fix(elasticloadbalancingv2): open, dual-stack-without-public-ipv4 ALB does not allow IPv6 inbound traffic (under feature flag)#32765
Conversation
aws-cdk-automation
left a comment
There was a problem hiding this comment.
The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.
A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
|
@Mergifyio update |
✅ Branch has been successfully updated |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #32765 +/- ##
=======================================
Coverage 81.52% 81.52%
=======================================
Files 222 222
Lines 13717 13717
Branches 2417 2417
=======================================
Hits 11183 11183
Misses 2254 2254
Partials 280 280
Flags with carried forward coverage won't be shown. Click here to find out more.
|
9e01387 to
7c5dc35
Compare
packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-listener.ts
Show resolved
Hide resolved
Co-authored-by: Clare Liguori <clareliguori@users.noreply.github.com>
7c5dc35 to
1055dba
Compare
| * **Redirects**: use `ListenerAction.redirect()` to serve an HTTP | ||
| redirect response (ALB only). | ||
| - **Authentication**: use `ListenerAction.authenticateOidc()` to | ||
| * **Authentication**: use `ListenerAction.authenticateOidc()` to |
There was a problem hiding this comment.
Did you run some Markdown linting to catch these things? Does it auto fix?
There was a problem hiding this comment.
Yes I think I installed the markdownlint VSCode extension mentioned in RFC repo readme: https://github.com/aws/aws-cdk-rfcs?tab=readme-ov-file#4-rfc-document which auto-formats markdown files.
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
|
This pull request has been removed from the queue for the following reason: The pull request can't be updated You should look at the reason for the failure and decide if the pull request needs to be fixed or if you want to requeue it. If you want to requeue this pull request, you need to post a comment with the text: |
|
@Mergifyio update |
❌ Mergify doesn't have permission to updateDetailsFor security reasons, Mergify can't update this pull request. Try updating locally. |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
|
Comments on closed issues and PRs are hard for our team to see. |
Issue # (if applicable)
Closes #32197 .
Reason for this change
Default generated security group ingress rules for open, dual-stack-without-public-ipv4 ALB does not allow IPv6 traffic. Only a rule for IPv4 ingress traffic is added to the security group rules currently.
Description of changes
Introduced a new feature flag which is enabled by default so that default generated security group ingress rules now have an additional rule that allows IPv6 ingress from anywhere.
Describe any new or updated permissions being added
No new IAM permissions. Added IPv6 security group ingress rules for open, internet-facing ALBs if IP address type is
dual-stack-without-public-ipv4and feature flag is set totrue(default).Description of how you validated changes
Added unit test which checks the security group rules for both cases where feature flag is enabled/disabled. Updated integration test snapshot.
Checklist
Co-authored-by: Clare Liguori clareliguori@users.noreply.github.com
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license