Class CcPublicApplicationLoadbalancer

CloudKitect Public Facing Application Load Balancer component. This load balancer is created in public subnet

Default Configuration

Drop Invalid header fields: true Removal Policy: Retain in Production

Default Alarms

1. 4xx error alerts

   • Risk Level: Medium
   • Well Architected Pillar: Reliability, Operational Excellence

2. 5xx error alerts

   • Risk Level: High
   • Well Architected Pillar: Reliability, Operational Excellence

Note that the default alarm uses the CcAlarm construct, which sets up an alarm action to notify the SNS Topic AlarmEventsTopic by default.

Examples

Default Usage

new CcPublicApplicationLoadbalancer(this, "LogicalId", {});
Copy

Custom Configuration

new CcPublicApplicationLoadbalancer(this, "LogicalId", {
   deletionProtection: false
});
Copy

Compliance

It addresses the following compliance requirements

1. Ensure ALB is always using https, by redirecting http to https

   • Risk Level: High
   • Compliance: PCI, APRA, NIST4
   • Well Architected Pillar: Security

2. Enable access logs in production

   • Risk Level: Medium
   • Compliance: PCI, HIPAA, APRA, MAS, NIST4
   • Well Architected Pillar: Security

3. Cross Zone load balancing enabled

   • Risk Level: Medium
   • Compliance: NIST4
   • Well Architected Pillar: Reliability

4. Security group to only allow https traffic

   • Risk Level: High
   • Compliance: PCI, APRA, MAS, NIST4
   • Well Architected Pillar: Security

Not: WAF is enabled in the patterns, because the rules differ based on use-case.