Skip to content

Commit ff83cfd

Browse files
badmintoncryerbadmintoncryer
authored
feat(elasticloadbalancingv2): create security group settings for NLB by default (under feature flag) (#34675)
### Issue # (if applicable) Closes #34606. ### Reason for this change Currently, CDK's L2 constructs allow setting security groups for NLBs, but this requires explicit configuration. ```ts declare const sg1: ec2.ISecurityGroup; const lb = new elbv2.NetworkLoadBalancer(this, 'LB', { vpc, securityGroups: [sg1], // configure SG explicitly }); ``` This was not originally intended - NLB security group support was implemented later, and the current specification exists to maintain backward compatibility. #27978 #28494 However, when comparing NLBs without security groups to NLBs with security groups configured, the latter has significantly more advantages. Furthermore, once an NLB is created without security groups, it's impossible to add security group configuration later. Therefore, I propose using feature flags to make security group configuration the default for NLBs in CDK. ### Description of changes - Add `@aws-cdk/aws-elasticloadbalancingv2:networkLoadBalancerWithSecurityGroupByDefault` feature flag - Create security groups by default when feature flags are enabled ### Describe any new or updated permissions being added None ### Description of how you validated changes Add both unit and integ tests ### Other information [This implementation](#34606 (comment)) was also proposed in the issue, but it was not implemented because it was difficult to detect when referenced from other Connectables as follows case2. ```ts declare const nlb: elbv2.INetworkLoadBalancer; declare const other: IConnectable; // case1 nlb.connections.allowTo(other, ec2.Port.tcp(1234)); // case2 other.connections.allowTo(nlb, ec2.Port.tcp(2181)); ``` ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 5e4f603 commit ff83cfd

File tree

19 files changed

+33315
-146
lines changed

19 files changed

+33315
-146
lines changed

‎packages/@aws-cdk-testing/framework-integ/temp.json‎

Lines changed: 225 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,225 @@
1+
{
2+
"ETag": "EEP8XQBTEOUC5",
3+
"DistributionConfig": {
4+
"CallerReference": "edcbed72-d836-106d-4b2a-dd5bf066eb55",
5+
"Aliases": {
6+
"Quantity": 0
7+
},
8+
"DefaultRootObject": "",
9+
"Origins": {
10+
"Quantity": 3,
11+
"Items": [
12+
{
13+
"Id": "cloudfronts3bucketoriginmixedDistributionOrigin3B1C9781D",
14+
"DomainName": "cloudfront-s3-bucket-origin-mixe-bucketoaib14a7c52-k5rjuqhpdrvh.s3.us-east-1.amazonaws.com",
15+
"OriginPath": "",
16+
"CustomHeaders": {
17+
"Quantity": 0
18+
},
19+
"S3OriginConfig": {
20+
"OriginAccessIdentity": "origin-access-identity/cloudfront/E1HQYMXWT4GBQK",
21+
"OriginReadTimeout": 60
22+
},
23+
"ConnectionAttempts": 3,
24+
"ConnectionTimeout": 10,
25+
"OriginShield": {
26+
"Enabled": false
27+
},
28+
"OriginAccessControlId": ""
29+
},
30+
{
31+
"Id": "cloudfronts3bucketoriginmixedDistributionOrigin239CEEA9F",
32+
"DomainName": "cloudfront-s3-bucket-origin-mixe-bucketoaccfc6baf0-wn9u4ekstwq4.s3.us-east-1.amazonaws.com",
33+
"OriginPath": "",
34+
"CustomHeaders": {
35+
"Quantity": 0
36+
},
37+
"S3OriginConfig": {
38+
"OriginAccessIdentity": "",
39+
"OriginReadTimeout": 45
40+
},
41+
"ConnectionAttempts": 3,
42+
"ConnectionTimeout": 10,
43+
"OriginShield": {
44+
"Enabled": false
45+
},
46+
"OriginAccessControlId": "E1EOOZXFTVRY63"
47+
},
48+
{
49+
"Id": "cloudfronts3bucketoriginmixedDistributionOrigin1AB885D6E",
50+
"DomainName": "cloudfront-s3-bucket-origin--bucketdefaultb1516e6d-zgwppexae9pl.s3.us-east-1.amazonaws.com",
51+
"OriginPath": "",
52+
"CustomHeaders": {
53+
"Quantity": 0
54+
},
55+
"S3OriginConfig": {
56+
"OriginAccessIdentity": "",
57+
"OriginReadTimeout": 30
58+
},
59+
"ConnectionAttempts": 3,
60+
"ConnectionTimeout": 10,
61+
"OriginShield": {
62+
"Enabled": false
63+
},
64+
"OriginAccessControlId": ""
65+
}
66+
]
67+
},
68+
"OriginGroups": {
69+
"Quantity": 0
70+
},
71+
"DefaultCacheBehavior": {
72+
"TargetOriginId": "cloudfronts3bucketoriginmixedDistributionOrigin1AB885D6E",
73+
"TrustedSigners": {
74+
"Enabled": false,
75+
"Quantity": 0
76+
},
77+
"TrustedKeyGroups": {
78+
"Enabled": false,
79+
"Quantity": 0
80+
},
81+
"ViewerProtocolPolicy": "allow-all",
82+
"AllowedMethods": {
83+
"Quantity": 2,
84+
"Items": [
85+
"HEAD",
86+
"GET"
87+
],
88+
"CachedMethods": {
89+
"Quantity": 2,
90+
"Items": [
91+
"HEAD",
92+
"GET"
93+
]
94+
}
95+
},
96+
"SmoothStreaming": false,
97+
"Compress": true,
98+
"LambdaFunctionAssociations": {
99+
"Quantity": 0
100+
},
101+
"FunctionAssociations": {
102+
"Quantity": 0
103+
},
104+
"FieldLevelEncryptionId": "",
105+
"CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
106+
"GrpcConfig": {
107+
"Enabled": false
108+
}
109+
},
110+
"CacheBehaviors": {
111+
"Quantity": 2,
112+
"Items": [
113+
{
114+
"PathPattern": "/oac/*",
115+
"TargetOriginId": "cloudfronts3bucketoriginmixedDistributionOrigin239CEEA9F",
116+
"TrustedSigners": {
117+
"Enabled": false,
118+
"Quantity": 0
119+
},
120+
"TrustedKeyGroups": {
121+
"Enabled": false,
122+
"Quantity": 0
123+
},
124+
"ViewerProtocolPolicy": "allow-all",
125+
"AllowedMethods": {
126+
"Quantity": 2,
127+
"Items": [
128+
"HEAD",
129+
"GET"
130+
],
131+
"CachedMethods": {
132+
"Quantity": 2,
133+
"Items": [
134+
"HEAD",
135+
"GET"
136+
]
137+
}
138+
},
139+
"SmoothStreaming": false,
140+
"Compress": true,
141+
"LambdaFunctionAssociations": {
142+
"Quantity": 0
143+
},
144+
"FunctionAssociations": {
145+
"Quantity": 0
146+
},
147+
"FieldLevelEncryptionId": "",
148+
"CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
149+
"GrpcConfig": {
150+
"Enabled": false
151+
}
152+
},
153+
{
154+
"PathPattern": "/oai/*",
155+
"TargetOriginId": "cloudfronts3bucketoriginmixedDistributionOrigin3B1C9781D",
156+
"TrustedSigners": {
157+
"Enabled": false,
158+
"Quantity": 0
159+
},
160+
"TrustedKeyGroups": {
161+
"Enabled": false,
162+
"Quantity": 0
163+
},
164+
"ViewerProtocolPolicy": "allow-all",
165+
"AllowedMethods": {
166+
"Quantity": 2,
167+
"Items": [
168+
"HEAD",
169+
"GET"
170+
],
171+
"CachedMethods": {
172+
"Quantity": 2,
173+
"Items": [
174+
"HEAD",
175+
"GET"
176+
]
177+
}
178+
},
179+
"SmoothStreaming": false,
180+
"Compress": true,
181+
"LambdaFunctionAssociations": {
182+
"Quantity": 0
183+
},
184+
"FunctionAssociations": {
185+
"Quantity": 0
186+
},
187+
"FieldLevelEncryptionId": "",
188+
"CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
189+
"GrpcConfig": {
190+
"Enabled": false
191+
}
192+
}
193+
]
194+
},
195+
"CustomErrorResponses": {
196+
"Quantity": 0
197+
},
198+
"Comment": "",
199+
"Logging": {
200+
"Enabled": false,
201+
"IncludeCookies": false,
202+
"Bucket": "",
203+
"Prefix": ""
204+
},
205+
"PriceClass": "PriceClass_All",
206+
"Enabled": true,
207+
"ViewerCertificate": {
208+
"CloudFrontDefaultCertificate": true,
209+
"SSLSupportMethod": "vip",
210+
"MinimumProtocolVersion": "TLSv1",
211+
"CertificateSource": "cloudfront"
212+
},
213+
"Restrictions": {
214+
"GeoRestriction": {
215+
"RestrictionType": "none",
216+
"Quantity": 0
217+
}
218+
},
219+
"WebACLId": "",
220+
"HttpVersion": "http2",
221+
"IsIPV6Enabled": true,
222+
"ContinuousDeploymentPolicyId": "",
223+
"Staging": false
224+
}
225+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.nlb.security-group.js.snapshot/NlbSecurityGroupIntegDefaultTestDeployAssertD87A91AD.assets.json‎

Lines changed: 33 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)