# TlsClientPolicy

Represents the properties needed to define client policy.

- Source: [`aws-appmesh/lib/tls-client-policy.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-appmesh/lib/tls-client-policy.ts#L7)

## Example

```ts
declare const mesh: appmesh.Mesh;
declare const service: cloudmap.Service;

const node = new appmesh.VirtualNode(this, 'node', {
  mesh,
  serviceDiscovery: appmesh.ServiceDiscovery.cloudMap(service),
  listeners: [appmesh.VirtualNodeListener.http({
    port: 8080,
    healthCheck: appmesh.HealthCheck.http({
      healthyThreshold: 3,
      interval: Duration.seconds(5),
      path: '/ping',
      timeout: Duration.seconds(2),
      unhealthyThreshold: 2,
    }),
    timeout: {
      idle: Duration.seconds(5),
    },
  })],
  backendDefaults: {
    tlsClientPolicy: {
      validation: {
        trust: appmesh.TlsValidationTrust.file('/keys/local_cert_chain.pem'),
      },
    },
  },
  accessLog: appmesh.AccessLog.fromFilePath('/dev/stdout'),
});

cdk.Tags.of(node).add('Environment', 'Dev');
```

## Properties

- `enforce`: boolean = true — Whether the policy is enforced.

- `mutualTlsCertificate`: [MutualTlsCertificate](/cdk/api/v2/docs/aws-cdk-lib.aws_appmesh.MutualTlsCertificate.html) — Represents a client TLS certificate.

  **Default:** client TLS certificate is not provided

  The certificate will be sent only if the server requests it, enabling mutual TLS.

- `ports`: number[] — TLS is enforced on the ports specified here.

  **Default:** all ports

  If no ports are specified, TLS will be enforced on all the ports.

- `validation`: [TlsValidation](/cdk/api/v2/docs/aws-cdk-lib.aws_appmesh.TlsValidation.html) (required) — Represents the object for TLS validation context.