main.tf

...
module "dcos" {
  source  = "dcos-terraform/dcos/aws"
  version = "~> 0.2.0"
  
  dcos_instance_os = "centos_7.5"
  cluster_name = "${var.cluster_name}"

  ...
  #other config of the module
}
# the elb modification starts here.
data "aws_lb" "master-lb" {
  name = "${var.cluster_name}"
}

data "aws_lb" "ext-lb" {
  name = "ext-${var.cluster_name}"
}

data "aws_lb_target_group" "tg-443" {
  name     = "${var.cluster_name}-tg-443"
}

data "aws_lb_target_group" "ext-tg-443" {
  name     = "ext-${var.cluster_name}-tg-443"
}

data "aws_lb_listener" "master-front_end" {
  load_balancer_arn = "${data.aws_lb.master-lb.arn}"
  port = "443"
}

data "aws_lb_listener" "public-front_end" {
  load_balancer_arn = "${data.aws_lb.ext-lb.arn}"
  port = "443"
}

resource "aws_lb_listener_certificate" "master-certificate" {
  listener_arn    = "${data.aws_lb_listener.master-front_end.arn}"
  certificate_arn = "${aws_acm_certificate.cert.arn}"
}
#current workaround I have, but once I run this, and re-run the plan command, it wants to re-add the listener I deleted from the cli
resource "null_resource" "update-nlb" {
  provisioner "local-exec" {
    command = "sh update-nlb-script.sh ${data.aws_lb_listener.public-front_end.arn}"
  }
}

resource "aws_lb_listener" "public-front_end" {
  load_balancer_arn = "${data.aws_lb.ext-lb.arn}"
  port              = "443"
  protocol          = "TLS"
  ssl_policy        = "ELBSecurityPolicy-2016-08"
  certificate_arn   = "${aws_acm_certificate.cert.arn}"

  default_action {
    type             = "forward"
    target_group_arn = "${data.aws_lb_target_group.ext-tg-443.arn}"
  }

  depends_on = [
    "null_resource.update-nlb"
  ]
}