Skip to content

Conversation

@badmintoncryer
Copy link
Contributor

@badmintoncryer badmintoncryer commented Oct 31, 2025

Issue # (if applicable)

None

Reason for this change

ALB now supports for modifying host header and URL information. This feature has already supporrted by cloudformation.
https://docs.aws.amazon.com/ja_jp/elasticloadbalancing/latest/application/rule-transforms.html

Description of changes

  • Add new ListenerTransform class with factory methods:
    • hostHeaderRewrite(): Transform host headers using regex
      patterns
    • urlRewrite(): Transform URL paths using regex patterns
  • Add transforms property to AddApplicationActionProps
  • Add addTransform() method to ApplicationListenerRule
  • Implement validation logic:
    • Transforms require both priority and conditions to be set
    • Maximum one host header rewrite and one URL rewrite per
      rule
    • Exactly one rewrite rule per transform

Describe any new or updated permissions being added

None

Description of how you validated changes

Add both unit and integ tests.

Checklist


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@github-actions github-actions bot added the p2 label Oct 31, 2025
@aws-cdk-automation aws-cdk-automation requested a review from a team October 31, 2025 13:06
@github-actions github-actions bot added the distinguished-contributor [Pilot] contributed 50+ PRs to the CDK label Oct 31, 2025
Copy link
Collaborator

@aws-cdk-automation aws-cdk-automation left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(This review is outdated)

@aws-cdk-automation aws-cdk-automation dismissed their stale review October 31, 2025 13:30

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

*/
@MethodMetadata()
public addAction(id: string, props: AddApplicationActionProps): void {
checkAddRuleProps(this, props);
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because checkAddRuleProps() cannot accept transforms prop, I've added new validation function checkAddActionProps().

}

private validateRewrites(rewrites: RewriteRule[]): void {
if (rewrites.length !== 1) {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In CloudFormation, an array of rewrite rules can be configured, but currently, deploying with multiple rules results in an error.
To prepare for future enhancements, the parameter is defined to accept an array, while validation restricts the number of elements to one.

      transforms: [
        elbv2.ListenerTransform.hostHeaderRewrite([
          {
            regex: '^(.*)\\.example\\.com$',
            replace: '$1.internal.example.com',
          },
          {
            regex: '^(.*)$',
            replace: 'internal.example.com',
          },
        ]),
      ],
Resource handler returned message: "Rule transforms must have exactly one Rewrite (Service: ElasticLoadBalancingV2, Status Code: 400, Request ID: c2ecd108-daad-4c23-bc38-0c5b1348d04a) (SDK Attempt Count: 1)" (RequestToken: d66a6b69-d5c8-2d95-a439-4f422e5905c9, HandlerErrorCode: InvalidRequest)

@badmintoncryer badmintoncryer marked this pull request as ready for review November 2, 2025 02:00
@github-actions
Copy link
Contributor

github-actions bot commented Dec 6, 2025

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.


TestsPassed ☑️SkippedFailed ❌️
Security Guardian Results48 ran47 passed1 failed
TestResult
Security Guardian Results
packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb-transforms.js.snapshot/AlbTransformsStack.template.json
ec2-no-open-security-groups.guard❌ failure

@github-actions
Copy link
Contributor

github-actions bot commented Dec 6, 2025

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.


TestsPassed ☑️SkippedFailed ❌️
Security Guardian Results with resolved templates48 ran47 passed1 failed
TestResult
Security Guardian Results with resolved templates
packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb-transforms.js.snapshot/AlbTransformsStack.template.json
ec2-no-open-security-groups.guard❌ failure

Copy link
Contributor

@mazyu36 mazyu36 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the contribution.
I've added some comments.

readonly removeSuffix?: boolean;

/**
* Transforms to apply to requests and responses
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just to confirm - responses aren't be transformed, correct?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're right!

);
}
}
if (hasTransforms && !hasPriority) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Based on the error message, wouldn't !hasAnyConditions also be necessary?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've updated validation condition to if (hasTransforms && (!hasPriority || !hasAnyConditions)) {.
Validation for cases where conditions or priority are not set is already covered by existing tests, so I have not added new unit tests.

// Rewrite host header
elbv2.ListenerTransform.hostHeaderRewrite([
{
regex: '(.+).example.com',
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't the periods be escaped?

(.+)\\.example\\.com

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, escaping is necessary. I've also added ^ and $ for better example.

@aws-cdk-automation aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jan 5, 2026
@badmintoncryer
Copy link
Contributor Author

@mazyu36 Thank you very much for your review!! I've addressed all of your comments.

@mazyu36
Copy link
Contributor

mazyu36 commented Jan 6, 2026

@badmintoncryer
LGTM. However, it seems like the CI is failing, so could you please fix that? 😅 I'll approve once the CI passes.

@badmintoncryer
Copy link
Contributor Author

@mazyu36 I’ve remembered that Rosetta cannot parse /^..$/ regular expressions. At this moment, I’ve avoided this expression and the build CI has passed.

Copy link
Contributor

@mazyu36 mazyu36 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@aws-cdk-automation aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Jan 6, 2026
@badmintoncryer
Copy link
Contributor Author

@mazyu36 Thank you!!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

distinguished-contributor [Pilot] contributed 50+ PRs to the CDK p2 pr/needs-maintainer-review This PR needs a review from a Core Team Member

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants