ECSPatterns: Support switch for http->https redirect

[juhofriman]

It's common use case to redirect all http requests to https at the load balancer level. Use cases include UI:s that are served from containers and API implementations as well. Giving https upgrade automatically to your users (end users using application and developers testing your API's) is a usability issue. It's like saying: "here I am, but could you talk securely to me?".

Application Load Balancer has great support for this already, but unfortunately it seems like this use case is not supported in ApplicationLoadBalancedFargateService pattern. Same thing probably affects other ALB based high level patterns as well.

Use Case

If you need to implement http to https redirect with ECS Patterns, you have to do some heavy lifting in order to be able to configure simple redirect. ApplicationLoadBalancedFargateServiceProps builder has loadBalancer(), but it seems like then you have to do the heavy VPC configuration and such.

Workaround seems to be something like following.

        ApplicationLoadBalancer loadBalancer = new ApplicationLoadBalancer(this, "loadBalancer", ApplicationLoadBalancerProps.builder()
                .internetFacing(true)
                .vpc(vpc)
                .build());

        ApplicationListener httpListener = loadBalancer.addListener("httpListener", BaseApplicationListenerProps.builder()
                .protocol(ApplicationProtocol.HTTP)
                .build());

        httpListener.addRedirectResponse("https-redirect", AddRedirectResponseProps.builder().statusCode("HTTP_301").protocol("HTTPS").port("443").build());

        ApplicationLoadBalancedFargateService fargateService = new ApplicationLoadBalancedFargateService(
                this,
                "my-fargate-service",
                ApplicationLoadBalancedFargateServiceProps.builder()
                        .cluster(cluster)
                        .certificate(Certificate.fromCertificateArn(this, "ALB-certificate",
                                "arn:aws:acm:eu-west-1:XXXXXXXXXXXX:certificate/XXXXXXXXX"))
                        .domainName("myservice.acme.com")
                        .domainZone(hostedZone)
                        .loadBalancer(loadBalancer)
                        .taskImageOptions(ApplicationLoadBalancedTaskImageOptions.builder()
                                .image(ContainerImage.fromRegistry("amazon/amazon-ecs-sample"))
                                .build())
                        .build());

This "decorates" used load balancer and merges configuration pretty intelligently and this is totally acceptable workaround for me. I personally feel that this is really common pattern in web applications to be able to listen both http and https traffic and upgrade all http requests to https, and it would help AWS and CDK newcomers to be able to define this really common use case in more easy way.

Proposed Solution

High level constructs could take additional "redirectHttpToHttps(boolean)", such as

        ApplicationLoadBalancedFargateService fargateService = new ApplicationLoadBalancedFargateService(
                this,
                "my-fargate-service",
                ApplicationLoadBalancedFargateServiceProps.builder()
                        .cluster(cluster)
                        .certificate(Certificate.fromCertificateArn(this, "ALB-certificate",
                                "arn:aws:acm:eu-west-1:XXXXXXXXXXXX:certificate/XXXXXXXXX"))
                        .domainName("myservice.acme.com")
                        .domainZone(hostedZone)
                        .redirectHttpToHttps(true)
                        .taskImageOptions(ApplicationLoadBalancedTaskImageOptions.builder()
                                .image(ContainerImage.fromRegistry("amazon/amazon-ecs-sample"))
                                .build())
                        .build());

If redirectHttpToHttps is called with true, when certificate is not set, synth should fail, because then http listener which redirects traffic to target group is configured.

More advanced option would be the ability to configure http traffic to target group, because there are applications in the wild that want (for some reason...) handle both http and https traffic. This could be done with something like:

httpPolicy(HttpPolicy.NO_LISTENER) No listener for http
httpPolicy(HttpPolicy.REDIRECT_TO_HTTPS) Do http->https redirect
httpPolicy(HttpPolicy.ROUTE_TO_TARGET_GROUP) Route http traffic to target group

Other

This is just an idea I wanted to share. I don't mind rejection :) I would love to help out, and if this is regarded as a good idea, I just might take some time to investigate how this could be implemented.

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[CaptainChemist]

@juhofriman Thank you so much for requesting this feature. I'm trying to repeat your stopgap example and running into trouble. Did you write this in javascript or a different language? I've created a typescript version here and can't figure how to add your code:

https://gist.github.com/CaptainChemist/c126e8c9b8f497cecaa20c793c48312f

I'm confused about whether you are creating a separate load balancer to handle the port 80 versus the one that is used for port 443 (that we add using the addListener method). I tried simply adding a listener on port 80 and have that code commented out in the gist, but as you mention the approach isn't a great one because it doesn't enforce SSL.

[saiparshi]

I am new to AWS CDK. Could you please provide some sample for ApplicationLoadBalancedFargateService to add listener for https->https. when i give certificate it is throwing A domain name and zone is required when using the HTTPS protocol, i dont have Route53 hosted zone to specify. When i added manually listener to this service in console it is working, need sample for python CDK

[cscharun]

I was struggling with the same problem today and found a solution:

You need to create a listener for your load balancer for HTTP on port 80.

    const httpListener = loadBalancer.addListener("app-lb-listener-http", {
        port: 80,
        protocol: ApplicationProtocol.HTTP
    });

And then you can redirect all incoming HTTP requests to HTTPS by adding a RedirectResponse like so:

    httpListener.addRedirectResponse("app-lb-redirect-https", {
        statusCode: 'HTTP_301',
        protocol: ApplicationProtocol.HTTPS,
        port:'443',
    });

I think this is a common problem and an example solution should be inserted to the cdk examples or documentation.

[MrArnoldPalmer]

@08en yeah I think we should add this to the elasticloadbalancingv2 docs if its not already there.

[piradeepk]

Does it make sense to add this examples to the cdk-examples repo

Yes I would say so. I'd guess that the vast majority of public facing LBs created today would want to have this redirect. Should be easy enough to add in an existing example.