fix(elasticloadbalancingv2): add validation on application listeners for certificates on HTTP protocol #34233

wmattei · 2025-04-23T19:06:33Z

Issue # (if applicable)

Reason for this change

ElasticLoadBalancerV2 throw a 400 error if you try to append a certificate to a listener on port 80 (or protocol HTTP).
This PR brings this same validation to CDK

Description of changes

Added a new check for the application protocol and the length of certificates, and if there is any certificate, throw a validation error.
Also, added a test for this case.

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

…s for certificates on HTTP protocol

badmintoncryer · 2025-04-26T14:13:49Z

@wmattei Could you please merge the newest main branch? It results that needs-maintainer-review lavel will be attached.

…validation

shikha372 · 2025-05-06T16:44:09Z

packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-listener.ts

@@ -263,6 +263,10 @@ export class ApplicationListener extends BaseListener implements IApplicationLis
      throw new ValidationError('At least one of \'port\' or \'protocol\' is required', scope);
    }

+    if (protocol === ApplicationProtocol.HTTP && props.certificates?.length) {


hi @wmattei , does this cause any failure if these values are passed to CFN ? if yes then okay to add it in CDK, if not then this can lead to a breaking change for the users.

@shikha372 it causes an error during deployment.
If I pass certificates to a listener on protocol HTTP I get the following error during deployment:

2:49:19 PM | UPDATE_FAILED | AWS::ElasticLoadBalancingV2::Listener | backendbackendlbba...listen er805306FF55 Resource handler returned message: "A certificate cannot be specified for HTTP listeners (Service: ElasticL oadBalancingV2, Status Code: 400, Request ID: 90e1f770-456b-4639-bd83-39ef554c8d0f) (SDK Attempt Count: 1)" (RequestToken: f6460b90-6dc1-63d3-cad3-259db82be7a1, HandlerErrorCode: InvalidRequest)

Thank you, what do you think about throwing a warning here instead of an error, do not want to cause an unintended breaking change for the existing customers.

We could do that, but I am not sure about the experience of seeing a warning during synth only to the see the deploy fail if the warning is ignore.

Do we have things like this happening on other resources/constructs?

yeah, we've warnings in other constructs/resources as well, if the check is already being handled by CFN, i think we should be good to just let them know before deployment with the warning which they can either bypass or choose to act upon, it doesn't become a blocker for any existing stack that are using such configuration.

an example for reference : https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-s3-notifications/lib/sqs.ts#L35

Got it! Ok, updated the PR, let me know what you think.
Not sure if the warning id needs to be defined somewhere else?

aws-cdk-automation

(This review is outdated)

wmattei · 2025-05-14T01:06:47Z

Exemption Request:

This PR does not contain any change to synthesized stacks, it just adds a new warning.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

mergify · 2025-05-15T17:39:57Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2025-05-15T17:40:01Z

This pull request has been removed from the queue for the following reason: pull request branch update failed.

The pull request can't be updated.

You should update or rebase your pull request manually. If you do, this pull request will automatically be requeued once the queue conditions match again.
If you think this was a flaky issue, you can requeue the pull request, without updating it, by posting a @mergifyio requeue comment.

…validation

Pull request has been modified.

…validation

wmattei · 2025-05-15T18:19:52Z

@shikha372 I think I will need your review again (:

…validation

Pull request has been modified.

…validation

wmattei · 2025-05-23T17:21:40Z

@shikha372 I think I am bit lost on what needs to be done on this PR.

The approval was dismissed.

Is there anything I must do? Thanks

…validation

Pull request has been modified.

aws-cdk-automation · 2025-05-23T23:46:02Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 7aca52e
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

wmattei · 2025-05-23T23:55:26Z

@shikha372 mergify seems to be dismissing your approval 🤔

mergify · 2025-05-24T04:11:21Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2025-05-24T04:11:36Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

chore(elasticloadbalancingv2): Add validation on application listener…

0b2bf0d

…s for certificates on HTTP protocol

github-actions bot added the p2 label Apr 23, 2025

aws-cdk-automation requested a review from a team April 23, 2025 19:06

github-actions bot added the beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK label Apr 23, 2025

chore(elasticloadbalancingv2): Fix test case and changed error message

94c56c1

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Apr 23, 2025

badmintoncryer approved these changes Apr 23, 2025

View reviewed changes

Merge branch 'main' into chore/elasticloadbalancing-http-certificate-…

c0b24f1

…validation

aws-cdk-automation added pr/needs-maintainer-review This PR needs a review from a Core Team Member and removed pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels Apr 26, 2025

github-actions bot mentioned this pull request May 1, 2025

Monthly PR metrics report #34324

Open

shikha372 self-assigned this May 5, 2025

shikha372 reviewed May 6, 2025

View reviewed changes

shikha372 changed the title ~~chore(elasticloadbalancingv2): add validation on application listeners for certificates on HTTP protocol~~ fix(elasticloadbalancingv2): add validation on application listeners for certificates on HTTP protocol May 8, 2025

aws-cdk-automation previously requested changes May 8, 2025

View reviewed changes

Adding warning annotations instead of throwing an error

249d83b

aws-cdk-automation added the pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. label May 14, 2025

shikha372 added pr-linter/exempt-integ-test The PR linter will not require integ test changes and removed pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. labels May 15, 2025

shikha372 previously approved these changes May 15, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label May 15, 2025

Merge branch 'main' into chore/elasticloadbalancing-http-certificate-…

463ee82

…validation

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label May 15, 2025

Merge branch 'main' into chore/elasticloadbalancing-http-certificate-…

5962b04

…validation

wmattei added 2 commits May 19, 2025 13:09

Merge branch 'main' into chore/elasticloadbalancing-http-certificate-…

f9485a9

…validation

Merge branch 'main' into chore/elasticloadbalancing-http-certificate-…

b673d9f

…validation

shikha372 previously approved these changes May 21, 2025

View reviewed changes

Merge branch 'main' into chore/elasticloadbalancing-http-certificate-…

c6869fe

…validation

Merge branch 'main' into chore/elasticloadbalancing-http-certificate-…

e27e53c

…validation

shikha372 previously approved these changes May 23, 2025

View reviewed changes

Merge branch 'main' into chore/elasticloadbalancing-http-certificate-…

7aca52e

…validation

shikha372 approved these changes May 24, 2025

View reviewed changes

mergify bot merged commit ca065bb into aws:main May 24, 2025
18 checks passed

github-actions bot locked as resolved and limited conversation to collaborators May 24, 2025

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label May 24, 2025

fix(elasticloadbalancingv2): add validation on application listeners for certificates on HTTP protocol #34233

fix(elasticloadbalancingv2): add validation on application listeners for certificates on HTTP protocol #34233

Uh oh!

Conversation

wmattei commented Apr 23, 2025

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

badmintoncryer commented Apr 26, 2025

Uh oh!

shikha372 May 6, 2025

Choose a reason for hiding this comment

Uh oh!

wmattei May 6, 2025

Choose a reason for hiding this comment

Uh oh!

shikha372 May 8, 2025

Choose a reason for hiding this comment

Uh oh!

wmattei May 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

shikha372 May 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

shikha372 May 12, 2025

Choose a reason for hiding this comment

Uh oh!

wmattei May 14, 2025

Choose a reason for hiding this comment

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wmattei commented May 14, 2025

Uh oh!

mergify bot commented May 15, 2025

Uh oh!

mergify bot commented May 15, 2025

Uh oh!

wmattei commented May 15, 2025

Uh oh!

wmattei commented May 23, 2025

Uh oh!

aws-cdk-automation commented May 23, 2025

AWS CodeBuild CI Report

Uh oh!

wmattei commented May 23, 2025

Uh oh!

mergify bot commented May 24, 2025

Uh oh!

Uh oh!

github-actions bot commented May 24, 2025

Uh oh!

Uh oh!

wmattei May 9, 2025 •

edited

Loading

shikha372 May 12, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading