SslPolicy

class aws_cdk.aws_elasticloadbalancingv2.SslPolicy(value)

Bases: Enum

Elastic Load Balancing provides the following security policies for Application Load Balancers.

We recommend the Recommended policy for general use. You can use the ForwardSecrecy policy if you require Forward Secrecy (FS).

You can use one of the TLS policies to meet compliance and security standards that require disabling certain TLS protocol versions, or to support legacy clients that require deprecated ciphers.

See:: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html
ExampleMetadata:: infused

Example:

from aws_cdk.aws_route53 import HostedZone
from aws_cdk.aws_certificatemanager import Certificate
from aws_cdk.aws_elasticloadbalancingv2 import SslPolicy

# vpc: ec2.Vpc
# cluster: ecs.Cluster


domain_zone = HostedZone.from_lookup(self, "Zone", domain_name="example.com")
certificate = Certificate.from_certificate_arn(self, "Cert", "arn:aws:acm:us-east-1:123456:certificate/abcdefg")
load_balanced_fargate_service = ecs_patterns.ApplicationLoadBalancedFargateService(self, "Service",
    vpc=vpc,
    cluster=cluster,
    certificate=certificate,
    ssl_policy=SslPolicy.RECOMMENDED,
    domain_name="api.example.com",
    domain_zone=domain_zone,
    redirect_hTTP=True,
    task_image_options=ecsPatterns.ApplicationLoadBalancedTaskImageOptions(
        image=ecs.ContainerImage.from_registry("amazon/amazon-ecs-sample")
    )
)

Attributes

FORWARD_SECRECY: Forward secrecy ciphers only.

FORWARD_SECRECY_TLS11: Forward secrecy ciphers only with TLS1.1 and higher.

FORWARD_SECRECY_TLS12: Forward secrecy ciphers and TLS1.2 only.

FORWARD_SECRECY_TLS12_RES: Strong forward secrecy ciphers and TLS1.2 only.

FORWARD_SECRECY_TLS12_RES_GCM: Strong foward secrecy ciphers and TLV1.2 only (2020 edition). Same as FORWARD_SECRECY_TLS12_RES, but only supports GCM versions of the TLS ciphers.

LEGACY

Support for DES-CBC3-SHA.

Do not use this security policy unless you must support a legacy client that requires the DES-CBC3-SHA cipher, which is a weak cipher.

RECOMMENDED: The recommended security policy.

TLS11: TLS1.1 and higher with all ciphers.

TLS12: TLS1.2 only and no SHA ciphers.

TLS12_EXT: TLS1.2 only with all ciphers.