Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(elasticloadbalancingv2): support AdvertiseTrustStoreCaNames for mTLS #32678

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

feat(elasticloadbalancingv2): support AdvertiseTrustStoreCaNames for mTLS #32678

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b49ac9e
feat(elasticloadbalancingv2): support AdvertiseTrustStoreCaNames for …
kdnakt Dec 28, 2024
c1595ff
Keep the MutualAuthentication interface clean
kdnakt Dec 30, 2024
83d978e
Validate inconsistent mutual authentication mode
kdnakt Dec 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 11 additions & 11 deletions ...ws-elasticloadbalancingv2/test/integ.alb-mtls.js.snapshot/alb-mtls-test-stack.assets.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 4 additions & 3 deletions ...-elasticloadbalancingv2/test/integ.alb-mtls.js.snapshot/alb-mtls-test-stack.template.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,7 +161,7 @@
"S3Bucket": {
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
},
"S3Key": "3322b7049fb0ed2b7cbb644a2ada8d1116ff80c32dca89e6ada846b5de26f961.zip"
"S3Key": "f24ba5e516d9d80b64bc7b0f406eedd12c36b20e7461f3e7719b7ffbdad72410.zip"
},
"Description": "/opt/awscli/aws"
}
Expand All @@ -181,7 +181,7 @@
}
],
"SourceObjectKeys": [
"9249e6ca38e4bef8f254ff6bd15067180e1d3efae918968740de5a3d24d6417d.zip"
"45e09a26a1a9e47354cc26b2d2d775f9331c818cc47f9876dfda9d800e5cb6e4.zip"
],
"DestinationBucketName": {
"Ref": "Bucket83908E77"
Expand Down Expand Up @@ -975,7 +975,7 @@
"S3Bucket": {
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
},
"S3Key": "bde7b5c89cb43285f884c94f0b9e17cdb0f5eb5345005114dd60342e0b8a85a1.zip"
"S3Key": "a1acfc2b5f4f6b183fd2bb9863f486bc5edef6a357b355a070d9a0e502df418c.zip"
},
"Timeout": 900,
"MemorySize": 128,
Expand Down Expand Up @@ -1111,6 +1111,7 @@
"Ref": "LB8A12904C"
},
"MutualAuthentication": {
"AdvertiseTrustStoreCaNames": "on",
"IgnoreClientCertificateExpiry": false,
"Mode": "verify",
"TrustStoreArn": {
Expand Down
4 changes: 1 addition & 3 deletions ...ework-integ/test/aws-elasticloadbalancingv2/test/integ.alb-mtls.js.snapshot/manifest.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 4 additions & 3 deletions ...framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb-mtls.js.snapshot/tree.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions ...s/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb-mtls.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,7 @@ class MutualTls extends Stack {
protocol: elbv2.ApplicationProtocol.HTTPS,
certificates: [certificate],
mutualAuthentication: {
advertiseTrustStoreCaNames: elbv2.AdvertiseTrustStoreCaNames.ON,
ignoreClientCertificateExpiry: false,
mutualAuthenticationMode: elbv2.MutualAuthenticationMode.VERIFY,
trustStore,
Expand Down
1 change: 1 addition & 0 deletions packages/aws-cdk-lib/aws-elasticloadbalancingv2/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -980,6 +980,7 @@ lb.addListener('Listener', {
certificates: [certificate],
// mTLS settings
mutualAuthentication: {
advertiseTrustStoreCaNames: elbv2.AdvertiseTrustStoreCaNames.ON,
ignoreClientCertificateExpiry: false,
mutualAuthenticationMode: elbv2.MutualAuthenticationMode.VERIFY,
trustStore,
Expand Down
23 changes: 23 additions & 0 deletions packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-listener.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,6 +137,13 @@ export interface MutualAuthentication {
* @default false
*/
readonly ignoreClientCertificateExpiry?: boolean;

/**
* Indicates whether trust store CA names are advertised
*
* @default AdvertiseTrustStoreCaNames.OFF
*/
readonly advertiseTrustStoreCaNames?: AdvertiseTrustStoreCaNames;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about changing the type to a boolean and removing the enum? It would provide a cleaner interface

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay I will try it

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks 👍 You can find a sample for the suggested approach here

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the nice sample! I made an update according to it.

}

/**
Expand All @@ -159,6 +166,21 @@ export enum MutualAuthenticationMode {
VERIFY = 'verify',
}

/**
* Indicates whether trust store CA names are advertised
*/
export enum AdvertiseTrustStoreCaNames {
/**
* Off
*/
OFF = 'off',

/**
* On
*/
ON = 'on',
}

/**
* Properties for defining a standalone ApplicationListener
*/
Expand Down Expand Up @@ -263,6 +285,7 @@ export class ApplicationListener extends BaseListener implements IApplicationLis
port,
sslPolicy: props.sslPolicy,
mutualAuthentication: props.mutualAuthentication ? {
advertiseTrustStoreCaNames: props.mutualAuthentication?.advertiseTrustStoreCaNames,
ignoreClientCertificateExpiry: props.mutualAuthentication?.ignoreClientCertificateExpiry,
mode: props.mutualAuthentication?.mutualAuthenticationMode,
trustStoreArn: props.mutualAuthentication?.trustStore?.trustStoreArn,
Expand Down
2 changes: 2 additions & 0 deletions packages/aws-cdk-lib/aws-elasticloadbalancingv2/test/alb/listener.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1953,6 +1953,7 @@ describe('tests', () => {
protocol: elbv2.ApplicationProtocol.HTTPS,
certificates: [importedCertificate(stack)],
mutualAuthentication: {
advertiseTrustStoreCaNames: elbv2.AdvertiseTrustStoreCaNames.ON,
ignoreClientCertificateExpiry: true,
mutualAuthenticationMode: elbv2.MutualAuthenticationMode.VERIFY,
trustStore,
Expand All @@ -1964,6 +1965,7 @@ describe('tests', () => {
// THEN
Template.fromStack(stack).hasResourceProperties('AWS::ElasticLoadBalancingV2::Listener', {
MutualAuthentication: {
AdvertiseTrustStoreCaNames: 'on',
IgnoreClientCertificateExpiry: true,
Mode: 'verify',
TrustStoreArn: stack.resolve(trustStore.trustStoreArn),
Expand Down
Loading