feat(ecs-patterns): support NLB with TLS listener and target group

[199911]

Issue # (if applicable)

Closes #8517

Reason for this change

NLB support TLS protocol in listener and target group.
This changes provide a feature parity in ECS patterns, allowing customer to enhance security with encrypted traffic between NLB and services

Description of changes

• Add listenerCertificate to NetworkLoadBalancedServiceBaseProps, default value is none
• Change the default value of listenerPort and taskImageOptions.containerPort to 443, if listenerCertificate is provided.

Description of how you validated changes

• Added both unit test and integration test

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[agarwal-aashish]

The code looks good and unit tests should cover all the points. Moreover it is backward compatible so should not break any clients.

[199911]

Hi @agarwal-aashish

Thanks for the review and approval!
Will the bot merge CR automatically?
Are there any pending actions on my side?

[199911]

@Mergifyio refresh

[mergify]

refresh

✅ Pull request refreshed

[199911]

@xazhao
I have this pull request reviewed and the build succeeded,
but it didn't merged automatically.

I notice you just merge and release a new version.
Can you help me on this?

[aws-cdk-automation]

This PR cannot be merged because it has conflicts. Please resolve them. The PR will be considered stale and closed if it remains in an unmergeable state.

[moelasmar]

should it be an array of IListenerCertificate to match the type of the listener certificates property

[199911]

Hi @moelasmar,

Thanks for your review and appreciate your attention on details!

Both network and application load balancer require exact one certificate even HTTPS protocol is used. The construct expect zero or one certificate.
I designed the interface to take an optional IListenerCertificate is to avoid user confusion when they passed multiple certificates into construct.

Please let me know you option.

Many thanks,
Lok

ALB doc: https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.ApplicationListener.html#certificates
NLB doc: https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.NetworkListener.html#certificates

You must provide exactly one certificate if the listener protocol is HTTPS or TLS.

[moelasmar]

left minor comment

[moelasmar]

since creating the certificate is not important for this testing, could you please modify the integration for EC2, and Fargate to accept an imported certificate, as the certificate creation step takes a very long time, and slow down this testing.

[199911]

Sounds good to me.

To confirm I understand your suggestion:
I can use

aws-cdk/packages/@aws-cdk-testing/framework-integ/test/aws-apigateway/test/integ.domain-name.ts

Line 13 in ab73e53

const certArn = process.env.CDK_INTEG_CERT_ARN || process.env.CERT_ARN;

and then import a certificate with

aws-cdk/packages/@aws-cdk-testing/framework-integ/test/aws-apigateway/test/integ.domain-name.ts

Line 83 in ab73e53

const certificate = Certificate.fromCertificateArn(testCase, 'Cert', certArn);

[moelasmar]

and for the certificate creation itself, I believe you can create a self signed certificate and then import it, I believe this will be an easier solution.

[moelasmar]

you can follow the following steps to create a self signed certificate:

$ openssl genrsa -out my-private.key 2048
$ openssl req -new -key my-private.key -out my-csr.csr
$ openssl x509 -req -days 365 -in my-csr.csr -signkey my-private.key -out my-certificate.crt

Then you can follow this link to import it.

Also, please add these steps to the test case as comment

[199911]

Thanks for the guidance!

I will take me some time to learn the details of self signed certificate and update the tests.

Pull request has been modified.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 36736a1
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[moelasmar]

thanks @199911. I will update the PR status to request changes till you update the integration testing