Add GuHttpsClassicLoadBalancer #204
Conversation
| }); | ||
| }); | ||
|
|
||
| test("adds the CertificateARN parameter if no value provided", () => { |
| const listenerProps = { ...GuHttpsClassicLoadBalancer.DefaultListener, ...props.listener }; | ||
|
|
||
| if (!listenerProps.sslCertificateId) { | ||
| const certificateId = new GuArnParameter(scope, "CertificateARN", { |
There was a problem hiding this comment.
ACM certificates can be created via CloudFormation. Historically, it's been painful as it's a blocking resource - the stack will remain in "updating" until the certificate has been validated.
Validation takes two forms:
- If email validated, an email will be sent with a link to be clicked. This email goes to a list of domain admins (around 5 people)
- If DNS validated, a CNAME needs created in DNS. Again, admins for the domain service is around 5 people.
However, since the creation of https://github.com/guardian/dns-validation-lambda, it's become more viable to create ACM certs via CFN if domain validated.
(almost at the end of this story!)
Rather than this construct bringing a param for the user to fill in at runtime, should/could it bring an ACM resource with it? Providing the benefit of:
- Less involvement for user (aka reduce human error)
- Applies best practice of domain validated certificates (best practice because they auto-renew vs. email validated which needs manual renewal once a year)
There was a problem hiding this comment.
That would be cool (and thanks for providing the context)! I guess if we find that not all cases can move to this for whatever reason then we can always provide a prop to add a param instead. I'll add this as an idea to the discussions section for now. 💡
What does this change?
This PR adds a new
GuHttpsClassicLoadBalancerconstruct which sets defaults for the load balancer listener. It restricts the number of listeners to one with the following defaults:If a value for the
sslCertificateIdprop is not provided, it also creates a new parameter and sets the output of that as the prop value.Does this change require changes to existing projects or CDK CLI?
No changes are required but stacks which implement the
GuClassLoadBalancerand have an HTTPS listener can reduce the number of props they provide.How to test
Migrate an existing stack to use the
GuHttpsClassLoadBalancerand run the snapshot test to confirm that nothing has changed.How can we measure success?
Stacks can define fewer props to get a standard load balancer which listens for HTTPS traffic