Specify container port protocol for ApplicationLoadBalancedFargateService

[jdavisp3]

Specify target group protocol when creating an application load balanced service.

Use Case

To use the ECS Pattern for a LoadBalancedFargateService when the container serves HTTPS.

Proposed Solution

Make the target protocol an option in the constructor.

---

This is a 🚀 Feature Request

[bvtujo]

Hi jdavisp3, just to be clear, are you describing the situation where you need the routing capabilities of the ALB, but need a new HTTPS connection to be originated at the load balancer and routed to your container targets?

[jdavisp3]

Hi jdavisp3, just to be clear, are you describing the situation where you need the routing capabilities of the ALB, but need a new HTTPS connection to be originated at the load balancer and routed to your container targets?

That's exactly right.

[bvtujo]

Thanks for the reply! This fix seems pretty quick at the moment, so barring any unexpected complications we should have this out as an optional parameter shortly.

[jdavisp3]

Thanks for the reply! This fix seems pretty quick at the moment, so barring any unexpected complications we should have this out as an optional parameter shortly.

Awesome! I was able to convince the current version to do this, but I had to add a lot of extra code so having this as an optional parameter will be 👌

[bvtujo]

Would you be able to share any (anonymized, of course) snippets of what you did to coerce the current implementation to behave properly? It would help us understand some of the ways our customers are innovating using the CDK to meet their own needs.

[jdavisp3]

Sure so first I added two port mappings to the container:

container.add_port_mappings(
            ecs.PortMapping(
                container_port=8000, protocol=elasticloadbalancingv2.ApplicationProtocol.HTTPS
            )
        )

Making sure HTTPS came after 80 (I don't need 80 but that's the one that the construct will use so I can configure HTTPS myself).

Then after creating the whole service I did this:

        # so the target group for 80 is healthy even though not really used
        load_balanced_service.target_group.configure_health_check(
            path="/health", port="8000", protocol=elasticloadbalancingv2.ApplicationProtocol.HTTPS
        )

        fargate_service = load_balanced_service.service

        listener = load_balancer.add_listener(
            "https-listener",
            certificates=[certificate],
            protocol=elasticloadbalancingv2.ApplicationProtocol.HTTPS,
        )

        target = fargate_service.load_balancer_target(
            container_name="app-container",
            container_port=8000,
            protocol=elasticloadbalancingv2.ApplicationProtocol.HTTPS,
        )

        target_group = listener.add_targets(
            "target-group",
            protocol=elasticloadbalancingv2.ApplicationProtocol.HTTPS,
            targets=[target],
        )

        target_group.configure_health_check(
            path="/health", protocol=elasticloadbalancingv2.ApplicationProtocol.HTTPS
        )

[bvtujo]

Related #6428

[jdavisp3]

To shed some additional light on the question of "why do you need HTTPS if it's inside your VPC" I would mention the HIPAA guidelines of "encrypt at rest, encrypt in transit". Not to suggest that the networking inside AWS inside isn't rock-solid already, but in general it's easier to satisfy regulatory requirements by following them even when it's not strictly technically necessary.

@kohidave

[justin-ad]

@SomayaB I have the same requirement as @jdavisp3. Building systems that fall under the HIPAA guidelines for handling of PHI. Unless AWS can provide guidance/documentation indicating that traffic within a VPC is protected in accordance with HIPAA guidelines (something authoritative that I can show an auditor), I'm required to ensure end-to-end encryption.

[justin-ad]

Related #7989

[hoegertn]

Also #11381

[bvtujo]

This is resolved as of merge of #11381

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.