# ApplicationListener

Define an ApplicationListener.

Extends: Construct › Resource › BaseListener › ApplicationListener
Implements: IResource, IConnectable, IApplicationListener, IApplicationListenerRef, IListener, IEnvironmentAware, IListenerRef, IConstruct, IDependable

- CloudFormation: [`AWS::ElasticLoadBalancingV2::Listener`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-listener.html)
- L1 type: [`CfnListener`](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.CfnListener.html)
- Source: [`aws-elasticloadbalancingv2/lib/alb/application-listener.ts`](https://github.com/aws/aws-cdk/blob/v2.273.0/packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-listener.ts#L215)
- Type last changed: v2.247.0 · 2 Apr 2026

## Example

```ts
import { AutoScalingGroup } from 'aws-cdk-lib/aws-autoscaling';
declare const asg: AutoScalingGroup;
declare const vpc: ec2.Vpc;

// Create the load balancer in a VPC. 'internetFacing' is 'false'
// by default, which creates an internal load balancer.
const lb = new elbv2.ApplicationLoadBalancer(this, 'LB', {
  vpc,
  internetFacing: true
});

// Add a listener and open up the load balancer's security group
// to the world.
const listener = lb.addListener('Listener', {
  port: 80,

  // 'open: true' is the default, you can leave it out if you want. Set it
  // to 'false' and use `listener.connections` if you want to be selective
  // about who can access the load balancer.
  open: true,
});

// Create an AutoScaling group and add it as a load balancing
// target to the listener.
listener.addTargets('ApplicationFleet', {
  port: 8080,
  targets: [asg]
});
```

## Initializer

```ts
new ApplicationListener(scope: Construct, id: string, props: ApplicationListenerProps)
```

## Construct Props

- `certificates`: [IListenerCertificate](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.IListenerCertificate.html)[] = No certificates. — Certificate list of ACM cert ARNs.

  You must provide exactly one certificate if the listener protocol is HTTPS or TLS.

- `defaultAction`: [ListenerAction](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.ListenerAction.html) = None. — Default action to take for requests to this listener.

  This allows full control of the default action of the load balancer,
  including Action chaining, fixed responses and redirect responses.

  See the `ListenerAction` class for all options.

  Cannot be specified together with `defaultTargetGroups`.

- `defaultTargetGroups`: [IApplicationTargetGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.IApplicationTargetGroup.html)[] = None. — Default target groups to load balance to.

  All target groups will be load balanced to with equal weight and without
  stickiness. For a more complex configuration than that, use
  either `defaultAction` or `addAction()`.

  Cannot be specified together with `defaultAction`.

- `loadBalancer`: [IApplicationLoadBalancer](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.IApplicationLoadBalancer.html) (required) — The load balancer to attach this listener to.

- `mutualAuthentication`: [MutualAuthentication](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.MutualAuthentication.html) = No mutual authentication configuration — The mutual authentication configuration information.

  **Default:** No mutual authentication configuration

- `open`: boolean = true — Allow anyone to connect to the load balancer on the listener port.

  If this is specified, the load balancer will be opened up to anyone who can reach it.
  For internal load balancers this is anyone in the same VPC. For public load
  balancers, this is anyone on the internet.

  If you want to be more selective about who can access this load
  balancer, set this to `false` and use the listener's `connections`
  object to selectively grant access to the load balancer on the listener port.

- `port`: number = Determined from protocol if known. — The port on which the listener listens for requests.

  **Default:** Determined from protocol if known.

- `protocol`: [ApplicationProtocol](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.ApplicationProtocol.html) = Determined from port if known. — The protocol to use.

- `sslPolicy`: [SslPolicy](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.SslPolicy.html) = The current predefined security policy. — The security policy that defines which ciphers and protocols are supported.

  **Default:** The current predefined security policy.

## Properties

- `connections`: [Connections](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Connections.html) (required) — Manage connections to this ApplicationListener.

- `env`: [ResourceEnvironment](/cdk/api/v2/docs/aws-cdk-lib.interfaces.ResourceEnvironment.html) (required) — The environment this resource belongs to.

  For resources that are created and managed in a Stack (those created by
  creating new class instances like `new Role()`, `new Bucket()`, etc.), this
  is always the same as the environment of the stack they belong to.

  For referenced resources (those obtained from referencing methods like
  `Role.fromRoleArn()`, `Bucket.fromBucketName()`, etc.), they might be
  different than the stack they were imported into.

- `isApplicationListener`: boolean (required) — Indicates that this is an ALB listener.

  Will always return true, but is necessary to prevent accidental structural
  equality in TypeScript.

- `listenerArn`: string (required) — ARN of the listener.

- `listenerRef`: [ListenerReference](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_elasticloadbalancingv2.ListenerReference.html) (required) — A reference to this listener.

- `loadBalancer`: [IApplicationLoadBalancer](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.IApplicationLoadBalancer.html) (required) — Load balancer this listener is associated with.

- `node`: [Node](/cdk/api/v2/docs/constructs.Node.html) (required) — The tree node.

- `port`: number (required) — The port of the listener.

- `PROPERTY_INJECTION_ID`: string (required) (static) — Uniquely identifies this class.

- `protocol`: [ApplicationProtocol](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.ApplicationProtocol.html) (required) — Listener protocol for this listener.

- `stack`: [Stack](/cdk/api/v2/docs/aws-cdk-lib.Stack.html) (required) — The stack in which this resource is defined.

## Methods

- `addAction(id: string, props: AddApplicationActionProps): void` — Perform the given default action on incoming requests.

  This allows full control of the default action of the load balancer,
  including Action chaining, fixed responses and redirect responses. See
  the `ListenerAction` class for all options.

  It's possible to add routing conditions to the Action added in this way.
  At least one Action must be added without conditions (which becomes the
  default Action).

- `addCertificates(id: string, certificates: IListenerCertificate[]): void` — Add one or more certificates to this listener.

  After the first certificate, this creates ApplicationListenerCertificates
  resources since cloudformation requires the certificates array on the
  listener resource to have a length of 1.

- `addTargetGroups(id: string, props: AddApplicationTargetGroupsProps): void` — Load balance incoming requests to the given target groups.

  All target groups will be load balanced to with equal weight and without
  stickiness. For a more complex configuration than that, use `addAction()`.

  It's possible to add routing conditions to the TargetGroups added in this
  way. At least one TargetGroup must be added without conditions (which will
  become the default Action for this listener).

- `addTargets(id: string, props: AddApplicationTargetsProps): ApplicationTargetGroup` — Load balance incoming requests to the given load balancing targets.

  This method implicitly creates an ApplicationTargetGroup for the targets
  involved, and a 'forward' action to route traffic to the given TargetGroup.

  If you want more control over the precise setup, create the TargetGroup
  and use `addAction` yourself.

  It's possible to add conditions to the targets added in this way. At least
  one set of targets must be added without conditions.

  **Returns:** The newly created target group

- `applyCrossStackReferenceStrength(strength: ReferenceStrength): void` — Override the cross-stack reference strength for this resource.

  When set, any cross-stack reference to this resource will use the specified
  mechanism instead of the global default determined by the
  `@aws-cdk/core:defaultCrossStackReferences` context key. This is useful for
  selectively weakening specific references to avoid the "deadly embrace" problem
  without changing the app-wide default.

  **Parameters**

  - `strength` — - The reference strength to use for this resource.

- `applyRemovalPolicy(policy: RemovalPolicy): void` — Apply the given removal policy to this resource.

  The Removal Policy controls what happens to this resource when it stops
  being managed by CloudFormation, either because you've removed it from the
  CDK application or because you've made a change that requires the resource
  to be replaced.

  The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
  account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).

- `fromApplicationListenerAttributes(scope: Construct, id: string, attrs: ApplicationListenerAttributes): IApplicationListener` (static) — Import an existing listener.

- `fromLookup(scope: Construct, id: string, options: ApplicationListenerLookupOptions): IApplicationListener` (static) — Look up an ApplicationListener.

- `isConstruct(x: any): boolean` (static) — Checks if `x` is a construct.

  Use this method instead of `instanceof` to properly detect `Construct`
  instances, even when the construct library is symlinked.

  Explanation: in JavaScript, multiple copies of the `constructs` library on
  disk are seen as independent, completely different libraries. As a
  consequence, the class `Construct` in each copy of the `constructs` library
  is seen as a different class, and an instance of one class will not test as
  `instanceof` the other class. `npm install` will not create installations
  like this, but users may manually symlink construct libraries together or
  use a monorepo tool: in those cases, multiple copies of the `constructs`
  library can be accidentally installed, and `instanceof` will behave
  unpredictably. It is safest to avoid using `instanceof`, and using
  this type-testing method instead.

  **Parameters**

  - `x` — Any object.

  **Returns:** true if `x` is an object created from a class which extends `Construct`.

- `isOwnedResource(construct: IConstruct): boolean` (static) — Returns true if the construct was created by CDK, and false otherwise.

- `isResource(construct: IConstruct): boolean` (static) — Check whether the given construct is a Resource.

- `registerConnectable(connectable: IConnectable, portRange: Port): void` — Register that a connectable that has been added to this load balancer.

  Don't call this directly. It is called by ApplicationTargetGroup.

- `removeAttribute(key: string): void` — Remove an attribute from the listener.

- `setAttribute(key: string, value?: string): void` — Set a non-standard attribute on the listener.

- `toString(): string` — Returns a string representation of this construct.

- `with(...mixins: IMixin[]): IConstruct` — Applies one or more mixins to this construct.

  Mixins are applied in order. The list of constructs is captured at the
  start of the call, so constructs added by a mixin will not be visited.
  Use multiple `with()` calls if subsequent mixins should apply to added
  constructs.