# ServiceConnectTlsConfiguration

TLS configuration for Service Connect service.

- Source: [`aws-ecs/lib/base/base-service.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-ecs/lib/base/base-service.ts#L400)
- Type last changed: v2.224.0 · 13 Nov 2025

## Example

```ts
declare const cluster: ecs.Cluster;
declare const taskDefinition: ecs.TaskDefinition;
declare const kmsKey: kms.IKey;
declare const role: iam.IRole;

const service = new ecs.FargateService(this, 'FargateService', {
  cluster,
  taskDefinition,
  serviceConnectConfiguration: {
    services: [
      {
        tls: {
          role,
          kmsKey,
          awsPcaAuthorityArn: 'arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/123456789012',
        },
        portMappingName: 'api',
      },
    ],
    namespace: 'sample namespace',
  },
});
```

## Properties

- `awsPcaAuthorityArn`: string = none — The ARN of the certificate root authority that secures your service.

- `kmsKey`: [IKeyRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_kms.IKeyRef.html) = none — The KMS key used for encryption and decryption.

- `role`: [IRole](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.IRole.html) = none — The IAM role that's associated with the Service Connect TLS.