ecsPatterns.ApplicationLoadBalancedFargateService always create HTTP target groups

[lemiesz]

❓ General Issue

I am creating a ALBEcs service with HTTPs like this

    this.service = new ecsPatterns.ApplicationLoadBalancedFargateService(
      this,
      "Service",
      {
        publicLoadBalancer: true,

        domainName: `portal.example.com`,
        domainZone: new HostedZone(this, "HostedZone", {
          zoneName: `example.com`
        }),
        protocol: elbv2.ApplicationProtocol.HTTPS,
        listenerPort: 443,
        cluster: props.ecsCluster,
        memoryLimitMiB: 1024,
        cpu: 512,
        loadBalancer: new elbv2.ApplicationLoadBalancer(this, "ALB", {
          securityGroup: alphaCorp443sg,
          vpc: props.ecsCluster.vpc,
          loadBalancerName: "Portal-ALB",
          internetFacing: true
        }),

The problem is that this always creates the ALB target groups over HTTP with not option to change to HTTPS.

https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts#L319-L321.

In my current application architecture this does not work since we terminate SSL at the nginx layer, inside each container.

The Question

Why does CDK not allow specifying the target group protocol to use HTTPS

Environment

• CDK CLI Version: "1.17.1
• Module Version: 1.17.1
• OS: OSX
• Language: Typescript

[lemiesz]

Ping anyone got advice on how to solve this. I need end-to-end traffic encryption

[kohidave]

Howdy! Thanks for reaching out, and sorry for the delay.

So, to answer the "Why?" part of your question - The reason the pattern redirects to HTTP of your target group is because your Target Group is within your VPC - so doing TLS termination at the Load Balancer level, and trusting the security of your VPC is very common.

HTTPS within a VPC is useful only if you don't trust the actors within your VPC - which we thought would be an uncommon situation.

As to how you can wire up your ALB to talk to an HTTPS Target Group - hmmm. I'm not sure - there's no way, within the pattern, to manually specify the TargetGroup.

If this is something you need now - I'd say you'd have to forgo this particular pattern.

Just to help me out - could you tell me why you want to encrypt traffic once its within your VPC? My guess is that you might share it with a bunch of other services/teams - is that right?

[bvtujo]

Closing this as duplicate--please refer to #7266 for latest developments here.