AWS AWSCloudFormation documentation change
Summary
Added examples for TCP, TLS, and UDP listeners. Updated HTTPS listener example to include explicit SslPolicy and Certificates configuration.
Security assessment
The change adds explicit examples for configuring TLS listeners with security policies (e.g., ELBSecurityPolicy-TLS13-1-2-2021-06) and certificates, which demonstrates security best practices. However, there is no evidence of addressing a specific security vulnerability.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-listener.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-listener.md index b65666f91..daf53c841 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-listener.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-listener.md @@ -200,0 +201,6 @@ After you create your load balancer using [AWS::ElasticLoadBalancingV2::LoadBala + * Create a TCP listener + + * Create a TLS listener + + * Create a UDP listener + @@ -212 +218 @@ The following example creates an HTTP listener with a default action that redire - Type: "AWS::ElasticLoadBalancingV2::Listener" + Type: 'AWS::ElasticLoadBalancingV2::Listener' @@ -215 +221 @@ The following example creates an HTTP listener with a default action that redire - Protocol: "HTTP" + Protocol: HTTP @@ -218 +224 @@ The following example creates an HTTP listener with a default action that redire - - Type: "redirect" + - Type: redirect @@ -220 +226 @@ The following example creates an HTTP listener with a default action that redire - Protocol: "HTTPS" + Protocol: HTTPS @@ -264 +270 @@ The following example creates an HTTPS listener with a default action that forwa - Type: AWS::ElasticLoadBalancingV2::Listener + Type: 'AWS::ElasticLoadBalancingV2::Listener' @@ -267 +273 @@ The following example creates an HTTPS listener with a default action that forwa - Protocol: "HTTPS" + Protocol: HTTPS @@ -268,0 +275,3 @@ The following example creates an HTTPS listener with a default action that forwa + SslPolicy: "ELBSecurityPolicy-TLS13-1-2-2021-06" + Certificates: + - CertificateArn: "arn:aws:acm:us-west-2:123456789012:certificate/88ca7932-756c-46f1-a70d-03fa7EXAMPLE" @@ -270 +279 @@ The following example creates an HTTPS listener with a default action that forwa - - Type: "forward" + - Type: forward @@ -272,3 +280,0 @@ The following example creates an HTTPS listener with a default action that forwa - SslPolicy: ELBSecurityPolicy-TLS13-1-2-2021-06 - Certificates: - - CertificateArn: arn:aws:acm:us-west-2:123456789012:certificate/88ca7932-756c-46f1-a70d-03fa7EXAMPLE @@ -287,0 +294,6 @@ The following example creates an HTTPS listener with a default action that forwa + "SslPolicy": "ELBSecurityPolicy-TLS13-1-2-2021-06", + "Certificates": [ + { + "CertificateArn": "arn:aws:acm:us-west-2:123456789012:certificate/88ca7932-756c-46f1-a70d-03fa7EXAMPLE" + } + ], @@ -295 +307,78 @@ The following example creates an HTTPS listener with a default action that forwa - ], + ] + } + } + } + +### Create a TCP listener + +The following example creates a TCP listener with a default action that forwards traffic to the specified target group. You can create the target group using [AWS::ElasticLoadBalancingV2::TargetGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-targetgroup.html). + +#### YAML + + + myTCPListener: + Type: 'AWS::ElasticLoadBalancingV2::Listener' + Properties: + LoadBalancerArn: !Ref myLoadBalancer + Protocol: TCP + Port: 80 + DefaultActions: + - Type: forward + TargetGroupArn: !Ref myTargetGroup + +#### JSON + + + { + "myTCPListener": { + "Type": "AWS::ElasticLoadBalancingV2::Listener", + "Properties": { + "LoadBalancerArn": { + "Ref": "myLoadBalancer" + }, + "Protocol": "TCP", + "Port": 80, + "DefaultActions": [ + { + "Type": "forward", + "TargetGroupArn": { + "Ref": "myTargetGroup" + } + } + ] + } + } + } + +### Create a TLS listener + +The following example creates a TLS listener with a default action that forwards traffic to the specified target group. When you create a secure listener, you must specify a security policy and a certificate. You can create the target group using [AWS::ElasticLoadBalancingV2::TargetGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-targetgroup.html). + +#### YAML + + + myTLSListener: + Type: 'AWS::ElasticLoadBalancingV2::Listener' + Properties: + LoadBalancerArn: !Ref myLoadBalancer + Protocol: TLS + Port: 443 + SslPolicy: "ELBSecurityPolicy-TLS13-1-2-2021-06" + Certificates: + - CertificateArn: "arn:aws:acm:us-west-2:123456789012:certificate/88ca7932-756c-46f1-a70d-03fa7EXAMPLE" + DefaultActions: + - Type: forward + TargetGroupArn: !Ref myTargetGroup + +#### JSON + + + { + "myTLSListener": { + "Type": "AWS::ElasticLoadBalancingV2::Listener", + "Properties": { + "LoadBalancerArn": { + "Ref": "myLoadBalancer" + }, + "Protocol": "TLS", + "Port": 443, @@ -300,0 +390,49 @@ The following example creates an HTTPS listener with a default action that forwa + ], + "DefaultActions": [ + { + "Type": "forward", + "TargetGroupArn": { + "Ref": "myTargetGroup" + } + } + ] + } + } + } + +### Create a UDP listener + +The following example creates a UDP listener with a default action that forwards traffic to the specified target group. You can create the target group using [AWS::ElasticLoadBalancingV2::TargetGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-targetgroup.html). + +#### YAML + + + myUDPListener: + Type: 'AWS::ElasticLoadBalancingV2::Listener' + Properties: + LoadBalancerArn: !Ref myLoadBalancer + Protocol: UDP + Port: 53 + DefaultActions: + - Type: forward + TargetGroupArn: !Ref myTargetGroup + +#### JSON + + + { + "myUDPListener": { + "Type": "AWS::ElasticLoadBalancingV2::Listener", + "Properties": { + "LoadBalancerArn": { + "Ref": "myLoadBalancer" + }, + "Protocol": "UDP", + "Port": 53, + "DefaultActions": [ + { + "Type": "forward", + "TargetGroupArn": { + "Ref": "myTargetGroup" + } + }