Enable TLS between Render Queue and clients by default

[horsmand]

Switch the default behaviour in the Render Queue so that TLS between the ALB and clients is enabled by default.

Use Case

This will make using TLS require minimal effort and cost for anyone creating an RFDK render farm, while giving them increased security.

Proposed Solution

To prevent breaking changes to anyone already using TLS in the Render Queue, we will leave the interface as-is, and only add one new enabled field in the RenderQueueExternalTLSProps interface. You can see the interface and where it fits in to the Render Queue's construct props here:

export interface RenderQueueProps {
  readonly trafficEncryption?: RenderQueueTrafficEncryptionProps;
  ...
}
export interface RenderQueueTrafficEncryptionProps {
  readonly externalTLS?: RenderQueueExternalTLSProps;
  ...
}
export interface RenderQueueExternalTLSProps {
  readonly enabled?: boolean;
  readonly acmCertificate?: ICertificate;
  readonly acmCertificateChain?: ISecret;
  readonly rfdkCertificate?: IX509CertificatePem;
}

If no certificate or hostname are provided, they will be created by default as follows:

const hostname = 'renderqueue';
const zoneName = 'rfdk.internal';

const domainZone = new PrivateHostedZone(this, 'DnsZone', {
  vpc,
  zoneName,
});
const fullyQualifiedDomainName = `${hostname}.${domainZone.zoneName}`

const rootCa = new X509CertificatePem(this, 'RootCA', {
  subject: {
    cn: 'RenderQueueRootCA',
  },
});
const rfdkCert = new X509CertificatePem(this, 'RenderQueueCA', {
  subject: {
    cn: fullyQualifiedDomainName,
  },
  signingCertificate: rootCa,
});

Other

This is a breaking change that will enable TLS on farms without it, unless they are modified to set the enabled flag to false.

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request