feat(elasticloadbalancingv2): add security group support for nlb #27978
Conversation
github-actions
bot
added
admired-contributor
|
I was looking at adding |
aws-cdk-automation
added
the
pr/needs-community-review
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
mergify
bot
dismissed
mikewrighton’s stale review
Pull request has been modified.
|
@mikewrighton This good to merge? |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
aws-cdk-automation
removed
the
pr/needs-community-review
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
|
@Mergifyio update |
❌ Mergify doesn't have permission to updateDetailsFor security reasons, Mergify can't update this pull request. Try updating locally. |
mergify
bot
dismissed
mikewrighton’s stale review
Pull request has been modified.
aws-cdk-automation
added
the
pr/needs-community-review
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
aws-cdk-automation
removed
the
pr/needs-community-review
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
# Summary Implement an `IConnectable` interface to a NetworkLoadBalancer. # Why need this change? AWS CDK has great features for abstraction. `IConnectable` interface is one of this. `IConnectable` simplifies the management of security groups. AWS CDK add support security group to NLB at #27978. However, Currently NLB not implement `IConnectable`, so customers can't use useful interface in AWS CDK. # Example use case ```ts declare const lb: elbv2.NetworkLoadBalancer; declare const asg: autoscaling.AutoScalingGroup; asg.connections.allowFrom(lb, ec2.Port.tcp(8088)); // currently can not ``` Closes #26735 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
…by default (under feature flag) (#34675) ### Issue # (if applicable) Closes #34606. ### Reason for this change Currently, CDK's L2 constructs allow setting security groups for NLBs, but this requires explicit configuration. ```ts declare const sg1: ec2.ISecurityGroup; const lb = new elbv2.NetworkLoadBalancer(this, 'LB', { vpc, securityGroups: [sg1], // configure SG explicitly }); ``` This was not originally intended - NLB security group support was implemented later, and the current specification exists to maintain backward compatibility. #27978 #28494 However, when comparing NLBs without security groups to NLBs with security groups configured, the latter has significantly more advantages. Furthermore, once an NLB is created without security groups, it's impossible to add security group configuration later. Therefore, I propose using feature flags to make security group configuration the default for NLBs in CDK. ### Description of changes - Add `@aws-cdk/aws-elasticloadbalancingv2:networkLoadBalancerWithSecurityGroupByDefault` feature flag - Create security groups by default when feature flags are enabled ### Describe any new or updated permissions being added None ### Description of how you validated changes Add both unit and integ tests ### Other information [This implementation](#34606 (comment)) was also proposed in the issue, but it was not implemented because it was difficult to detect when referenced from other Connectables as follows case2. ```ts declare const nlb: elbv2.INetworkLoadBalancer; declare const other: IConnectable; // case1 nlb.connections.allowTo(other, ec2.Port.tcp(1234)); // case2 other.connections.allowTo(nlb, ec2.Port.tcp(2181)); ``` ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
4 participants
Closes #26735.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license