(elasticloadbalancingv2): Update rules for alb listener to have two or more actions

Hi,

We have an application load balancer that is targeting a lambda. We want to update its listener’s rule to return fixed response 403 by default and forward actions to target group (of type lambda) if path is /test and method is post. This is doable via management console. With cdk and cloudformation template it throws error: Protocol cannot be specified for target groups with target type ‘lambda’

In management console we have this for listener:

Rule                condition                                              action
1                 IF: Http method is post                            THEN: Forward to target group
                      Path is /test
last              IF: Requests otherwise not routed                  THEN: Return fixed response 403

Reproduction Steps

    let target = new targets.LambdaTarget(this.lambda)
    let applicationLoadBalancerTargetGroup = new elb.ApplicationTargetGroup(this, 'GatewayTargetGroup', {
          port: 443,
          vpc: this.vpc,
          targets: [target]
     })
    let applicationLoadBalancerListener = this.applicationLoadBalancer.addListener('test', {
      port: 443,
      protocol: elb.Protocol.HTTPS,
      certificateArns: [this.cert], 
      defaultAction: elb.ListenerAction.fixedResponse(403, {
        contentType: elb.ContentType.APPLICATION_JSON,
        messageBody: 'Forbidden'
      })
    })
    let applicationLoadBalancerPathListenerRule = new elb.ApplicationListenerRule(this, 'PathListenerRule', {
      listener: applicationLoadBalancerListener,
      priority: 1,
      conditions:[
        elb.ListenerCondition.httpRequestMethods(['POST']),
        elb.ListenerCondition.pathPatterns(['/test'])
      ],
      action: elb.ListenerAction.forward([applicationLoadBalancerTargetGroup])
  })

What did you expect to happen?

To be able to update rules same as what is doable in management console

What actually happened?

cloudformation stack failed with: Protocol cannot be specified for target groups with target type ‘lambda’

I understand according to this https://docs.aws.amazon.com/cdk/api/latest/docs/aws-elasticloadbalancingv2-readme.html#protocol-for-load-balancer-targets seems like creating application target group is only limited to instance type or ip. If that is the case here, is there a workaround to be able to do this in cdk?

Environment

• CDK CLI Version : 1.68.0
• Node.js Version: v13.6.0
• OS : macOS Mojave version 10.14.6
• Language (Version): TypeScript

Other

---

This is 🐛 Bug Report

[corymhall]

@afsanehr this should work as long as you don’t provide port when creating your target group. I have a PR open to add some validation around this behavior.

let applicationLoadBalancerTargetGroup = new elb.ApplicationTargetGroup(this, 'GatewayTargetGroup', {
          vpc: this.vpc,
          targets: [target]
     })

[NGL321]

Okay, I was finally able to reproduce.

My initial assessment was very wrong 🤦. The problem here is that the prop protocol in ApplicationListener cannot presently be specified for Lambda function targets. The exception is being generated by the Elastic Load Balancer API rather than the CDK.

The biggest problem here is that the parameter is forced into the template. If left blank, it is automatically assigned based on port: https://github.com/aws/aws-cdk/blob/f92b65e2a158f918d8f05132ed12a4bb85228997/packages/%40aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-listener.ts#L186 https://github.com/aws/aws-cdk/blob/f92b65e2a158f918d8f05132ed12a4bb85228997/packages/%40aws-cdk/aws-elasticloadbalancingv2/lib/shared/util.ts#L60

There are two possibilities here: either it is intended behavior of ELBv2 and we need to stop forcing protocol, OR it is a bug in the API.

I have cut an internal ticket to the team to determine this. Unfortunately I am not aware of a workaround atm, but I will update this ticket as soon as I hear from the team.

😸 😷