Merge branch 'master' into update-eks-alb-controller-2.4.1

packages/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-listener.ts

@@ -508,6 +508,21 @@ export interface IApplicationListener extends IResource, ec2.IConnectable {
    * Don't call this directly. It is called by ApplicationTargetGroup.
    */
   registerConnectable(connectable: ec2.IConnectable, portRange: ec2.Port): void;
+
+  /**
+   * Perform the given action on incoming requests
+   *
+   * This allows full control of the default action of the load balancer,
+   * including Action chaining, fixed responses and redirect responses. See
+   * the `ListenerAction` class for all options.
+   *
+   * It's possible to add routing conditions to the Action added in this way.
+   *
+   * It is not possible to add a default action to an imported IApplicationListener.
+   * In order to add actions to an imported IApplicationListener a `priority`
+   * must be provided.
+   */
+  addAction(id: string, props: AddApplicationActionProps): void;
 }
 
 /**
@@ -627,6 +642,36 @@ abstract class ExternalApplicationListener extends Resource implements IApplicat
     // eslint-disable-next-line max-len
     throw new Error('Can only call addTargets() when using a constructed ApplicationListener; construct a new TargetGroup and use addTargetGroup.');
   }
+
+  /**
+   * Perform the given action on incoming requests
+   *
+   * This allows full control of the default action of the load balancer,
+   * including Action chaining, fixed responses and redirect responses. See
+   * the `ListenerAction` class for all options.
+   *
+   * It's possible to add routing conditions to the Action added in this way.
+   *
+   * It is not possible to add a default action to an imported IApplicationListener.
+   * In order to add actions to an imported IApplicationListener a `priority`
+   * must be provided.
+   */
+  public addAction(id: string, props: AddApplicationActionProps): void {
+    checkAddRuleProps(props);
+
+    if (props.priority !== undefined) {
+      // New rule
+      //
+      // TargetGroup.registerListener is called inside ApplicationListenerRule.
+      new ApplicationListenerRule(this, id + 'Rule', {
+        listener: this,
+        priority: props.priority,
+        ...props,
+      });
+    } else {
+      throw new Error('priority must be set for actions added to an imported listener');
+    }
+  }
 }
 
 /**

packages/@aws-cdk/aws-elasticloadbalancingv2/lib/nlb/network-listener-certificate.ts

@@ -0,0 +1,43 @@
+import { Construct } from 'constructs';
+import { CfnListenerCertificate } from '../elasticloadbalancingv2.generated';
+import { IListenerCertificate } from '../shared/listener-certificate';
+import { INetworkListener } from './network-listener';
+
+// keep this import separate from other imports to reduce chance for merge conflicts with v2-main
+// eslint-disable-next-line no-duplicate-imports, import/order
+import { Construct as CoreConstruct } from '@aws-cdk/core';
+
+/**
+ * Properties for adding a set of certificates to a listener
+ */
+export interface NetworkListenerCertificateProps {
+  /**
+   * The listener to attach the rule to
+   */
+  readonly listener: INetworkListener;
+
+  /**
+   * Certificates to attach
+   *
+   * Duplicates are not allowed.
+   */
+  readonly certificates: IListenerCertificate[];
+}
+
+/**
+ * Add certificates to a listener
+ */
+export class NetworkListenerCertificate extends CoreConstruct {
+  constructor(scope: Construct, id: string, props: NetworkListenerCertificateProps) {
+    super(scope, id);
+
+    const certificates = [
+      ...(props.certificates || []).map(c => ({ certificateArn: c.certificateArn })),
+    ];
+
+    new CfnListenerCertificate(this, 'Resource', {
+      listenerArn: props.listener.listenerArn,
+      certificates,
+    });
+  }
+}

packages/@aws-cdk/aws-elasticloadbalancingv2/lib/nlb/network-listener.ts

@@ -1,12 +1,13 @@
 import * as cxschema from '@aws-cdk/cloud-assembly-schema';
-import { Duration, IResource, Resource } from '@aws-cdk/core';
+import { Duration, IResource, Resource, Lazy } from '@aws-cdk/core';
 import { Construct } from 'constructs';
 import { BaseListener, BaseListenerLookupOptions } from '../shared/base-listener';
 import { HealthCheck } from '../shared/base-target-group';
 import { AlpnPolicy, Protocol, SslPolicy } from '../shared/enums';
 import { IListenerCertificate } from '../shared/listener-certificate';
 import { validateNetworkProtocol } from '../shared/util';
 import { NetworkListenerAction } from './network-listener-action';
+import { NetworkListenerCertificate } from './network-listener-certificate';
 import { INetworkLoadBalancer } from './network-load-balancer';
 import { INetworkLoadBalancerTarget, INetworkTargetGroup, NetworkTargetGroup } from './network-target-group';
 
@@ -160,6 +161,11 @@ export class NetworkListener extends BaseListener implements INetworkListener {
    */
   public readonly loadBalancer: INetworkLoadBalancer;
 
+  /**
+   * ARNs of certificates added to this listener
+   */
+  private readonly certificateArns: string[];
+
   /**
    * the protocol of the listener
    */
@@ -188,13 +194,17 @@ export class NetworkListener extends BaseListener implements INetworkListener {
       protocol: proto,
       port: props.port,
       sslPolicy: props.sslPolicy,
-      certificates: props.certificates,
+      certificates: Lazy.any({ produce: () => this.certificateArns.map(certificateArn => ({ certificateArn })) }, { omitEmptyArray: true }),
       alpnPolicy: props.alpnPolicy ? [props.alpnPolicy] : undefined,
     });
 
+    this.certificateArns = [];
     this.loadBalancer = props.loadBalancer;
     this.protocol = proto;
 
+    if (certs.length > 0) {
+      this.addCertificates('DefaultCertificates', certs);
+    }
     if (props.defaultAction && props.defaultTargetGroups) {
       throw new Error('Specify at most one of \'defaultAction\' and \'defaultTargetGroups\'');
     }
@@ -208,6 +218,29 @@ export class NetworkListener extends BaseListener implements INetworkListener {
     }
   }
 
+  /**
+   * Add one or more certificates to this listener.
+   *
+   * After the first certificate, this creates NetworkListenerCertificates
+   * resources since cloudformation requires the certificates array on the
+   * listener resource to have a length of 1.
+   */
+  public addCertificates(id: string, certificates: IListenerCertificate[]): void {
+    const additionalCerts = [...certificates];
+    if (this.certificateArns.length === 0 && additionalCerts.length > 0) {
+      const first = additionalCerts.splice(0, 1)[0];
+      this.certificateArns.push(first.certificateArn);
+    }
+    // Only one certificate can be specified per resource, even though
+    // `certificates` is of type Array
+    for (let i = 0; i < additionalCerts.length; i++) {
+      new NetworkListenerCertificate(this, `${id}${i + 1}`, {
+        listener: this,
+        certificates: [additionalCerts[i]],
+      });
+    }
+  }
+
   /**
    * Load balance incoming requests to the given target groups.
    *

packages/@aws-cdk/aws-elasticloadbalancingv2/test/alb/listener.test.ts

@@ -707,6 +707,85 @@ describe('tests', () => {
     });
   });
 
+  test('Can add actions to an imported listener', () => {
+    // GIVEN
+    const stack = new cdk.Stack();
+    const stack2 = new cdk.Stack();
+    const vpc = new ec2.Vpc(stack, 'VPC');
+    const lb = new elbv2.ApplicationLoadBalancer(stack, 'LoadBalancer', {
+      vpc,
+    });
+    const listener = lb.addListener('Listener', {
+      port: 80,
+    });
+
+    // WHEN
+    listener.addAction('Default', {
+      action: elbv2.ListenerAction.fixedResponse(404, {
+        contentType: 'text/plain',
+        messageBody: 'Not Found',
+      }),
+    });
+
+    const importedListener = elbv2.ApplicationListener.fromApplicationListenerAttributes(stack2, 'listener', {
+      listenerArn: 'listener-arn',
+      defaultPort: 443,
+      securityGroup: ec2.SecurityGroup.fromSecurityGroupId(stack2, 'SG', 'security-group-id', {
+        allowAllOutbound: false,
+      }),
+    });
+    importedListener.addAction('Hello', {
+      action: elbv2.ListenerAction.fixedResponse(503),
+      conditions: [elbv2.ListenerCondition.pathPatterns(['/hello'])],
+      priority: 10,
+    });
+
+    // THEN
+    Template.fromStack(stack).hasResourceProperties('AWS::ElasticLoadBalancingV2::Listener', {
+      DefaultActions: [
+        {
+          FixedResponseConfig: {
+            ContentType: 'text/plain',
+            MessageBody: 'Not Found',
+            StatusCode: '404',
+          },
+          Type: 'fixed-response',
+        },
+      ],
+    });
+
+    Template.fromStack(stack2).hasResourceProperties('AWS::ElasticLoadBalancingV2::ListenerRule', {
+      ListenerArn: 'listener-arn',
+      Priority: 10,
+      Actions: [
+        {
+          FixedResponseConfig: {
+            StatusCode: '503',
+          },
+          Type: 'fixed-response',
+        },
+      ],
+    });
+  });
+
+  test('actions added to an imported listener must have a priority', () => {
+    // GIVEN
+    const stack = new cdk.Stack();
+
+    const importedListener = elbv2.ApplicationListener.fromApplicationListenerAttributes(stack, 'listener', {
+      listenerArn: 'listener-arn',
+      defaultPort: 443,
+      securityGroup: ec2.SecurityGroup.fromSecurityGroupId(stack, 'SG', 'security-group-id', {
+        allowAllOutbound: false,
+      }),
+    });
+    expect(() => {
+      importedListener.addAction('Hello', {
+        action: elbv2.ListenerAction.fixedResponse(503),
+      });
+    }).toThrow(/priority must be set for actions added to an imported listener/);
+  });
+
   testDeprecated('Can add redirect responses', () => {
     // GIVEN
     const stack = new cdk.Stack();

packages/@aws-cdk/aws-elasticloadbalancingv2/test/nlb/listener.test.ts

@@ -416,6 +416,62 @@ describe('tests', () => {
     })).toThrow(/Protocol must be TLS when certificates have been specified/);
   });
 
+  test('Can pass multiple certificates to network listener constructor', () => {
+    // GIVEN
+    const stack = new cdk.Stack();
+    const vpc = new ec2.Vpc(stack, 'Stack');
+    const lb = new elbv2.NetworkLoadBalancer(stack, 'LB', { vpc });
+
+    // WHEN
+    lb.addListener('Listener', {
+      port: 443,
+      certificates: [
+        importedCertificate(stack, 'cert1'),
+        importedCertificate(stack, 'cert2'),
+      ],
+      defaultTargetGroups: [new elbv2.NetworkTargetGroup(stack, 'Group', { vpc, port: 80 })],
+    });
+
+    // THEN
+    Template.fromStack(stack).hasResourceProperties('AWS::ElasticLoadBalancingV2::Listener', {
+      Protocol: 'TLS',
+    });
+
+    Template.fromStack(stack).hasResourceProperties('AWS::ElasticLoadBalancingV2::ListenerCertificate', {
+      Certificates: [{ CertificateArn: 'cert2' }],
+    });
+  });
+
+  test('Can add multiple certificates to network listener after construction', () => {
+    // GIVEN
+    const stack = new cdk.Stack();
+    const vpc = new ec2.Vpc(stack, 'Stack');
+    const lb = new elbv2.NetworkLoadBalancer(stack, 'LB', { vpc });
+
+    // WHEN
+    const listener = lb.addListener('Listener', {
+      port: 443,
+      certificates: [
+        importedCertificate(stack, 'cert1'),
+      ],
+      defaultTargetGroups: [new elbv2.NetworkTargetGroup(stack, 'Group', { vpc, port: 80 })],
+    });
+
+    listener.addCertificates('extra', [
+      importedCertificate(stack, 'cert2'),
+    ]);
+
+
+    // THEN
+    Template.fromStack(stack).hasResourceProperties('AWS::ElasticLoadBalancingV2::Listener', {
+      Protocol: 'TLS',
+    });
+
+    Template.fromStack(stack).hasResourceProperties('AWS::ElasticLoadBalancingV2::ListenerCertificate', {
+      Certificates: [{ CertificateArn: 'cert2' }],
+    });
+  });
+
   test('not allowed to specify defaultTargetGroups and defaultAction together', () => {
     // GIVEN
     const stack = new cdk.Stack();
@@ -462,3 +518,8 @@ class ResourceWithLBDependency extends cdk.CfnResource {
     this.node.addDependency(targetGroup.loadBalancerAttached);
   }
 }
+
+function importedCertificate(stack: cdk.Stack,
+  certificateArn = 'arn:aws:certificatemanager:123456789012:testregion:certificate/fd0b8392-3c0e-4704-81b6-8edf8612c852') {
+  return acm.Certificate.fromCertificateArn(stack, certificateArn, certificateArn);
+}

packages/@aws-cdk/aws-kinesisanalytics-flink/README.md

@@ -18,7 +18,7 @@
 This package provides constructs for creating Kinesis Analytics Flink
 applications. To learn more about using using managed Flink applications, see
 the [AWS developer
-guide](https://docs.aws.amazon.com/kinesisanalytics/latest/java/what-is.html).
+guide](https://docs.aws.amazon.com/kinesisanalytics/latest/java/).
 
 ## Creating Flink Applications