aws / aws/aws-cdk

aws-elasticloadbalancing: Allow for input/specified Security Group

Open
#21,860 3 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-elasticloadbalancing effort/small feature-request p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

packages/@aws-cdk/aws-elasticloadbalancing/lib/load-balancer.ts

ELB should allow for SG to be specified the same way that ELBv2 does. CloudFormation and SDK allow this functionality so there is clearly not a limitation. As it is, the code creates a new SG that is not configurable and creates quite a mess for environments where they SG setup has to be well defined (e.g. DoD SRG).

### Use Case

In a code base with well defined SG setup following WAF having SG's created for ingress to LB from outside and ingress to EC2/ASG from LB using SG references, the current implementation of ELB causes extra and unexpected SG's to be created and applied to the LB itself while the ASG uses the defined SG's creating a scenario where the environment is fully KO until manual intervention is executed to remove the extra SG's and their carried references. It is very messy, as is.

### Proposed Solution

Add readonly value corresponding to specified value then add to ELB during definition.
export interface LoadBalancerProps {
readonly secGroups?: SecurityGroup;
}
Possibly remove lines 249, 258, 259
Possibly change line 265 to "securityGroups: [props.secGroup.SecurityGroupId],"

Of course, this is my non-programmer way to communicate a proposed solution.

Example from ELBv2 - packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-load-balancer.ts
line 22: readonly value corresponding to value specified as property
lines 138-140: add the SG to the LB

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.33.0 (build 859272d)

### Environment details (OS name and version, etc.)

Linux endeavor 5.19.1-zen1-1-zen

Contributor guide

Open the contributing guide

Research direction

Start in packages/@aws-cdk/aws-elasticloadbalancing/lib/load-balancer.ts and compare its LoadBalancerProps and security-group handling with packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-load-balancer.ts, especially the referenced lines. Confirm how the specified SecurityGroup should be passed during ELB definition, then add coverage using the repository's existing tests for this construct; done means a caller can provide the group without an unexpected group being created.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.