Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[ecs-patterns] - HTTPS between NLB and fargate service when using NetworkLoadBalancedFargateService #8517

Closed
1 of 2 tasks
svkurowski opened this issue Jun 12, 2020 · 11 comments · Fixed by #30611
Closed
1 of 2 tasks

[ecs-patterns] - HTTPS between NLB and fargate service when using NetworkLoadBalancedFargateService #8517

svkurowski opened this issue Jun 12, 2020 · 11 comments · Fixed by #30611
Labels
@aws-cdk/aws-ecs-patterns Related to ecs-patterns library closed-for-staleness This issue was automatically closed because it hadn't received any attention in a while. effort/medium Medium work item – several days of effort feature/pattern Feature requests related to high level L3 pattern libraries feature-request A feature should be added or improved. in-progress This issue is being actively worked on. p1

Comments

@svkurowski
Copy link

Hello,

Please add a switch to use TLS target group protocol when using NetworkLoadBalancedFargateService.

Best regards

~ Sascha

Use Case

We are using NetworkLoadBalancedFargateService construct and are using an ACM certificate and an additional listener for HTTPS traffic (terminating HTTPS on the NLB), that part is working well.

However, as per internal requirements the traffic between the NLB and the service needs to be secured with TLS as well (we would like to re-encrypt on the NLB so that the service does not need to know about our certificate). We already have our service serving SSL with a self-signed certificate.

Proposed Solution

A switch or something in NetworkLoadBalancedFargateService construct to set the target group protocol to TLS, not TCP:

nlb-tls-service

CR property: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-targetgroup.html#cfn-elasticloadbalancingv2-targetgroup-protocol

Other

  • 👋 I may be able to implement this feature request
  • ⚠️ This feature might incur a breaking change

This is a 🚀 Feature Request
@svkurowski svkurowski added feature-request A feature should be added or improved. needs-triage This issue or PR still needs to be triaged. labels Jun 12, 2020
@SomayaB SomayaB added the @aws-cdk/aws-ecs-patterns Related to ecs-patterns library label Jun 12, 2020
@SoManyHs
Copy link
Contributor

Related: #6988

@SoManyHs SoManyHs added in-progress This issue is being actively worked on. and removed needs-triage This issue or PR still needs to be triaged. labels Jun 15, 2020
@SoManyHs
Copy link
Contributor

Closing as duplicate of #6263. Feel free to re-open if you have further questions!

@svkurowski
Copy link
Author

Please reopen. I looked at both linked issues and they don't describe the feature mentioned here. Both are about the TLS listener on the NLB. We have already set that up and it is working.

This feature request is about the traffic between NLB and target group and a separate CFN. property.

@KarthickEmis
Copy link

Please reopen. I looked at both linked issues and they don't describe the feature mentioned here. Both are about the TLS listener on the NLB. We have already set that up and it is working.

This feature request is about the traffic between NLB and target group and a separate CFN. property.

Hi ,

I am facing the below issue when trying to create NLB using CDK(NetworkLoadBalancedFargateService) with the listener of port 22 and 443 (TCP and TLS) with the certificates attached to it . I am creating the certificate and NLB in the same construct.
node_modules@aws-cdk\core\lib\private\resolve.ts:144 : throw new Error('Trying to resolve() a Construct at ' + pathName);.

How to create certificate and attach to the NLB in CDK for TLS(443) port ?

@SoManyHs SoManyHs reopened this Jun 29, 2020
@MrArnoldPalmer MrArnoldPalmer added effort/medium Medium work item – several days of effort p2 labels Dec 7, 2020
@MrArnoldPalmer MrArnoldPalmer changed the title HTTPS between NLB and fargate service when using NetworkLoadBalancedFargateService [ecs-patterns] - HTTPS between NLB and fargate service when using NetworkLoadBalancedFargateService Dec 7, 2020
@ericzbeard ericzbeard added the feature/pattern Feature requests related to high level L3 pattern libraries label Apr 2, 2021
@github-actions
Copy link

This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

@github-actions github-actions bot added closing-soon This issue will automatically close in 4 days unless further comments are made. closed-for-staleness This issue was automatically closed because it hadn't received any attention in a while. and removed closing-soon This issue will automatically close in 4 days unless further comments are made. labels May 13, 2022
@svkurowski
Copy link
Author

This is still a feature that would benefit us.

@OGoodness
Copy link

Same here, this is actually linked to the base NLB creation. We just need some way to specify listener configurations.
https://github.com/aws/aws-cdk/blob/v1.159.0/packages/%40aws-cdk/aws-ecs-patterns/lib/base/network-load-balanced-service-base.ts

@OGoodness
Copy link

@MrArnoldPalmer Why was this medium? Curious, because if you expose the Network Listener creation props as a input to the NLB Base, then it would be a matter of just keeping defaults.

@199911
Copy link
Contributor

199911 commented Jun 19, 2024 •
edited
Loading

Hi community,

I am working on this issue.

I got some idea on the fix,
I will need some time to test the code in real AWS account.
Any suggestion or helps on testing will be helpful.

#30611

@199911 199911 mentioned this issue Jun 21, 2024
Merged
1 task
@paulhcsun paulhcsun reopened this Sep 3, 2024
@github-actions github-actions bot added p1 and removed p2 labels Sep 8, 2024
@github-actions GitHub Actions
Copy link

github-actions bot commented Sep 8, 2024

This issue has received a significant amount of attention so we are automatically upgrading its priority. A member of the community will see the re-prioritization and provide an update on the issue.

@mergify mergify bot closed this as completed in #30611 Oct 14, 2024
mergify bot pushed a commit that referenced this issue Oct 14, 2024
@199911
feat(ecs-patterns): support NLB with TLS listener and target group (#…
f4f8abc 
…30611)

### Issue # (if applicable)

Closes #8517 

### Reason for this change

NLB support TLS protocol in listener and target group. 
This changes provide a feature parity in ECS patterns, allowing customer to enhance security with encrypted traffic between NLB and services

### Description of changes

- Add `listenerCertificate` to `NetworkLoadBalancedServiceBaseProps`, default value is `none`
- Change the default value of `listenerPort` and `taskImageOptions.containerPort` to 443, if `listenerCertificate` is provided.

### Description of how you validated changes

- Added both unit test and integration test

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
@github-actions GitHub Actions
Copy link

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Oct 14, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
@aws-cdk/aws-ecs-patterns Related to ecs-patterns library closed-for-staleness This issue was automatically closed because it hadn't received any attention in a while. effort/medium Medium work item – several days of effort feature/pattern Feature requests related to high level L3 pattern libraries feature-request A feature should be added or improved. in-progress This issue is being actively worked on. p1
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat(ecs-patterns): support NLB with TLS listener and target group 199911/aws-cdk
10 participants
@ericzbeard @uttarasridhar @svkurowski @199911 @MrArnoldPalmer @OGoodness @SomayaB @SoManyHs @KarthickEmis @paulhcsun