Merge branch 'master' into robertd/fix-core-runtime-selection

Author: mergify[bot]

packages/@aws-cdk/aws-cloudformation/test/integ.core-custom-resources.expected.json

@@ -72,7 +72,8 @@
             "Arn"
           ]
         },
-        "Runtime": "nodejs12.x"
+        "Runtime": "nodejs12.x",
+        "Description": "veni vidi vici"
       },
       "DependsOn": [
         "CustomReflectCustomResourceProviderRoleB4B29AEC"

packages/@aws-cdk/aws-cloudformation/test/integ.core-custom-resources.ts

@@ -24,6 +24,7 @@ class TestStack extends Stack {
     const serviceToken = CustomResourceProvider.getOrCreate(this, resourceType, {
       codeDirectory: `${__dirname}/core-custom-resource-provider-fixture`,
       runtime: CustomResourceProviderRuntime.NODEJS_12,
+      description: 'veni vidi vici',
     });
 
     const cr = new CustomResource(this, 'MyResource', {

packages/@aws-cdk/aws-cloudwatch/lib/private/rendering.ts

@@ -55,6 +55,7 @@ function metricGraphJson(metric: IMetric, yAxis?: string, id?: string) {
 
     withExpression(expr) {
       options.expression = expr.expression;
+      if (expr.period && expr.period !== 300) { options.period = expr.period; }
     },
   });
 

packages/@aws-cdk/aws-cloudwatch/test/integ.math-alarm-and-dashboard.expected.json

@@ -88,7 +88,7 @@
               {
                 "Ref": "AWS::Region"
               },
-              "\",\"metrics\":[[{\"label\":\"Total Messages\",\"expression\":\"m1+m2\"}],[\"AWS/SQS\",\"ApproximateNumberOfMessagesVisible\",\"QueueName\",\"",
+              "\",\"metrics\":[[{\"label\":\"Total Messages\",\"expression\":\"m1+m2\",\"period\":60}],[\"AWS/SQS\",\"ApproximateNumberOfMessagesVisible\",\"QueueName\",\"",
               {
                 "Fn::GetAtt": [
                   "queue",
@@ -120,7 +120,7 @@
               {
                 "Ref": "AWS::Region"
               },
-              "\",\"metrics\":[[{\"label\":\"Total Messages\",\"expression\":\"m1+m2\"}],[\"AWS/SQS\",\"ApproximateNumberOfMessagesVisible\",\"QueueName\",\"",
+              "\",\"metrics\":[[{\"label\":\"Total Messages\",\"expression\":\"m1+m2\",\"period\":60}],[\"AWS/SQS\",\"ApproximateNumberOfMessagesVisible\",\"QueueName\",\"",
               {
                 "Fn::GetAtt": [
                   "queue",

packages/@aws-cdk/aws-cloudwatch/test/test.metric-math.ts

@@ -219,6 +219,28 @@ export = {
       test.done();
     },
 
+    'top level period in a MathExpression is respected in its metrics'(test: Test) {
+      const graph = new GraphWidget({
+        left: [
+          a,
+          new MathExpression({
+            expression: 'a + b',
+            usingMetrics: { a, b },
+            period: Duration.minutes(1),
+          }),
+        ],
+      });
+
+      // THEN
+      graphMetricsAre(test, graph, [
+        ['Test', 'ACount'],
+        [{ label: 'a + b', expression: 'a + b', period: 60 }],
+        ['Test', 'ACount', { visible: false, id: 'a', period: 60 }],
+        ['Test', 'BCount', { visible: false, id: 'b', period: 60 }],
+      ]);
+      test.done();
+    },
+
     'MathExpression controls period of metrics transitively used in it'(test: Test) {
       // Same as the previous test, but recursively
 

packages/@aws-cdk/aws-elasticloadbalancingv2/README.md

@@ -182,6 +182,9 @@ lb.addRedirect({
 
 If you do not provide any options for this method, it redirects HTTP port 80 to HTTPS port 443.
 
+By default all ingress traffic will be allowed on the source port. If you want to be more selective with your
+ingress rules then set `open: false` and use the listener's `connections` object to selectively grant access to the listener.
+
 ## Defining a Network Load Balancer
 
 Network Load Balancers are defined in a similar way to Application Load

packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-load-balancer.ts

@@ -119,7 +119,7 @@ export class ApplicationLoadBalancer extends BaseLoadBalancer implements IApplic
     return this.addListener(`Redirect${sourcePort}To${targetPort}`, {
       protocol: props.sourceProtocol ?? ApplicationProtocol.HTTP,
       port: sourcePort,
-      open: true,
+      open: props.open ?? true,
       defaultAction: ListenerAction.redirect({
         port: targetPort,
         protocol: props.targetProtocol ?? ApplicationProtocol.HTTPS,
@@ -665,4 +665,19 @@ export interface ApplicationLoadBalancerRedirectConfig {
    */
   readonly targetPort?: number;
 
+  /**
+   * Allow anyone to connect to this listener
+   *
+   * If this is specified, the listener will be opened up to anyone who can reach it.
+   * For internal load balancers this is anyone in the same VPC. For public load
+   * balancers, this is anyone on the internet.
+   *
+   * If you want to be more selective about who can access this load
+   * balancer, set this to `false` and use the listener's `connections`
+   * object to selectively grant access to the listener.
+   *
+   * @default true
+   */
+  readonly open?: boolean;
+
 }

packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-target-group.ts

@@ -123,6 +123,9 @@ export class ApplicationTargetGroup extends TargetGroupBase implements IApplicat
 
     if (props) {
       if (props.slowStart !== undefined) {
+        if (props.slowStart.toSeconds() < 30 || props.slowStart.toSeconds() > 900) {
+          throw new Error('Slow start duration value must be between 30 and 900 seconds.');
+        }
         this.setAttribute('slow_start.duration_seconds', props.slowStart.toSeconds().toString());
       }
       if (props.stickinessCookieDuration) {

packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/listener.test.ts

@@ -727,6 +727,31 @@ describe('tests', () => {
     });
   });
 
+  test('Can supress default ingress rules on a simple redirect response', () => {
+    // GIVEN
+    const stack = new cdk.Stack();
+    const vpc = new ec2.Vpc(stack, 'Stack');
+
+    const loadBalancer = new elbv2.ApplicationLoadBalancer(stack, 'LB', {
+      vpc,
+    });
+
+    // WHEN
+    loadBalancer.addRedirect({ open: false });
+
+    // THEN
+    expect(stack).not.toHaveResourceLike('AWS::EC2::SecurityGroup', {
+      SecurityGroupIngress: [
+        {
+          CidrIp: '0.0.0.0/0',
+          Description: 'Allow from anyone on port 80',
+          IpProtocol: 'tcp',
+        },
+      ],
+    });
+
+  });
+
   test('Can add simple redirect responses with custom values', () => {
     // GIVEN
     const stack = new cdk.Stack();

packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/target-group.test.ts

@@ -205,4 +205,21 @@ describe('tests', () => {
       });
     }).toThrow(/Stickiness cookie duration value must be between 1 second and 7 days \(604800 seconds\)./);
   });
+
+  test('Bad slow start duration value', () => {
+    // GIVEN
+    const app = new cdk.App();
+    const stack = new cdk.Stack(app, 'Stack');
+    const vpc = new ec2.Vpc(stack, 'VPC', {});
+
+    // THEN
+    [cdk.Duration.minutes(16), cdk.Duration.seconds(29)].forEach((badDuration, i) => {
+      expect(() => {
+        new elbv2.ApplicationTargetGroup(stack, `TargetGroup${i}`, {
+          slowStart: badDuration,
+          vpc,
+        });
+      }).toThrow(/Slow start duration value must be between 30 and 900 seconds./);
+    });
+  });
 });