HSTS header to ALB listener not added when provisioning with Terraform

Not sure if this applies to Terraform. For CloudFormation, I have to explicitly set routing.http.response.server.enabled to true for routing.http.response.strict_transport_security.header_value to work.

For TF, this will mean routing_http_response_server_enabled

The issue you're experiencing with the HSTS header not being added to your Application Load Balancer (ALB) listener when provisioning with Terraform is likely due to a known limitation in how ALB handles custom headers.

By default, ALB only adds custom headers, including the Strict-Transport-Security (HSTS) header, to successful responses (typically 2xx and 3xx status codes). This behavior is not specific to Terraform but is a characteristic of the ALB itself.

To address this issue, you have a few options:

1. Verify that your backend application is returning successful response codes. If it's consistently returning 4xx or 5xx errors, the HSTS header may not be added by the ALB.

2. Consider implementing HSTS at the application level instead of relying on the ALB. This ensures that the header is added to all responses, regardless of the status code.

3. Use AWS CloudFront in front of your ALB. CloudFront allows you to add custom headers to all responses, including error responses, giving you more control over header management.

4. If you need to stick with ALB, you could set up a custom error page for non-2xx responses that includes the necessary HSTS header.

5. Double-check your Terraform configuration to ensure that the attribute is correctly specified and that there are no typos or formatting issues.

6. After applying the Terraform changes, you may need to wait a short period for the changes to propagate fully in the AWS environment.

If the issue persists after trying these steps, it might be worth reaching out to AWS support for further assistance, as there could be a specific interaction between Terraform and the ALB that's causing this behavior.
Sources
Is HSTS supported either by ALB or WAF? | AWS re:Post
ALB Listener Attributes: Headers Missing in Non-2XX Responses | AWS re:Post
Application Load Balancer does not always send back header | AWS re:Post