fix: adding deletion protection for load balancer (#39)

This commit enables customers to create the load-balancers created
in HealthMonitor and RenderQueue with delete protection.

* Updated the unit tests to validate the change.
* Deployed the kitchen-sink app and verified its functionality.

packages/aws-rfdk/lib/core/lib/health-monitor.ts

@@ -175,7 +175,7 @@ export interface HealthMonitorProps {
 
   /**
    * Describes the current Elastic Load Balancing resource limits for your AWS account.
-   * This object should be the output of 'describeAccountLimits' API
+   * This object should be the output of 'describeAccountLimits' API.
    *
    * @default default account limits for ALB is used
    *
@@ -189,6 +189,17 @@ export interface HealthMonitorProps {
    * @default A new Key will be created and used.
    */
   readonly encryptionKey?: IKey;
+
+  /**
+   * Indicates whether deletion protection is enabled for the LoadBalancer.
+   *
+   * @default true
+   *
+   * Note: This value is true by default which means that the deletion protection is enabled for the
+   * load balancer. Hence, user needs to disable it using AWS Console or CLI before deleting the stack.
+   * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html#deletion-protection
+   */
+  readonly deletionProtection?: boolean;
 }
 
 /**
@@ -389,7 +400,7 @@ export class HealthMonitor extends HealthMonitorBase {
     const {loadBalancer, targetGroup} = this.lbFactory.registerWorkerFleet(
       monitorableFleet,
       healthCheckConfig,
-      this.props.elbAccountLimits);
+      this.props);
 
     this.createFleetAlarms(monitorableFleet, healthCheckConfig, loadBalancer, targetGroup);
   }

packages/aws-rfdk/lib/core/lib/load-balancer-manager.ts

@@ -17,6 +17,7 @@ import {
   HealthMonitor,
   IMonitorableFleet,
   Limit,
+  HealthMonitorProps,
 } from './health-monitor';
 
 /**
@@ -108,7 +109,7 @@ export class LoadBalancerFactory {
   public registerWorkerFleet(
     fleet: IMonitorableFleet,
     healthCheckConfig: HealthCheckConfig,
-    elbAccountLimits?: Limit[]): {
+    healthMonitorProps: HealthMonitorProps): {
       loadBalancer: ApplicationLoadBalancer,
       listener: ApplicationListener,
       targetGroup: ApplicationTargetGroup
@@ -126,7 +127,7 @@ export class LoadBalancerFactory {
           loadBalancer,
           fleet,
           healthCheckConfig,
-          elbAccountLimits);
+          healthMonitorProps);
 
         loadBalancerParent = loadBalancer;
         listenerParent = listener;
@@ -149,7 +150,8 @@ export class LoadBalancerFactory {
       // accommodate fleet, create a new one and register
       loadBalancerParent = this.createLoadBalancer(
         this.healthMonitorScope,
-        this.loadBalancerMap.size);
+        this.loadBalancerMap.size,
+        healthMonitorProps);
       const loadBalancerManager = new LoadBalancerManager();
 
       // Add it to the map
@@ -161,7 +163,7 @@ export class LoadBalancerFactory {
           loadBalancerParent,
           fleet,
           healthCheckConfig,
-          elbAccountLimits);
+          healthMonitorProps);
 
         listenerParent = listener;
         targetGroupParent = targetGroup;
@@ -189,10 +191,14 @@ export class LoadBalancerFactory {
    * @param scope
    * @param loadBalancerindex
    */
-  private createLoadBalancer(scope: Construct, loadBalancerindex: number): ApplicationLoadBalancer {
+  private createLoadBalancer(scope: Construct,
+    loadBalancerindex: number,
+    healthMonitorProps: HealthMonitorProps,
+  ): ApplicationLoadBalancer {
     return new ApplicationLoadBalancer(scope, `ALB_${loadBalancerindex}`, {
       vpc: this.vpc,
       internetFacing: false,
+      deletionProtection: healthMonitorProps.deletionProtection ?? true,
     });
   }
 }
@@ -222,7 +228,7 @@ class LoadBalancerManager {
     loadBalancer: ApplicationLoadBalancer,
     fleet: IMonitorableFleet,
     healthCheckConfig: HealthCheckConfig,
-    elbAccountLimits?: Limit[]) {
+    healthMonitorProps: HealthMonitorProps) {
 
     // this initializes with 0 and keeps the track of all components
     // newly added down the hierarchy.
@@ -233,7 +239,7 @@ class LoadBalancerManager {
     // check for target limit in load balancer
     const targetPerLoadBalancerLimit = LoadBalancerFactory.getAccountLimit('targets-per-application-load-balancer',
       LoadBalancerFactory.DEFAULT_TARGETS_PER_APPLICATION_LOAD_BALANCER,
-      elbAccountLimits);
+      healthMonitorProps.elbAccountLimits);
     if ((this.loadBalancerComponentCount.targetCount + fleet.targetCapacity) > targetPerLoadBalancerLimit) {
       throw new AWSLimitExhaustedError('AWS service limit "targets-per-application-load-balancer" reached. Limit: ' +
         targetPerLoadBalancerLimit);
@@ -242,7 +248,7 @@ class LoadBalancerManager {
     // check for target group limit in load balancer
     const targetGroupsPerLoadBalancerLimit = LoadBalancerFactory.getAccountLimit('target-groups-per-application-load-balancer',
       LoadBalancerFactory.DEFAULT_TARGET_GROUPS_PER_APPLICATION_LOAD_BALANCER,
-      elbAccountLimits);
+      healthMonitorProps.elbAccountLimits);
     if ((this.loadBalancerComponentCount.targetGroupCount + 1) > targetGroupsPerLoadBalancerLimit) {
       throw new AWSLimitExhaustedError('AWS service limit "target-groups-per-application-load-balancer" reached. Limit: ' +
         targetGroupsPerLoadBalancerLimit);
@@ -260,7 +266,7 @@ class LoadBalancerManager {
           listener,
           fleet,
           healthCheckConfig,
-          elbAccountLimits);
+          healthMonitorProps);
 
         statsDelta.add(componentsAdded);
         listenerParent = listener;
@@ -283,7 +289,7 @@ class LoadBalancerManager {
 
       const listenersPerLoadBalancerLimit = LoadBalancerFactory.getAccountLimit('listeners-per-application-load-balancer',
         LoadBalancerFactory.DEFAULT_LISTENERS_PER_APPLICATION_LOAD_BALANCER,
-        elbAccountLimits);
+        healthMonitorProps.elbAccountLimits);
       if ((this.loadBalancerComponentCount.listenerCount + 1) > listenersPerLoadBalancerLimit) {
         throw new AWSLimitExhaustedError('AWS service limit "listeners-per-application-load-balancer" reached. Limit: ' +
           listenersPerLoadBalancerLimit);
@@ -301,7 +307,7 @@ class LoadBalancerManager {
           listenerParent,
           fleet,
           healthCheckConfig,
-          elbAccountLimits);
+          healthMonitorProps);
 
         targetGroupParent = targetGroup;
         statsDelta.add(componentsAdded);
@@ -364,7 +370,7 @@ class ListenerManager {
     listener: ApplicationListener,
     fleet: IMonitorableFleet,
     healthCheckConfig: HealthCheckConfig,
-    elbAccountLimits?: Limit[]) {
+    healthMonitorProps: HealthMonitorProps) {
 
     const componentsAdded = new LoadBalancerComponentStats();
 
@@ -373,7 +379,7 @@ class ListenerManager {
     // check for target limit in listener
     const targetGroupPerLoadBalancerLimit = LoadBalancerFactory.getAccountLimit('target-groups-per-action-on-application-load-balancer',
       LoadBalancerFactory.DEFAULT_TARGET_GROUPS_PER_ACTION_ON_APPLICATION_LOAD_BALANCER,
-      elbAccountLimits);
+      healthMonitorProps.elbAccountLimits);
     if ((this.listenerComponentCount.targetGroupCount + 1) > targetGroupPerLoadBalancerLimit) {
       throw new AWSLimitExhaustedError('AWS service limit "target-groups-per-action-on-application-load-balancer" reached. Limit: ' +
         targetGroupPerLoadBalancerLimit);

packages/aws-rfdk/lib/core/test/health-monitor.test.ts

@@ -11,6 +11,7 @@ import {
   expect as expectCDK,
   haveResource,
   haveResourceLike,
+  ABSENT,
 } from '@aws-cdk/assert';
 import {
   AutoScalingGroup,
@@ -319,7 +320,15 @@ test('2 ASG gets registered to same LB', () => {
   healthMonitor.registerFleet(fleet2, {port: 7171});
 
   // THEN
-  expectCDK(hmStack).to(countResources('AWS::ElasticLoadBalancingV2::LoadBalancer', 1));
+  expectCDK(hmStack).to(countResourcesLike('AWS::ElasticLoadBalancingV2::LoadBalancer', 1, {
+    LoadBalancerAttributes: [
+      {
+        Key: 'deletion_protection.enabled',
+        Value: 'true',
+      },
+    ],
+    Scheme: 'internal',
+  }));
   expectCDK(wfStack).to(countResources('AWS::ElasticLoadBalancingV2::Listener', 2));
   expectCDK(wfStack).to(haveResource('AWS::ElasticLoadBalancingV2::Listener'));
   expectCDK(wfStack).to(haveResourceLike('AWS::ElasticLoadBalancingV2::TargetGroup', {
@@ -372,6 +381,12 @@ test('validating LB target limit', () => {
 
   // THEN
   expectCDK(hmStack).to(countResourcesLike('AWS::ElasticLoadBalancingV2::LoadBalancer', 2, {
+    LoadBalancerAttributes: [
+      {
+        Key: 'deletion_protection.enabled',
+        Value: 'true',
+      },
+    ],
     Scheme: 'internal',
     Type: 'application',
   }));
@@ -407,6 +422,12 @@ test('validating LB listener limit', () => {
 
   // THEN
   expectCDK(hmStack).to(countResourcesLike('AWS::ElasticLoadBalancingV2::LoadBalancer', 2, {
+    LoadBalancerAttributes: [
+      {
+        Key: 'deletion_protection.enabled',
+        Value: 'true',
+      },
+    ],
     Scheme: 'internal',
     Type: 'application',
   }));
@@ -466,4 +487,24 @@ test('validating target limit exhaustion', () => {
   expect(() => {
     healthMonitor.registerFleet(fleet, {});
   }).toThrowError(/AWS service limit \"targets-per-application-load-balancer\" reached. Limit: 1/);
+});
+
+test('validating deletion protection', () => {
+  // WHEN
+  healthMonitor = new HealthMonitor(hmStack, 'healthMonitor2', {
+    vpc,
+    deletionProtection: false,
+  });
+
+  const fleet = new TestMonitorableFleet(wfStack, 'workerFleet', {
+    vpc,
+  });
+  healthMonitor.registerFleet(fleet, {});
+
+  // THEN
+  expectCDK(hmStack).to(haveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', {
+    LoadBalancerAttributes: ABSENT,
+    Scheme: 'internal',
+    Type: 'application',
+  }));
 });

packages/aws-rfdk/lib/deadline/lib/render-queue-ref.ts

@@ -262,6 +262,17 @@ export interface RenderQueueProps {
    * @default - LogGroup will be created with all properties' default values and a prefix of "/renderfarm/".
    */
   readonly logGroupProps?: LogGroupFactoryProps;
+
+  /**
+   * Indicates whether deletion protection is enabled for the LoadBalancer.
+   *
+   * @default true
+   *
+   * Note: This value is true by default which means that the deletion protection is enabled for the
+   * load balancer. Hence, user needs to disable it using AWS Console or CLI before deleting the stack.
+   * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html#deletion-protection
+   */
+  readonly deletionProtection?: boolean;
 }
 
 /**

packages/aws-rfdk/lib/deadline/lib/render-queue.ts

@@ -318,14 +318,20 @@ export class RenderQueue extends RenderQueueBase implements IGrantable {
       loadBalancerFQDN = `${label}.${props.hostname.zone.zoneName}`;
     }
 
+    const loadBalancer = new ApplicationLoadBalancer(this, 'LB', {
+      vpc: this.cluster.vpc,
+      internetFacing: false,
+      deletionProtection: props.deletionProtection ?? true,
+    });
+
     this.pattern = new ApplicationLoadBalancedEc2Service(this, 'AlbEc2ServicePattern', {
       certificate: this.clientCert,
       cluster: this.cluster,
       desiredCount: props.renderQueueSize?.desired,
       domainZone: props.hostname?.zone,
       domainName: loadBalancerFQDN,
       listenerPort: externalPortNumber,
-      publicLoadBalancer: false,
+      loadBalancer,
       protocol: externalProtocol,
       taskDefinition,
       // This is required to right-size our host capacity and not have the ECS service block on updates. We set a memory