aws-cdk-lib.aws_appmesh.TlsClientPolicy

TlsClientPolicy Struct

Represents the properties needed to define client policy.

Source

aws-appmesh/lib/tls-client-policy.ts

Example

declare const mesh: appmesh.Mesh;
declare const service: cloudmap.Service;

const node = new appmesh.VirtualNode(this, 'node', {
  mesh,
  serviceDiscovery: appmesh.ServiceDiscovery.cloudMap(service),
  listeners: [appmesh.VirtualNodeListener.http({
    port: 8080,
    healthCheck: appmesh.HealthCheck.http({
      healthyThreshold: 3,
      interval: Duration.seconds(5),
      path: '/ping',
      timeout: Duration.seconds(2),
      unhealthyThreshold: 2,
    }),
    timeout: {
      idle: Duration.seconds(5),
    },
  })],
  backendDefaults: {
    tlsClientPolicy: {
      validation: {
        trust: appmesh.TlsValidationTrust.file('/keys/local_cert_chain.pem'),
      },
    },
  },
  accessLog: appmesh.AccessLog.fromFilePath('/dev/stdout'),
});

cdk.Tags.of(node).add('Environment', 'Dev');

# mesh: appmesh.Mesh
# service: cloudmap.Service


node = appmesh.VirtualNode(self, "node",
    mesh=mesh,
    service_discovery=appmesh.ServiceDiscovery.cloud_map(service),
    listeners=[appmesh.VirtualNodeListener.http(
        port=8080,
        health_check=appmesh.HealthCheck.http(
            healthy_threshold=3,
            interval=Duration.seconds(5),
            path="/ping",
            timeout=Duration.seconds(2),
            unhealthy_threshold=2
        ),
        timeout=appmesh.HttpTimeout(
            idle=Duration.seconds(5)
        )
    )],
    backend_defaults=appmesh.BackendDefaults(
        tls_client_policy=appmesh.TlsClientPolicy(
            validation=appmesh.TlsValidation(
                trust=appmesh.TlsValidationTrust.file("/keys/local_cert_chain.pem")
            )
        )
    ),
    access_log=appmesh.AccessLog.from_file_path("/dev/stdout")
)

cdk.Tags.of(node).add("Environment", "Dev")

Mesh mesh;
Service service;


VirtualNode node = VirtualNode.Builder.create(this, "node")
        .mesh(mesh)
        .serviceDiscovery(ServiceDiscovery.cloudMap(service))
        .listeners(List.of(VirtualNodeListener.http(HttpVirtualNodeListenerOptions.builder()
                .port(8080)
                .healthCheck(HealthCheck.http(HttpHealthCheckOptions.builder()
                        .healthyThreshold(3)
                        .interval(Duration.seconds(5))
                        .path("/ping")
                        .timeout(Duration.seconds(2))
                        .unhealthyThreshold(2)
                        .build()))
                .timeout(HttpTimeout.builder()
                        .idle(Duration.seconds(5))
                        .build())
                .build())))
        .backendDefaults(BackendDefaults.builder()
                .tlsClientPolicy(TlsClientPolicy.builder()
                        .validation(TlsValidation.builder()
                                .trust(TlsValidationTrust.file("/keys/local_cert_chain.pem"))
                                .build())
                        .build())
                .build())
        .accessLog(AccessLog.fromFilePath("/dev/stdout"))
        .build();

Tags.of(node).add("Environment", "Dev");

// Install: dotnet add package Amazon.CDK.Lib
Mesh mesh;
Service service;


var node = new VirtualNode(this, "node", new VirtualNodeProps {
    Mesh = mesh,
    ServiceDiscovery = ServiceDiscovery.CloudMap(service),
    Listeners = new [] { VirtualNodeListener.Http(new HttpVirtualNodeListenerOptions {
        Port = 8080,
        HealthCheck = HealthCheck.Http(new HttpHealthCheckOptions {
            HealthyThreshold = 3,
            Interval = Duration.Seconds(5),
            Path = "/ping",
            Timeout = Duration.Seconds(2),
            UnhealthyThreshold = 2
        }),
        Timeout = new HttpTimeout {
            Idle = Duration.Seconds(5)
        }
    }) },
    BackendDefaults = new BackendDefaults {
        TlsClientPolicy = new TlsClientPolicy {
            Validation = new TlsValidation {
                Trust = TlsValidationTrust.File("/keys/local_cert_chain.pem")
            }
        }
    },
    AccessLog = AccessLog.FromFilePath("/dev/stdout")
});

Tags.Of(node).Add("Environment", "Dev");

// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
var mesh Mesh
var service Service


node := appmesh.NewVirtualNode(this, jsii.String("node"), &VirtualNodeProps{
	Mesh: Mesh,
	ServiceDiscovery: appmesh.ServiceDiscovery_CloudMap(service),
	Listeners: []VirtualNodeListener{
		appmesh.VirtualNodeListener_Http(&HttpVirtualNodeListenerOptions{
			Port: jsii.Number(8080),
			HealthCheck: appmesh.HealthCheck_Http(&HttpHealthCheckOptions{
				HealthyThreshold: jsii.Number(3),
				Interval: awscdk.Duration_Seconds(jsii.Number(5)),
				Path: jsii.String("/ping"),
				Timeout: awscdk.Duration_*Seconds(jsii.Number(2)),
				UnhealthyThreshold: jsii.Number(2),
			}),
			Timeout: &HttpTimeout{
				Idle: awscdk.Duration_*Seconds(jsii.Number(5)),
			},
		}),
	},
	BackendDefaults: &BackendDefaults{
		TlsClientPolicy: &TlsClientPolicy{
			Validation: &TlsValidation{
				Trust: appmesh.TlsValidationTrust_File(jsii.String("/keys/local_cert_chain.pem")),
			},
		},
	},
	AccessLog: appmesh.AccessLog_FromFilePath(jsii.String("/dev/stdout")),
})

cdk.Tags_Of(node).Add(jsii.String("Environment"), jsii.String("Dev"))

Properties

enforce?optionalbooleanenforce?optionalboolenforce?optionalBooleanEnforce?optionalboolEnforce?optional*bool= true#

Whether the policy is enforced.

mutualTlsCertificate?optionalMutualTlsCertificatemutual_tls_certificate?optionalMutualTlsCertificatemutualTlsCertificate?optionalMutualTlsCertificateMutualTlsCertificate?optionalMutualTlsCertificateMutualTlsCertificate?optionalMutualTlsCertificate#

Represents a client TLS certificate.

Default: client TLS certificate is not provided

The certificate will be sent only if the server requests it, enabling mutual TLS.

ports?optionalnumber[]ports?optionaltyping.List[int | float]ports?optionalList<Number>Ports?optionaldouble[]Ports?optional*[]*float64#

TLS is enforced on the ports specified here.

Default: all ports

If no ports are specified, TLS will be enforced on all the ports.

validationTlsValidationvalidationTlsValidationvalidationTlsValidationValidationTlsValidationValidationTlsValidationrequired#

Represents the object for TLS validation context.