fix: adding deletion protection for load balancer (#39)

This commit enables customers to create the load-balancers created
in HealthMonitor and RenderQueue with delete protection.

* Updated the unit tests to validate the change.
* Deployed the kitchen-sink app and verified its functionality.

packages/aws-rfdk/lib/core/lib/health-monitor.ts

@@ -175,7 +175,7 @@ export interface HealthMonitorProps {
 
  /**
  * Describes the current Elastic Load Balancing resource limits for your AWS account.
- * This object should be the output of 'describeAccountLimits' API
+ * This object should be the output of 'describeAccountLimits' API.
  *
  * @default default account limits for ALB is used
  *
@@ -189,6 +189,17 @@ export interface HealthMonitorProps {
  * @default A new Key will be created and used.
  */
  readonly encryptionKey?: IKey;
+
+ /**
+ * Indicates whether deletion protection is enabled for the LoadBalancer.
+ *
+ * @default true
+ *
+ * Note: This value is true by default which means that the deletion protection is enabled for the
+ * load balancer. Hence, user needs to disable it using AWS Console or CLI before deleting the stack.
+ * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html#deletion-protection
+ */
+ readonly deletionProtection?: boolean;
 }
 
 /**
@@ -389,7 +400,7 @@ export class HealthMonitor extends HealthMonitorBase {
  const {loadBalancer, targetGroup} = this.lbFactory.registerWorkerFleet(
  monitorableFleet,
  healthCheckConfig,
- this.props.elbAccountLimits);
+ this.props);
 
  this.createFleetAlarms(monitorableFleet, healthCheckConfig, loadBalancer, targetGroup);
  }

packages/aws-rfdk/lib/core/lib/load-balancer-manager.ts

@@ -17,6 +17,7 @@ import {
  HealthMonitor,
  IMonitorableFleet,
  Limit,
+ HealthMonitorProps,
 } from './health-monitor';
 
 /**
@@ -108,7 +109,7 @@ export class LoadBalancerFactory {
  public registerWorkerFleet(
  fleet: IMonitorableFleet,
  healthCheckConfig: HealthCheckConfig,
- elbAccountLimits?: Limit[]): {
+ healthMonitorProps: HealthMonitorProps): {
  loadBalancer: ApplicationLoadBalancer,
  listener: ApplicationListener,
  targetGroup: ApplicationTargetGroup
@@ -126,7 +127,7 @@ export class LoadBalancerFactory {
  loadBalancer,
  fleet,
  healthCheckConfig,
- elbAccountLimits);
+ healthMonitorProps);
 
  loadBalancerParent = loadBalancer;
  listenerParent = listener;
@@ -149,7 +150,8 @@ export class LoadBalancerFactory {
  // accommodate fleet, create a new one and register
  loadBalancerParent = this.createLoadBalancer(
  this.healthMonitorScope,
- this.loadBalancerMap.size);
+ this.loadBalancerMap.size,
+ healthMonitorProps);
  const loadBalancerManager = new LoadBalancerManager();
 
  // Add it to the map
@@ -161,7 +163,7 @@ export class LoadBalancerFactory {
  loadBalancerParent,
  fleet,
  healthCheckConfig,
- elbAccountLimits);
+ healthMonitorProps);
 
  listenerParent = listener;
  targetGroupParent = targetGroup;
@@ -189,10 +191,14 @@ export class LoadBalancerFactory {
  * @param scope
  * @param loadBalancerindex
  */
- private createLoadBalancer(scope: Construct, loadBalancerindex: number): ApplicationLoadBalancer {
+ private createLoadBalancer(scope: Construct,
+ loadBalancerindex: number,
+ healthMonitorProps: HealthMonitorProps,
+ ): ApplicationLoadBalancer {
  return new ApplicationLoadBalancer(scope, `ALB_${loadBalancerindex}`, {
  vpc: this.vpc,
  internetFacing: false,
+ deletionProtection: healthMonitorProps.deletionProtection ?? true,
  });
  }
 }
@@ -222,7 +228,7 @@ class LoadBalancerManager {
  loadBalancer: ApplicationLoadBalancer,
  fleet: IMonitorableFleet,
  healthCheckConfig: HealthCheckConfig,
- elbAccountLimits?: Limit[]) {
+ healthMonitorProps: HealthMonitorProps) {
 
  // this initializes with 0 and keeps the track of all components
  // newly added down the hierarchy.
@@ -233,7 +239,7 @@ class LoadBalancerManager {
  // check for target limit in load balancer
  const targetPerLoadBalancerLimit = LoadBalancerFactory.getAccountLimit('targets-per-application-load-balancer',
  LoadBalancerFactory.DEFAULT_TARGETS_PER_APPLICATION_LOAD_BALANCER,
- elbAccountLimits);
+ healthMonitorProps.elbAccountLimits);
  if ((this.loadBalancerComponentCount.targetCount + fleet.targetCapacity) > targetPerLoadBalancerLimit) {
  throw new AWSLimitExhaustedError('AWS service limit "targets-per-application-load-balancer" reached. Limit: ' +
  targetPerLoadBalancerLimit);
@@ -242,7 +248,7 @@ class LoadBalancerManager {
  // check for target group limit in load balancer
  const targetGroupsPerLoadBalancerLimit = LoadBalancerFactory.getAccountLimit('target-groups-per-application-load-balancer',
  LoadBalancerFactory.DEFAULT_TARGET_GROUPS_PER_APPLICATION_LOAD_BALANCER,
- elbAccountLimits);
+ healthMonitorProps.elbAccountLimits);
  if ((this.loadBalancerComponentCount.targetGroupCount + 1) > targetGroupsPerLoadBalancerLimit) {
  throw new AWSLimitExhaustedError('AWS service limit "target-groups-per-application-load-balancer" reached. Limit: ' +
  targetGroupsPerLoadBalancerLimit);
@@ -260,7 +266,7 @@ class LoadBalancerManager {
  listener,
  fleet,
  healthCheckConfig,
- elbAccountLimits);
+ healthMonitorProps);
 
  statsDelta.add(componentsAdded);
  listenerParent = listener;
@@ -283,7 +289,7 @@ class LoadBalancerManager {
 
  const listenersPerLoadBalancerLimit = LoadBalancerFactory.getAccountLimit('listeners-per-application-load-balancer',
  LoadBalancerFactory.DEFAULT_LISTENERS_PER_APPLICATION_LOAD_BALANCER,
- elbAccountLimits);
+ healthMonitorProps.elbAccountLimits);
  if ((this.loadBalancerComponentCount.listenerCount + 1) > listenersPerLoadBalancerLimit) {
  throw new AWSLimitExhaustedError('AWS service limit "listeners-per-application-load-balancer" reached. Limit: ' +
  listenersPerLoadBalancerLimit);
@@ -301,7 +307,7 @@ class LoadBalancerManager {
  listenerParent,
  fleet,
  healthCheckConfig,
- elbAccountLimits);
+ healthMonitorProps);
 
  targetGroupParent = targetGroup;
  statsDelta.add(componentsAdded);
@@ -364,7 +370,7 @@ class ListenerManager {
  listener: ApplicationListener,
  fleet: IMonitorableFleet,
  healthCheckConfig: HealthCheckConfig,
- elbAccountLimits?: Limit[]) {
+ healthMonitorProps: HealthMonitorProps) {
 
  const componentsAdded = new LoadBalancerComponentStats();
 
@@ -373,7 +379,7 @@ class ListenerManager {
  // check for target limit in listener
  const targetGroupPerLoadBalancerLimit = LoadBalancerFactory.getAccountLimit('target-groups-per-action-on-application-load-balancer',
  LoadBalancerFactory.DEFAULT_TARGET_GROUPS_PER_ACTION_ON_APPLICATION_LOAD_BALANCER,
- elbAccountLimits);
+ healthMonitorProps.elbAccountLimits);
  if ((this.listenerComponentCount.targetGroupCount + 1) > targetGroupPerLoadBalancerLimit) {
  throw new AWSLimitExhaustedError('AWS service limit "target-groups-per-action-on-application-load-balancer" reached. Limit: ' +
  targetGroupPerLoadBalancerLimit);

packages/aws-rfdk/lib/core/test/health-monitor.test.ts

@@ -11,6 +11,7 @@ import {
  expect as expectCDK,
  haveResource,
  haveResourceLike,
+ ABSENT,
 } from '@aws-cdk/assert';
 import {
  AutoScalingGroup,
@@ -319,7 +320,15 @@ test('2 ASG gets registered to same LB', () => {
  healthMonitor.registerFleet(fleet2, {port: 7171});
 
  // THEN
- expectCDK(hmStack).to(countResources('AWS::ElasticLoadBalancingV2::LoadBalancer', 1));
+ expectCDK(hmStack).to(countResourcesLike('AWS::ElasticLoadBalancingV2::LoadBalancer', 1, {
+ LoadBalancerAttributes: [
+ {
+ Key: 'deletion_protection.enabled',
+ Value: 'true',
+ },
+ ],
+ Scheme: 'internal',
+ }));
  expectCDK(wfStack).to(countResources('AWS::ElasticLoadBalancingV2::Listener', 2));
  expectCDK(wfStack).to(haveResource('AWS::ElasticLoadBalancingV2::Listener'));
  expectCDK(wfStack).to(haveResourceLike('AWS::ElasticLoadBalancingV2::TargetGroup', {
@@ -372,6 +381,12 @@ test('validating LB target limit', () => {
 
  // THEN
  expectCDK(hmStack).to(countResourcesLike('AWS::ElasticLoadBalancingV2::LoadBalancer', 2, {
+ LoadBalancerAttributes: [
+ {
+ Key: 'deletion_protection.enabled',
+ Value: 'true',
+ },
+ ],
  Scheme: 'internal',
  Type: 'application',
  }));
@@ -407,6 +422,12 @@ test('validating LB listener limit', () => {
 
  // THEN
  expectCDK(hmStack).to(countResourcesLike('AWS::ElasticLoadBalancingV2::LoadBalancer', 2, {
+ LoadBalancerAttributes: [
+ {
+ Key: 'deletion_protection.enabled',
+ Value: 'true',
+ },
+ ],
  Scheme: 'internal',
  Type: 'application',
  }));
@@ -466,4 +487,24 @@ test('validating target limit exhaustion', () => {
  expect(() => {
  healthMonitor.registerFleet(fleet, {});
  }).toThrowError(/AWS service limit \"targets-per-application-load-balancer\" reached. Limit: 1/);
+});
+
+test('validating deletion protection', () => {
+ // WHEN
+ healthMonitor = new HealthMonitor(hmStack, 'healthMonitor2', {
+ vpc,
+ deletionProtection: false,
+ });
+
+ const fleet = new TestMonitorableFleet(wfStack, 'workerFleet', {
+ vpc,
+ });
+ healthMonitor.registerFleet(fleet, {});
+
+ // THEN
+ expectCDK(hmStack).to(haveResourceLike('AWS::ElasticLoadBalancingV2::LoadBalancer', {
+ LoadBalancerAttributes: ABSENT,
+ Scheme: 'internal',
+ Type: 'application',
+ }));
 });

packages/aws-rfdk/lib/deadline/lib/render-queue-ref.ts

@@ -262,6 +262,17 @@ export interface RenderQueueProps {
  * @default - LogGroup will be created with all properties' default values and a prefix of "/renderfarm/".
  */
  readonly logGroupProps?: LogGroupFactoryProps;
+
+ /**
+ * Indicates whether deletion protection is enabled for the LoadBalancer.
+ *
+ * @default true
+ *
+ * Note: This value is true by default which means that the deletion protection is enabled for the
+ * load balancer. Hence, user needs to disable it using AWS Console or CLI before deleting the stack.
+ * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html#deletion-protection
+ */
+ readonly deletionProtection?: boolean;
 }
 
 /**

packages/aws-rfdk/lib/deadline/lib/render-queue.ts

@@ -318,14 +318,20 @@ export class RenderQueue extends RenderQueueBase implements IGrantable {
  loadBalancerFQDN = `${label}.${props.hostname.zone.zoneName}`;
  }
 
+ const loadBalancer = new ApplicationLoadBalancer(this, 'LB', {
+ vpc: this.cluster.vpc,
+ internetFacing: false,
+ deletionProtection: props.deletionProtection ?? true,
+ });
+
  this.pattern = new ApplicationLoadBalancedEc2Service(this, 'AlbEc2ServicePattern', {
  certificate: this.clientCert,
  cluster: this.cluster,
  desiredCount: props.renderQueueSize?.desired,
  domainZone: props.hostname?.zone,
  domainName: loadBalancerFQDN,
  listenerPort: externalPortNumber,
- publicLoadBalancer: false,
+ loadBalancer,
  protocol: externalProtocol,
  taskDefinition,
  // This is required to right-size our host capacity and not have the ECS service block on updates. We set a memory