From ded4711ab7062d749b78f6f25361c907b88eb3b2 Mon Sep 17 00:00:00 2001 From: Bharat Parmar Date: Mon, 3 Feb 2025 13:36:09 +0530 Subject: [PATCH 1/2] feat: vpc Endpoint Services --- API.md | 365 ++++++++++++++++++++++++++++++++++++++ src/constructs/network.ts | 312 +++++++++++++++++++++++++++++++- 2 files changed, 672 insertions(+), 5 deletions(-) diff --git a/API.md b/API.md index ea4cdfd..0b7dadf 100644 --- a/API.md +++ b/API.md @@ -313,6 +313,100 @@ public readonly routerId: string; --- +### LoadBalancerConfig + +#### Initializer + +```typescript +import { LoadBalancerConfig } from '@smallcase/cdk-vpc-module' + +const loadBalancerConfig: LoadBalancerConfig = { ... } +``` + +#### Properties + +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| certificates | string[] | *No description.* | +| existingArn | string | *No description.* | +| existingSecurityGroupId | string | *No description.* | +| internetFacing | boolean | *No description.* | +| securityGroupRules | SecurityGroupRule[] | *No description.* | +| subnetGroupName | string | *No description.* | +| targetGroups | TargetGroupConfig[] | *No description.* | + +--- + +##### `certificates`Optional + +```typescript +public readonly certificates: string[]; +``` + +- *Type:* string[] + +--- + +##### `existingArn`Optional + +```typescript +public readonly existingArn: string; +``` + +- *Type:* string + +--- + +##### `existingSecurityGroupId`Optional + +```typescript +public readonly existingSecurityGroupId: string; +``` + +- *Type:* string + +--- + +##### `internetFacing`Optional + +```typescript +public readonly internetFacing: boolean; +``` + +- *Type:* boolean + +--- + +##### `securityGroupRules`Optional + +```typescript +public readonly securityGroupRules: SecurityGroupRule[]; +``` + +- *Type:* SecurityGroupRule[] + +--- + +##### `subnetGroupName`Optional + +```typescript +public readonly subnetGroupName: string; +``` + +- *Type:* string + +--- + +##### `targetGroups`Optional + +```typescript +public readonly targetGroups: TargetGroupConfig[]; +``` + +- *Type:* TargetGroupConfig[] + +--- + ### NetworkACL #### Initializer @@ -352,6 +446,78 @@ public readonly traffic: AclTraffic; --- +### NetworkLoadBalancerConfig + +#### Initializer + +```typescript +import { NetworkLoadBalancerConfig } from '@smallcase/cdk-vpc-module' + +const networkLoadBalancerConfig: NetworkLoadBalancerConfig = { ... } +``` + +#### Properties + +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| securityGroupRules | SecurityGroupRule[] | *No description.* | +| subnetGroupName | string | *No description.* | +| certificates | string[] | *No description.* | +| existingSecurityGroupId | string | *No description.* | +| internetFacing | boolean | *No description.* | + +--- + +##### `securityGroupRules`Required + +```typescript +public readonly securityGroupRules: SecurityGroupRule[]; +``` + +- *Type:* SecurityGroupRule[] + +--- + +##### `subnetGroupName`Required + +```typescript +public readonly subnetGroupName: string; +``` + +- *Type:* string + +--- + +##### `certificates`Optional + +```typescript +public readonly certificates: string[]; +``` + +- *Type:* string[] + +--- + +##### `existingSecurityGroupId`Optional + +```typescript +public readonly existingSecurityGroupId: string; +``` + +- *Type:* string + +--- + +##### `internetFacing`Optional + +```typescript +public readonly internetFacing: boolean; +``` + +- *Type:* boolean + +--- + ### PeeringConfig #### Initializer @@ -485,6 +651,111 @@ public readonly description: string; --- +### TargetGroupConfig + +#### Initializer + +```typescript +import { TargetGroupConfig } from '@smallcase/cdk-vpc-module' + +const targetGroupConfig: TargetGroupConfig = { ... } +``` + +#### Properties + +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| applicationPort | number | *No description.* | +| host | string | *No description.* | +| healthCheckPath | string | *No description.* | +| healthCheckPort | number | *No description.* | +| healthCheckProtocol | aws-cdk-lib.aws_elasticloadbalancingv2.Protocol | *No description.* | +| priority | number | *No description.* | +| protocol | aws-cdk-lib.aws_elasticloadbalancingv2.ApplicationProtocol | *No description.* | +| protocolVersion | aws-cdk-lib.aws_elasticloadbalancingv2.ApplicationProtocolVersion | *No description.* | + +--- + +##### `applicationPort`Required + +```typescript +public readonly applicationPort: number; +``` + +- *Type:* number + +--- + +##### `host`Required + +```typescript +public readonly host: string; +``` + +- *Type:* string + +--- + +##### `healthCheckPath`Optional + +```typescript +public readonly healthCheckPath: string; +``` + +- *Type:* string + +--- + +##### `healthCheckPort`Optional + +```typescript +public readonly healthCheckPort: number; +``` + +- *Type:* number + +--- + +##### `healthCheckProtocol`Optional + +```typescript +public readonly healthCheckProtocol: Protocol; +``` + +- *Type:* aws-cdk-lib.aws_elasticloadbalancingv2.Protocol + +--- + +##### `priority`Optional + +```typescript +public readonly priority: number; +``` + +- *Type:* number + +--- + +##### `protocol`Optional + +```typescript +public readonly protocol: ApplicationProtocol; +``` + +- *Type:* aws-cdk-lib.aws_elasticloadbalancingv2.ApplicationProtocol + +--- + +##### `protocolVersion`Optional + +```typescript +public readonly protocolVersion: ApplicationProtocolVersion; +``` + +- *Type:* aws-cdk-lib.aws_elasticloadbalancingv2.ApplicationProtocolVersion + +--- + ### VpcEndpointConfig #### Initializer @@ -579,6 +850,89 @@ public readonly securityGroupRules: SecurityGroupRule[]; --- +### VpcEndpontServiceConfig + +#### Initializer + +```typescript +import { VpcEndpontServiceConfig } from '@smallcase/cdk-vpc-module' + +const vpcEndpontServiceConfig: VpcEndpontServiceConfig = { ... } +``` + +#### Properties + +| **Name** | **Type** | **Description** | +| --- | --- | --- | +| alb | LoadBalancerConfig | *No description.* | +| name | string | *No description.* | +| nlb | NetworkLoadBalancerConfig | *No description.* | +| acceptanceRequired | boolean | *No description.* | +| additionalTags | {[ key: string ]: string} | *No description.* | +| allowedPrincipals | string[] | *No description.* | + +--- + +##### `alb`Required + +```typescript +public readonly alb: LoadBalancerConfig; +``` + +- *Type:* LoadBalancerConfig + +--- + +##### `name`Required + +```typescript +public readonly name: string; +``` + +- *Type:* string + +--- + +##### `nlb`Required + +```typescript +public readonly nlb: NetworkLoadBalancerConfig; +``` + +- *Type:* NetworkLoadBalancerConfig + +--- + +##### `acceptanceRequired`Optional + +```typescript +public readonly acceptanceRequired: boolean; +``` + +- *Type:* boolean + +--- + +##### `additionalTags`Optional + +```typescript +public readonly additionalTags: {[ key: string ]: string}; +``` + +- *Type:* {[ key: string ]: string} + +--- + +##### `allowedPrincipals`Optional + +```typescript +public readonly allowedPrincipals: string[]; +``` + +- *Type:* string[] + +--- + ### VPCProps #### Initializer @@ -598,6 +952,7 @@ const vPCProps: VPCProps = { ... } | natEipAllocationIds | string[] | *No description.* | | peeringConfigs | {[ key: string ]: PeeringConfig} | *No description.* | | vpcEndpoints | VpcEndpointConfig[] | *No description.* | +| vpcEndpointServices | VpcEndpontServiceConfig[] | *No description.* | --- @@ -651,6 +1006,16 @@ public readonly vpcEndpoints: VpcEndpointConfig[]; --- +##### `vpcEndpointServices`Optional + +```typescript +public readonly vpcEndpointServices: VpcEndpontServiceConfig[]; +``` + +- *Type:* VpcEndpontServiceConfig[] + +--- + ## Protocols diff --git a/src/constructs/network.ts b/src/constructs/network.ts index aa41390..61e24c0 100644 --- a/src/constructs/network.ts +++ b/src/constructs/network.ts @@ -1,4 +1,7 @@ import { aws_ec2 as ec2, CfnOutput, Tags, aws_iam as iam, Stack } from 'aws-cdk-lib'; +import * as acm from 'aws-cdk-lib/aws-certificatemanager'; +import * as elbv2 from 'aws-cdk-lib/aws-elasticloadbalancingv2'; +import * as targets from 'aws-cdk-lib/aws-elasticloadbalancingv2-targets'; import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from 'aws-cdk-lib/custom-resources'; import { Construct } from 'constructs'; import { ObjToStrMap } from '../utils/common'; @@ -65,6 +68,7 @@ export interface VPCProps { readonly vpcEndpoints?: VpcEndpointConfig[]; // List of VPC endpoints to configure readonly natEipAllocationIds?: string[]; readonly subnets: ISubnetsProps[]; + readonly vpcEndpointServices?: VpcEndpontServiceConfig[]; // List of VPC endpoint Service to configure } export interface PeeringConfig { @@ -77,9 +81,9 @@ export interface PeeringConfig { export interface PeeringConnectionInternalType { -/** -* @jsii ignore -*/ + /** + * @jsii ignore + */ [name: string]: ec2.CfnVPCPeeringConnection; } export interface SecurityGroupRule { @@ -101,6 +105,44 @@ export interface VpcEndpointConfig { readonly securityGroupRules?: SecurityGroupRule[]; // Optional list of security group rules for Interface Endpoints readonly additionalTags?: { [key: string]: string }; // Optional additional tags } +// Target Group Configuration Interface +export interface TargetGroupConfig { + readonly host: string; + readonly applicationPort: number; + readonly healthCheckPath?: string; + readonly healthCheckProtocol?: elbv2.Protocol; + readonly protocolVersion?: elbv2.ApplicationProtocolVersion; + readonly protocol?: elbv2.ApplicationProtocol; + readonly healthCheckPort?: number; + readonly priority?: number; +} + +export interface LoadBalancerConfig { + readonly existingArn?: string; + readonly existingSecurityGroupId?: string; + readonly subnetGroupName?: string; + readonly internetFacing?: boolean; + readonly targetGroups?: TargetGroupConfig[]; + readonly certificates?: string[]; + readonly securityGroupRules?: SecurityGroupRule[]; // Optional list of security group rules for Interface Endpoints +} + +export interface NetworkLoadBalancerConfig { + readonly subnetGroupName: string; + readonly securityGroupRules: SecurityGroupRule[]; // Optional list of security group rules for Interface Endpoints + readonly existingSecurityGroupId?: string; + readonly certificates?: string[]; + readonly internetFacing?: boolean; +} + +export interface VpcEndpontServiceConfig { + readonly name: string; + readonly alb: LoadBalancerConfig; + readonly nlb: NetworkLoadBalancerConfig; + readonly allowedPrincipals?: string[]; + readonly acceptanceRequired?: boolean; + readonly additionalTags?: { [key: string]: string }; // Optional additional tags +} export class Network extends Construct { public pbSubnets: ec2.PublicSubnet[] = []; @@ -195,6 +237,11 @@ export class Network extends Construct { this.addVpcEndpoint(endpointConfig); } } + if (props?.vpcEndpointServices) { + for (const vpcEndpointServiceConfig of props.vpcEndpointServices) { + this.addVpcEndpointService(vpcEndpointServiceConfig); + } + } } createSubnet(option: ISubnetsProps, vpc: ec2.Vpc, peeringConnectionId?: PeeringConnectionInternalType) { @@ -376,8 +423,8 @@ export class Network extends Construct { // Helper function to merge subnets based on subnet group names private mergeSubnetsByGroupNames(name: string, service: ec2.InterfaceVpcEndpointAwsService | ec2.GatewayVpcEndpointAwsService - | ec2.InterfaceVpcEndpointService, - subnetGroupNames: string[], externalSubnets?: IExternalVPEndpointSubnets[] ): ec2.SelectedSubnets { + | ec2.InterfaceVpcEndpointService, + subnetGroupNames: string[], externalSubnets?: IExternalVPEndpointSubnets[]): ec2.SelectedSubnets { // Check if subnetGroupNames is required and not empty for Interface VPC Endpoints if ((service instanceof ec2.InterfaceVpcEndpointAwsService || service instanceof ec2.InterfaceVpcEndpointService) && (!subnetGroupNames || subnetGroupNames.length === 0)) { @@ -430,6 +477,28 @@ export class Network extends Construct { return sg; } + // Helper function to create a security group with a list of rules + private createOrExistingSGWithRules(type: string, sgId?: string, rules?: SecurityGroupRule[], name?: string): ec2.SecurityGroup { + const sg = sgId ? ec2.SecurityGroup.fromSecurityGroupId( + this, + `${name}${type}ExistingSecurityGroup`, + sgId, + ) as ec2.SecurityGroup + : new ec2.SecurityGroup(this, `${name}-${type}-sg`, { + vpc: this.vpc, + securityGroupName: `${name}-${type}-sg`, + description: `Custom security group for ${name}`, + allowAllOutbound: true, // Allow all outbound traffic by default + }); + Tags.of(sg).add('Name', `${name}-${type}-sg`); + // If rules are provided, add each rule to the security group + if (rules) { + for (const rule of rules) { + sg.addIngressRule(rule.peer, rule.port, rule.description); + } + } + return sg; + } private applyTagsUsingCustomResource(resourceId: string, resourceType: string, tags: { [key: string]: string }) { new AwsCustomResource(this, `AddTagsTo${resourceType}`, { onCreate: { @@ -458,6 +527,239 @@ export class Network extends Construct { ]), }); } + + private addVpcEndpointService(vpceServiceConfig: VpcEndpontServiceConfig) { + const { alb, name, nlb, allowedPrincipals, acceptanceRequired, additionalTags } = vpceServiceConfig; + let ALB: elbv2.ApplicationLoadBalancer; + let NLB: elbv2.NetworkLoadBalancer; + let vpcEndpointService: ec2.VpcEndpointService; + let nlbTargetGroups: elbv2.INetworkTargetGroup[] = []; + let albListeners: string[]; + let albListener: elbv2.IApplicationListener; + let albOutputArn: string | undefined; + let nlbOutputArn: string | undefined; + // eslint-disable-next-line max-len + const albVpcSubnets = alb.subnetGroupName ? this.mergeSubnetsByGroupNames(name, ec2.InterfaceVpcEndpointService, [alb.subnetGroupName]) : undefined; + + const nlbSecurityGroup = this.createOrExistingSGWithRules('NLB', nlb.existingSecurityGroupId, nlb.securityGroupRules, name); + const albSecurityGroup = this.createOrExistingSGWithRules('ALB', alb.existingSecurityGroupId, alb.securityGroupRules, name); + albSecurityGroup.addIngressRule(nlbSecurityGroup, ec2.Port.HTTPS, 'allowNLBTraffic443'); + albSecurityGroup.addIngressRule(nlbSecurityGroup, ec2.Port.HTTP, 'allowNLBTraffic80'); + // eslint-disable-next-line max-len + const nlbVpcSubnets = nlb.subnetGroupName ? this.mergeSubnetsByGroupNames(name, ec2.InterfaceVpcEndpointService, [nlb.subnetGroupName]) : undefined; + + // const NLB = nlb.existingArn ? elbv2.NetworkLoadBalancer.fromNetworkLoadBalancerAttributes(this, `${name}ExistingNlb`, { + // loadBalancerArn: nlb.existingArn, + // vpc: this.vpc, + // }) : new elbv2.NetworkLoadBalancer(this, `${name}nlb`, { + // vpc: this.vpc, + // vpcSubnets: nlbVpcSubnets, + // internetFacing: nlb.internetFacing ? nlb.internetFacing : false, + // securityGroups: [nlbSecurityGroup!], + // }); + + + // const albListener = ALB.addListener('AlbListener', { + // port: 443, // HTTP Listener + // }); + if (alb.existingArn == undefined) { + ALB = new elbv2.ApplicationLoadBalancer(this, `${name}alb`, { + vpc: this.vpc, + internetFacing: alb?.internetFacing ? alb?.internetFacing : false, + vpcSubnets: albVpcSubnets, + securityGroup: albSecurityGroup, + }); + const nlbTargetGroup = new elbv2.NetworkTargetGroup(this, `NLBTargetGroup${name}`, { + port: 443, + vpc: this.vpc, + protocol: elbv2.Protocol.TCP, + targets: [new targets.AlbArnTarget(ALB.loadBalancerArn, 443)], + }); + nlbTargetGroups.push(nlbTargetGroup); + albListener = ALB.addListener(`${name}-443-ALBListener`, { + port: 443, + certificates: alb.certificates ? alb.certificates.map((certiArn, index) => { + return acm.Certificate.fromCertificateArn(this, `${name}-importAlbCert-${index}`, certiArn); + }) : undefined, + defaultAction: elbv2.ListenerAction.fixedResponse(503, { + contentType: 'text/plain', + messageBody: 'Service is temporarily unavailable.', // Custom Response Body + }), + }); + ALB.addListener(`${name}-HttpListener`, { + port: 80, + defaultAction: elbv2.ListenerAction.redirect({ + port: '443', + protocol: elbv2.ApplicationProtocol.HTTPS, + permanent: true, // HTTP 301 Redirect + }), + }); + albOutputArn = ALB.loadBalancerArn; + } else { + const nlbTargetGroup = new elbv2.NetworkTargetGroup(this, `NLBTargetGroup${name}`, { + port: 443, + vpc: this.vpc, + protocol: elbv2.Protocol.TCP, + targets: [new targets.AlbArnTarget(alb.existingArn, 443)], + }); + nlbTargetGroups.push(nlbTargetGroup); + albListeners = this.getLoadBalancerListener(alb.existingArn, true, name); + albOutputArn = alb.existingArn; + } + NLB = new elbv2.NetworkLoadBalancer(this, `${name}nlb`, { + vpc: this.vpc, + vpcSubnets: nlbVpcSubnets, + internetFacing: nlb.internetFacing ? nlb.internetFacing : false, + securityGroups: [nlbSecurityGroup!], + }); + + // if (alb.existingArn) { + // const nlbTargetGroup = new elbv2.NetworkTargetGroup(this, `NLBTargetGroup${name}`, { + // port: 443, + // vpc: this.vpc, + // protocol: elbv2.Protocol.TCP, + // targets: [new targets.AlbArnTarget(alb.existingArn, 443)], + // }); + // nlbTargetGroups.push(nlbTargetGroup); + // albListeners = this.getLoadBalancerListener(alb.existingArn, true, name); + // albOutputArn = alb.existingArn; + // } + if (nlb.certificates != undefined) { + const certificates: acm.ICertificate[] = nlb.certificates.map((certiArn, index) => { + return acm.Certificate.fromCertificateArn(this, `${name}-importNlbCert-${index}`, certiArn); + }); + NLB.addListener(`${name}NLB443Listener`, { + port: 443, + certificates, + protocol: elbv2.Protocol.HTTPS, + defaultTargetGroups: nlbTargetGroups, + }); + NLB.addListener(`${name}NLB80Listener`, { + port: 80, + protocol: elbv2.Protocol.HTTP, + defaultTargetGroups: nlbTargetGroups, + }); + } else { + NLB.addListener(`${name}NLB443Listener`, { + port: 443, + protocol: elbv2.Protocol.TCP, + defaultTargetGroups: nlbTargetGroups, + }); + NLB.addListener(`${name}NLB80Listener`, { + port: 80, + protocol: elbv2.Protocol.TCP, + defaultTargetGroups: nlbTargetGroups, + }); + } + vpcEndpointService = new ec2.VpcEndpointService(this, `${name}EndpointService`, { + vpcEndpointServiceLoadBalancers: [NLB], + acceptanceRequired: acceptanceRequired, + allowedPrincipals: allowedPrincipals?.map((principal) => new iam.ArnPrincipal(principal)), + contributorInsights: false, + }); + nlbOutputArn = NLB.loadBalancerArn; + this.createVPCEndpointServiceOutputs(vpcEndpointService, name, nlbOutputArn, albOutputArn); + + if (additionalTags) { + Tags.of(vpcEndpointService).add('Name', name); + Object.entries(additionalTags).forEach(([key, value]) => { + Tags.of(vpcEndpointService).add(key, value); + }); + } + + if (alb.targetGroups) { + alb.targetGroups.forEach((tgConfig, index) => { + const albTargetGroup = new elbv2.ApplicationTargetGroup(this, `${name}-AlbTargetGroup-${index}`, { + vpc: this.vpc, + protocolVersion: tgConfig.protocolVersion ? tgConfig.protocolVersion : elbv2.ApplicationProtocolVersion.HTTP1, + protocol: tgConfig.protocol ? tgConfig.protocol : elbv2.ApplicationProtocol.HTTP, + targetType: elbv2.TargetType.IP, + port: tgConfig.applicationPort, + healthCheck: { + path: tgConfig.healthCheckPath, + protocol: tgConfig.healthCheckProtocol ? tgConfig.healthCheckProtocol : elbv2.Protocol.HTTP, + port: tgConfig.healthCheckPort ? `${tgConfig.healthCheckPort}` : `${tgConfig.applicationPort}`, + }, + }); + if (alb.existingArn) { + new elbv2.CfnListenerRule(this, `${name}-http-rule-${index}`, { + listenerArn: albListeners[0], + actions: [ + { + type: 'forward', + targetGroupArn: albTargetGroup.targetGroupArn, + }, + ], + conditions: [ + { + field: 'host-header', + hostHeaderConfig: { + values: [tgConfig.host], + }, + }, + ], + priority: tgConfig.priority ? tgConfig.priority : (index + 1), + }); + } else { + if ( albListener != undefined ) { + albListener.addAction(`${name}-albAction-${index}`, { + conditions: [ + elbv2.ListenerCondition.hostHeaders([tgConfig.host]), + ], + action: elbv2.ListenerAction.forward([albTargetGroup]), + priority: tgConfig.priority ? tgConfig.priority : (index + 1), + }); + } + } + }); + } + + } + private createVPCEndpointServiceOutputs( + vpcEndpointService: ec2.VpcEndpointService, + + name: string, + nlb?: string, + alb?: string, + ) { + new CfnOutput(this, `${name}VpcEndpointServiceName`, { + value: vpcEndpointService.vpcEndpointServiceName, + description: 'The name of the VPC Endpoint Service.', + }); + if (alb != undefined) { + new CfnOutput(this, `${name}AlbArn`, { + value: alb, + description: 'The ALB ARN of the Application Load Balancer.', + }); + } + + if (nlb != undefined) { + new CfnOutput(this, `${name}NlbArn`, { + value: nlb, + description: 'The NLB ARN of the Network Load Balancer.', + }); + } + } + + private getLoadBalancerListener(loadBalancerArn: string, sslEnabled: boolean, name: string) { + const listeners = []; + + if (!sslEnabled) { + listeners.push(elbv2.ApplicationListener.fromLookup(this, name + '-listener-http', { + loadBalancerArn: loadBalancerArn, + listenerProtocol: elbv2.ApplicationProtocol.HTTP, + }).listenerArn); + } + + if (sslEnabled) { + listeners.push(elbv2.ApplicationListener.fromLookup(this, name + '-listener-https', { + loadBalancerArn: loadBalancerArn, + listenerProtocol: elbv2.ApplicationProtocol.HTTPS, + }).listenerArn); + } + return listeners; + } + } From d924acdf2002e4b52dfc8b3f8a2cf7e194375459 Mon Sep 17 00:00:00 2001 From: Bharat Parmar Date: Mon, 3 Feb 2025 13:38:02 +0530 Subject: [PATCH 2/2] feat: remove commited line --- src/constructs/network.ts | 26 -------------------------- 1 file changed, 26 deletions(-) diff --git a/src/constructs/network.ts b/src/constructs/network.ts index 61e24c0..4da83a0 100644 --- a/src/constructs/network.ts +++ b/src/constructs/network.ts @@ -548,20 +548,6 @@ export class Network extends Construct { // eslint-disable-next-line max-len const nlbVpcSubnets = nlb.subnetGroupName ? this.mergeSubnetsByGroupNames(name, ec2.InterfaceVpcEndpointService, [nlb.subnetGroupName]) : undefined; - // const NLB = nlb.existingArn ? elbv2.NetworkLoadBalancer.fromNetworkLoadBalancerAttributes(this, `${name}ExistingNlb`, { - // loadBalancerArn: nlb.existingArn, - // vpc: this.vpc, - // }) : new elbv2.NetworkLoadBalancer(this, `${name}nlb`, { - // vpc: this.vpc, - // vpcSubnets: nlbVpcSubnets, - // internetFacing: nlb.internetFacing ? nlb.internetFacing : false, - // securityGroups: [nlbSecurityGroup!], - // }); - - - // const albListener = ALB.addListener('AlbListener', { - // port: 443, // HTTP Listener - // }); if (alb.existingArn == undefined) { ALB = new elbv2.ApplicationLoadBalancer(this, `${name}alb`, { vpc: this.vpc, @@ -612,18 +598,6 @@ export class Network extends Construct { internetFacing: nlb.internetFacing ? nlb.internetFacing : false, securityGroups: [nlbSecurityGroup!], }); - - // if (alb.existingArn) { - // const nlbTargetGroup = new elbv2.NetworkTargetGroup(this, `NLBTargetGroup${name}`, { - // port: 443, - // vpc: this.vpc, - // protocol: elbv2.Protocol.TCP, - // targets: [new targets.AlbArnTarget(alb.existingArn, 443)], - // }); - // nlbTargetGroups.push(nlbTargetGroup); - // albListeners = this.getLoadBalancerListener(alb.existingArn, true, name); - // albOutputArn = alb.existingArn; - // } if (nlb.certificates != undefined) { const certificates: acm.ICertificate[] = nlb.certificates.map((certiArn, index) => { return acm.Certificate.fromCertificateArn(this, `${name}-importNlbCert-${index}`, certiArn);