3

I am trying to create a Cloudformation stack that can be provisioned by anybody (basically I want to share it either in the marketplace, or make it public in GitHub), which includes a set of EC2 instances behind an ALB (no autoscaling, but rather a fixed number of instances).
I want to create a single listener for the ALB listening on a non default port (let's say 9999) that uses HTTPS. In order to do this, ALB forces me to use an SSL certificate. I only care about the encryption, and not about the CA validation (because this is meant for internal traffic.) What I would like to do, is to have encryption enabled between a client and a load balancer like: https://my-loadbalancer-1234567890.us-west-2.elb.amazonaws.com:9999. This is a rest api, so I don't care about the browser pop up complaining about "Your connection is not private"

I can't rely on having a domain, since I want to share this template, I don't expect everybody to own a domain. I can think of 3 solutions, but I don't like any of these (and I don't even know if they will work):

  1. Generate a self signed cert on the userdata script. Push this cert to ACM. Then use this cert from the ALB.
    Downside: This will probably require to remove manually the cert, if the stack is destroyed, as the certificate was not created from cloudformation, but from ec2 bootstrap.

  2. Generate a self signed cert on the userdata script, but instead of pushing to ACM, install it on an ec2 alb (using something like haproxy/nginx).
    Downside: We don't get the benefits of aws alb.

  3. Have the end user to create a subdomain (myrestapi.example-domain.com) beforehand, and generate a cert with that domain from the cloudformation stack.
    Downside: requires extra step from the user, plus touching their existing infrastructure.
Simon Ernesto Cardenas Zarate
  • 251
  • 1
  • 3
  • 12
  • 1
    Please don't publicly share a template that violates best practices and encourages others to. Bypassing certificate validation is a sloppy and unacceptable practice, even on an internal API, and having control of a domain is a trivially low barrier to entry. There's also no compelling reason to use a port other than the standard port for HTTPS. – Michael - sqlbot Mar 25 '20 at 19:50

1 Answers1

1

Option 3 is the only valid one. Have the user to create a Route53 domain and ACM cert beforehand and provide the domain name and certificate ARN as parameters for the CloudFormation template.

Provide a README.md your GitHub repo with instructions on how to do that. ACM certs are free, no reason why not to use them.

Hope that helps :)

MLu
  • 24,849
  • 5
  • 59
  • 86