Skip to content

Commit 067c4a5

Browse files
badmintoncryerbadmintoncryer
authored
feat(elasticloadbalancingv2): application load balancer attributes (#29586)
### Issue # (if applicable) Closes #29585. ### Reason for this change ALB supports some attributes that is not configurable from CDK - `routing.http.preserve_host_header.enabled` - `routing.http.x_amzn_tls_version_and_cipher_suite.enabled` - `routing.http.xff_client_port.enabled` - `routing.http.xff_header_processing.mode` - `waf.fail_open.enabled` ### Description of changes Added some props to `ApplicationLoadBalancerProps`. - `preserveHostHeader` - `xAmznTlsVersionAndCipherSuiteHeaders` - `preserveXffClientPort` - `xffHeaderProcessingMode` - `wafFailOpen` ### Description of how you validated changes Added both unit and integ tests. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 5675010 commit 067c4a5

File tree

8 files changed

+164
-4
lines changed

8 files changed

+164
-4
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.attributes.js.snapshot/aws-cdk-elbv2-integ.assets.json

+2-2
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.attributes.js.snapshot/aws-cdk-elbv2-integ.template.json

+20
Original file line numberDiff line numberDiff line change
@@ -415,6 +415,26 @@
415415
"Key": "routing.http.desync_mitigation_mode",
416416
"Value": "defensive"
417417
},
418+
{
419+
"Key": "routing.http.preserve_host_header.enabled",
420+
"Value": "true"
421+
},
422+
{
423+
"Key": "routing.http.x_amzn_tls_version_and_cipher_suite.enabled",
424+
"Value": "true"
425+
},
426+
{
427+
"Key": "routing.http.xff_client_port.enabled",
428+
"Value": "true"
429+
},
430+
{
431+
"Key": "routing.http.xff_header_processing.mode",
432+
"Value": "preserve"
433+
},
434+
{
435+
"Key": "waf.fail_open.enabled",
436+
"Value": "true"
437+
},
418438
{
419439
"Key": "client_keep_alive.seconds",
420440
"Value": "1000"

‎packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.attributes.js.snapshot/manifest.json

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.attributes.js.snapshot/tree.json

+20
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.attributes.ts

+5
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,11 @@ new elbv2.ApplicationLoadBalancer(stack, 'LB', {
2020
dropInvalidHeaderFields: true,
2121
desyncMitigationMode: elbv2.DesyncMitigationMode.DEFENSIVE,
2222
clientKeepAlive: cdk.Duration.seconds(1000),
23+
preserveHostHeader: true,
24+
xAmznTlsVersionAndCipherSuiteHeaders: true,
25+
preserveXffClientPort: true,
26+
xffHeaderProcessingMode: elbv2.XffHeaderProcessingMode.PRESERVE,
27+
wafFailOpen: true,
2328
});
2429

2530
new elbv2.ApplicationLoadBalancer(stack, 'DesyncMitigationModeMonitor', {

‎packages/aws-cdk-lib/aws-elasticloadbalancingv2/README.md

+16-1
Original file line numberDiff line numberDiff line change
@@ -228,7 +228,22 @@ const lb = new elbv2.ApplicationLoadBalancer(this, 'LB', {
228228
crossZoneEnabled: true,
229229

230230
// Whether the load balancer blocks traffic through the Internet Gateway (IGW).
231-
denyAllIgwTraffic: false
231+
denyAllIgwTraffic: false,
232+
233+
// Whether to preserve host header in the request to the target
234+
preserveHostHeader: true,
235+
236+
// Whether to add the TLS information header to the request
237+
xAmznTlsVersionAndCipherSuiteHeaders: true,
238+
239+
// Whether the X-Forwarded-For header should preserve the source port
240+
preserveXffClientPort: true,
241+
242+
// The processing mode for X-Forwarded-For headers
243+
xffHeaderProcessingMode: elbv2.XffHeaderProcessingMode.APPEND,
244+
245+
// Whether to allow a load balancer to route requests to targets if it is unable to forward the request to AWS WAF.
246+
wafFailOpen: true,
232247
});
233248
```
234249

‎packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-load-balancer.ts

+75
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ import { parseLoadBalancerFullName } from '../shared/util';
1616

1717
/**
1818
* Properties for defining an Application Load Balancer
19+
*
20+
* @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html#load-balancer-attributes
1921
*/
2022
export interface ApplicationLoadBalancerProps extends BaseLoadBalancerProps {
2123
/**
@@ -68,6 +70,74 @@ export interface ApplicationLoadBalancerProps extends BaseLoadBalancerProps {
6870
* @default - Duration.seconds(3600)
6971
*/
7072
readonly clientKeepAlive?: Duration;
73+
74+
/**
75+
* Indicates whether the Application Load Balancer should preserve the host header in the HTTP request
76+
* and send it to the target without any change.
77+
*
78+
* @default false
79+
*/
80+
readonly preserveHostHeader?: boolean;
81+
82+
/**
83+
* Indicates whether the two headers (x-amzn-tls-version and x-amzn-tls-cipher-suite),
84+
* which contain information about the negotiated TLS version and cipher suite,
85+
* are added to the client request before sending it to the target.
86+
*
87+
* The x-amzn-tls-version header has information about the TLS protocol version negotiated with the client,
88+
* and the x-amzn-tls-cipher-suite header has information about the cipher suite negotiated with the client.
89+
*
90+
* Both headers are in OpenSSL format.
91+
*
92+
* @default false
93+
*/
94+
readonly xAmznTlsVersionAndCipherSuiteHeaders?: boolean;
95+
96+
/**
97+
* Indicates whether the X-Forwarded-For header should preserve the source port
98+
* that the client used to connect to the load balancer.
99+
*
100+
* @default false
101+
*/
102+
readonly preserveXffClientPort?: boolean;
103+
104+
/**
105+
* Enables you to modify, preserve, or remove the X-Forwarded-For header in the HTTP request
106+
* before the Application Load Balancer sends the request to the target.
107+
*
108+
* @default XffHeaderProcessingMode.APPEND
109+
*/
110+
readonly xffHeaderProcessingMode?: XffHeaderProcessingMode;
111+
112+
/**
113+
* Indicates whether to allow a WAF-enabled load balancer to route requests to targets
114+
* if it is unable to forward the request to AWS WAF.
115+
*
116+
* @default false
117+
*/
118+
readonly wafFailOpen?: boolean;
119+
}
120+
121+
/**
122+
* Processing mode of the X-Forwarded-For header in the HTTP request
123+
* before the Application Load Balancer sends the request to the target.
124+
*/
125+
export enum XffHeaderProcessingMode {
126+
/**
127+
* Application Load Balancer adds the client IP address (of the last hop) to the X-Forwarded-For header
128+
* in the HTTP request before it sends it to targets.
129+
*/
130+
APPEND = 'append',
131+
/**
132+
* Application Load Balancer preserves the X-Forwarded-For header in the HTTP request,
133+
* and sends it to targets without any change.
134+
*/
135+
PRESERVE = 'preserve',
136+
/**
137+
* Application Load Balancer removes the X-Forwarded-For header
138+
* in the HTTP request before it sends it to targets.
139+
*/
140+
REMOVE = 'remove',
71141
}
72142

73143
/**
@@ -129,6 +199,11 @@ export class ApplicationLoadBalancer extends BaseLoadBalancer implements IApplic
129199
if (props.idleTimeout !== undefined) { this.setAttribute('idle_timeout.timeout_seconds', props.idleTimeout.toSeconds().toString()); }
130200
if (props.dropInvalidHeaderFields) {this.setAttribute('routing.http.drop_invalid_header_fields.enabled', 'true'); }
131201
if (props.desyncMitigationMode !== undefined) {this.setAttribute('routing.http.desync_mitigation_mode', props.desyncMitigationMode); }
202+
if (props.preserveHostHeader) { this.setAttribute('routing.http.preserve_host_header.enabled', 'true'); }
203+
if (props.xAmznTlsVersionAndCipherSuiteHeaders) { this.setAttribute('routing.http.x_amzn_tls_version_and_cipher_suite.enabled', 'true'); }
204+
if (props.preserveXffClientPort) { this.setAttribute('routing.http.xff_client_port.enabled', 'true'); }
205+
if (props.xffHeaderProcessingMode !== undefined) { this.setAttribute('routing.http.xff_header_processing.mode', props.xffHeaderProcessingMode); }
206+
if (props.wafFailOpen) { this.setAttribute('waf.fail_open.enabled', 'true'); }
132207
if (props.clientKeepAlive !== undefined) {
133208
const clientKeepAliveInMillis = props.clientKeepAlive.toMilliseconds();
134209
if (clientKeepAliveInMillis < 1000) {

‎packages/aws-cdk-lib/aws-elasticloadbalancingv2/test/alb/load-balancer.test.ts

+25
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,11 @@ describe('tests', () => {
8585
dropInvalidHeaderFields: true,
8686
clientKeepAlive: cdk.Duration.seconds(200),
8787
denyAllIgwTraffic: true,
88+
preserveHostHeader: true,
89+
xAmznTlsVersionAndCipherSuiteHeaders: true,
90+
preserveXffClientPort: true,
91+
xffHeaderProcessingMode: elbv2.XffHeaderProcessingMode.PRESERVE,
92+
wafFailOpen: true,
8893
});
8994

9095
// THEN
@@ -110,6 +115,26 @@ describe('tests', () => {
110115
Key: 'routing.http.drop_invalid_header_fields.enabled',
111116
Value: 'true',
112117
},
118+
{
119+
Key: 'routing.http.preserve_host_header.enabled',
120+
Value: 'true',
121+
},
122+
{
123+
Key: 'routing.http.x_amzn_tls_version_and_cipher_suite.enabled',
124+
Value: 'true',
125+
},
126+
{
127+
Key: 'routing.http.xff_client_port.enabled',
128+
Value: 'true',
129+
},
130+
{
131+
Key: 'routing.http.xff_header_processing.mode',
132+
Value: 'preserve',
133+
},
134+
{
135+
Key: 'waf.fail_open.enabled',
136+
Value: 'true',
137+
},
113138
{
114139
Key: 'client_keep_alive.seconds',
115140
Value: '200',

0 commit comments

Comments
 (0)