MutualTlsValidation

class aws_cdk.aws_appmesh.MutualTlsValidation(*, trust, subject_alternative_names=None)

Bases: object

Represents the properties needed to define TLS Validation context that is supported for mutual TLS authentication.

Parameters:

trust (MutualTlsValidationTrust) – Reference to where to retrieve the trust chain.
subject_alternative_names (Optional[SubjectAlternativeNames]) – Represents the subject alternative names (SANs) secured by the certificate. SANs must be in the FQDN or URI format. Default: - If you don’t specify SANs on the terminating mesh endpoint, the Envoy proxy for that node doesn’t verify the SAN on a peer client certificate. If you don’t specify SANs on the originating mesh endpoint, the SAN on the certificate provided by the terminating endpoint must match the mesh endpoint service discovery configuration.

ExampleMetadata:

infused

Example:

# mesh: appmesh.Mesh


node1 = appmesh.VirtualNode(self, "node1",
    mesh=mesh,
    service_discovery=appmesh.ServiceDiscovery.dns("node"),
    listeners=[appmesh.VirtualNodeListener.grpc(
        port=80,
        tls=appmesh.ListenerTlsOptions(
            mode=appmesh.TlsMode.STRICT,
            certificate=appmesh.TlsCertificate.file("path/to/certChain", "path/to/privateKey"),
            # Validate a file client certificates to enable mutual TLS authentication when a client provides a certificate.
            mutual_tls_validation=appmesh.MutualTlsValidation(
                trust=appmesh.TlsValidationTrust.file("path-to-certificate")
            )
        )
    )]
)

certificate_authority_arn = "arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012"
node2 = appmesh.VirtualNode(self, "node2",
    mesh=mesh,
    service_discovery=appmesh.ServiceDiscovery.dns("node2"),
    backend_defaults=appmesh.BackendDefaults(
        tls_client_policy=appmesh.TlsClientPolicy(
            ports=[8080, 8081],
            validation=appmesh.TlsValidation(
                subject_alternative_names=appmesh.SubjectAlternativeNames.matching_exactly("mesh-endpoint.apps.local"),
                trust=appmesh.TlsValidationTrust.acm([
                    acmpca.CertificateAuthority.from_certificate_authority_arn(self, "certificate", certificate_authority_arn)
                ])
            ),
            # Provide a SDS client certificate when a server requests it and enable mutual TLS authentication.
            mutual_tls_certificate=appmesh.TlsCertificate.sds("secret_certificate")
        )
    )
)

Attributes

subject_alternative_names

Represents the subject alternative names (SANs) secured by the certificate.

SANs must be in the FQDN or URI format.

Default:

If you don’t specify SANs on the terminating mesh endpoint,

the Envoy proxy for that node doesn’t verify the SAN on a peer client certificate. If you don’t specify SANs on the originating mesh endpoint, the SAN on the certificate provided by the terminating endpoint must match the mesh endpoint service discovery configuration.

trust: Reference to where to retrieve the trust chain.