b/tests/integration/targets/elb_network_lb/tasks/test_modifying_nlb_listeners.yml
--- a/tests/integration/targets/elb_network_lb/tasks/test_modifying_nlb_listeners.yml
+++ b/tests/integration/targets/elb_network_lb/tasks/test_modifying_nlb_listeners.yml
@@ -73,3 +73,83 @@
       that:
         - nlb.changed
         - not nlb.listeners
+
+# TLS listeners
+- name: Add a TLS listener
+  elb_network_lb:
+    name: "{{ nlb_name }}"
+    subnets: "{{ nlb_subnets }}"
+    state: present
+    listeners:
+      - Protocol: TLS
+        Port: 443
+        Certificates:
+          - CertificateArn: "{{ cert.arn }}"
+        DefaultActions:
+          - Type: forward
+            TargetGroupName: "{{ tg_name }}"
+        SslPolicy: ELBSecurityPolicy-TLS-1-0-2015-04
+        AlpnPolicy: HTTP2Optional
+  register: _add
+
+- assert:
+    that:
+      - _add.listeners[0].alpn_policy == ["HTTP2Optional"]
+      - _add.listeners[0].ssl_policy == "ELBSecurityPolicy-TLS-1-0-2015-04"
+
+- name: Add a TLS listener (idempotency)
+  elb_network_lb:
+    name: "{{ nlb_name }}"
+    subnets: "{{ nlb_subnets }}"
+    listeners:
+      - Protocol: TLS
+        Port: 443
+        Certificates:
+          - CertificateArn: "{{ cert.arn }}"
+        DefaultActions:
+          - Type: forward
+            TargetGroupName: "{{ tg_name }}"
+        SslPolicy: ELBSecurityPolicy-TLS-1-0-2015-04
+        AlpnPolicy: HTTP2Optional
+  register: _idempotency
+
+- assert:
+    that:
+      - _idempotency is not changed
+      - _idempotency.listeners[0].alpn_policy == ["HTTP2Optional"]
+      - _idempotency.listeners[0].ssl_policy == "ELBSecurityPolicy-TLS-1-0-2015-04"
+
+- name: Update TLS listener of NLB
+  elb_network_lb:
+    name: "{{ nlb_name }}"
+    subnets: "{{ nlb_subnets }}"
+    listeners:
+      - Protocol: TLS
+        Port: 443
+        Certificates:
+          - CertificateArn: "{{ cert.arn }}"
+        DefaultActions:
+          - Type: forward
+            TargetGroupName: "{{ tg_name }}"
+        SslPolicy: ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04
+        AlpnPolicy: HTTP1Only
+  register: _update
+
+- assert:
+    that:
+      - _update is changed
+      - _update.listeners[0].alpn_policy == ["HTTP1Only"]
+      - _update.listeners[0].ssl_policy == "ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04"
+
+- name: remove listener from NLB
+  elb_network_lb:
+    name: "{{ nlb_name }}"
+    subnets: "{{ nlb_subnets }}"
+    state: present
+    listeners: []
+  register: nlb
+
+- assert:
+    that:
+      - nlb.changed
+      - not nlb.listeners