Skip to content

Commit aff160b

Browse files
authored
fix(elasticloadbalancingv2): open, dual-stack-without-public-ipv4 ALB does not allow IPv6 inbound traffic (under feature flag) (#32765)
### Issue # (if applicable) Closes #32197 . ### Reason for this change Default generated security group ingress rules for open, dual-stack-without-public-ipv4 ALB does not allow IPv6 traffic. Only a rule for IPv4 ingress traffic is added to the security group rules currently. ### Description of changes Introduced a new feature flag which is enabled by default so that default generated security group ingress rules now have an additional rule that allows IPv6 ingress from anywhere. ### Describe any new or updated permissions being added No new IAM permissions. Added IPv6 security group ingress rules for open, internet-facing ALBs if IP address type is `dual-stack-without-public-ipv4` and feature flag is set to `true` (default). ### Description of how you validated changes Added unit test which checks the security group rules for both cases where feature flag is enabled/disabled. Updated integration test snapshot. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- Co-authored-by: Clare Liguori <[email protected]> *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent f63ec29 commit aff160b

File tree

15 files changed

+287
-266
lines changed

15 files changed

+287
-266
lines changed

packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.dualstack-without-public-ipv4.js.snapshot/AlbDualstackWithoutPublicIpv4DefaultTestDeployAssertFA6F90DD.assets.json

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.dualstack-without-public-ipv4.js.snapshot/aws-cdk-elbv2-integ-dualstack-without-public-ipv4.assets.json

+3-3
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.dualstack-without-public-ipv4.js.snapshot/aws-cdk-elbv2-integ-dualstack-without-public-ipv4.template.json

+7
Original file line numberDiff line numberDiff line change
@@ -530,6 +530,13 @@
530530
"FromPort": 80,
531531
"IpProtocol": "tcp",
532532
"ToPort": 80
533+
},
534+
{
535+
"CidrIpv6": "::/0",
536+
"Description": "Allow from anyone on port 80",
537+
"FromPort": 80,
538+
"IpProtocol": "tcp",
539+
"ToPort": 80
533540
}
534541
],
535542
"VpcId": {

packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.dualstack-without-public-ipv4.js.snapshot/cdk.out

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.dualstack-without-public-ipv4.js.snapshot/integ.json

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.dualstack-without-public-ipv4.js.snapshot/manifest.json

+2-2
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)