(aws-ecs-patterns): (ApplicationLoadBalancedFargateService has publicLoadBalancer set to True by default but should be False)

[yatri1306]

Describe the feature

ApplicationLoadBalancedFargateService construct creates an internet facing load balancer by default because prop publicLoadBalancer is by default set to true. publicLoadBalancer should be false by default as it is an optional parameter.

Use Case

If ApplicationLoadBalancedFargateService is a construct for everyone to use, why is publicLoadBalancer is by default set to true? This creates an internet facing load balancer by default for all users and risks exposing endpoints to the internet which can cause security issues. Even if users define the VPC prop, an internet facing load balancer is created. The default value for publicLoadBalancer should be set to false to allow users to create more secure, internal load balancers.

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.156.0

Environment details (OS name and version, etc.)

All

[khushail]

Hi @yatri1306 , thanks for reporting this. Sharing my observation here -

The patterns are designed to be well constructed services with opinionated defaults. So it seems to be usecase dependent when implemented.

In the CDK docs, it states the property publicLoadBalancer as optional and sets the default:true - https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ecs_patterns.ApplicationLoadBalancedFargateService.html#publicloadbalancer.

In the code, setting this to true, makes the internetfacing true -

aws-cdk/packages/aws-cdk-lib/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts

Line 477 in 2966832

const internetFacing = props.publicLoadBalancer ?? true;

which confirns what you are saying is true. I also tried to repro this by code sample and this is what the synthesized template looks like -

    const patterns = new ecspatterns.ApplicationLoadBalancedFargateService(this, 'PatternsIssue', {
      cpu: 512,
      memoryLimitMiB: 1024,
      taskImageOptions: {
        image: ecs.ContainerImage.fromRegistry('amazon/amazon-ecs-sample'),
      },
    });

Snippet of synthesized template which creates the public load balancer with internetfacing scheme-

{
 "Resources": {
  "PatternsIssueLB1BAE96F8": {
   "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer",
   "Properties": {
    "LoadBalancerAttributes": [
     {
      "Key": "deletion_protection.enabled",
      "Value": "false"
     }
    ],
    "Scheme": "internet-facing",
    "SecurityGroups": [
     {
      "Fn::GetAtt": [
       "PatternsIssueLBSecurityGroup55B426A8",
       "GroupId"
      ]
     }
    ],

However the AWS doc mentions that a default internet-facing load balancer would be created, ref below -

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-loadbalancer.html#cfn-elasticloadbalancingv2-loadbalancer-scheme

Scheme

    The nodes of an Internet-facing load balancer have public IP addresses. The DNS name of an Internet-facing load balancer is publicly resolvable to the public IP addresses of the nodes. Therefore, Internet-facing load balancers can route requests from clients over the internet.

    The nodes of an internal load balancer have only private IP addresses. The DNS name of an internal load balancer is publicly resolvable to the private IP addresses of the nodes. Therefore, internal load balancers can route requests only from clients with access to the VPC for the load balancer.

    **The default is an Internet-facing load balancer.**

    You cannot specify a scheme for a Gateway Load Balancer.

    Required: No

    Type: String

    Allowed values: internet-facing | internal

So if I understood it correctly, it seems that its done with purpose and am not really sure if changing the default should be done but since this is opinionated, we are open to feedback from the community. Please feel free to share your thoughts on this if something is misinterpreted

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.