(aws_elasticloadbalancingv2.ApplicationListener): SslPolicy change to allow both SslPolicy Enum and Str

[jk2l]

Describe the feature

in the past few years I quite often have new security compliance guideline to require us to update the SSL policy on load balancer, however the CDK release schedule simply cannot catch up with how the security guideline release speed. (in this case, we are requested to update to use ELBSecurityPolicy-TLS13-1-2-RFC9151-FIPS-2023-07 this month, it was only released 3 weeks ago)

Currently ApplicationListener SslPolicy only accept the enum object, and I can't use latest SslPolicy without some hack around the base class property override.

Use Case

Allow us freely use any SSL policy supported by AWS instead restrict by SslPolicy enum.

Proposed Solution

Allow sslPolicy field accept string

elbv2.ApplicationListener(
        self.scope,
        "Listener",
        ssl_policy='ELBSecurityPolicy-TLS13-1-2-RFC9151-FIPS-2023-07'
 )

# instead of 
listener.node.default_child.add_property_override('SslPolicy', 'ELBSecurityPolicy-TLS13-1-2-RFC9151-FIPS-2023-07')

Other Information

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html#rfc9151-security-policies
https://aws.amazon.com/about-aws/whats-new/2026/08/aws-application-network/

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

AWS CDK Library version (aws-cdk-lib)

2.266.0

AWS CDK CLI version

2.1135.1

Environment details (OS name and version, etc.)

Linux

[pahud]

I reproduced the behavior with Python 2.255.0: passing the RFC9151 policy string is rejected because ssl_policy must be an SslPolicy. The exact v2.266.0 source and current main have the same enum-only signature.

aws-cdk/packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-listener.ts

Lines 35 to 72 in 51234fd

	*/
	export interface BaseApplicationListenerProps {
	/**
	* The protocol to use
	*
	* @default - Determined from port if known.
	*/
	readonly protocol?: ApplicationProtocol;
	/**
	* The port on which the listener listens for requests.
	*
	* @default - Determined from protocol if known.
	*/
	readonly port?: number;
	/**
	* The certificates to use on this listener
	*
	* @default - No certificates.
	* @deprecated Use the `certificates` property instead
	*/
	readonly certificateArns?: string[];
	/**
	* Certificate list of ACM cert ARNs. You must provide exactly one certificate if the listener protocol is HTTPS or TLS.
	*
	* @default - No certificates.
	*/
	readonly certificates?: IListenerCertificate[];
	/**
	* The security policy that defines which ciphers and protocols are supported.
	*
	* @default - The current predefined security policy.
	*/
	readonly sslPolicy?: SslPolicy;

As an immediate workaround, try CfnListenerPropsMixin first instead of add_property_override:

from aws_cdk.cfn_property_mixins import (
    aws_elasticloadbalancingv2 as elbv2_mixins,
)

listener.with_(elbv2_mixins.CfnListenerPropsMixin(
    elbv2_mixins.CfnListenerMixinProps(
        ssl_policy="ELBSecurityPolicy-TLS13-1-2-RFC9151-FIPS-2023-07",
    )
))

I validated this pattern by synthesis; it emits the exact requested SslPolicy string on the generated listener. Use a property-mixins package version matching aws-cdk-lib.

The underlying L1 already accepts a string, so the restriction is in the L2/jsii API. Related issues #36283 and #32307 added individual enum values, but they are not duplicates of this request because they do not prevent the same lag for the next policy release.

aws-cdk/packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/enums.ts

Lines 91 to 205 in 51234fd

	/**
	* Elastic Load Balancing provides the following security policies for Application Load Balancers
	*
	* We recommend the Recommended policy for general use. You can
	* use the ForwardSecrecy policy if you require Forward Secrecy
	* (FS).
	*
	* You can use one of the TLS policies to meet compliance and security
	* standards that require disabling certain TLS protocol versions, or to
	* support legacy clients that require deprecated ciphers.
	*
	* @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html
	*/
	export enum SslPolicy {
	/**
	* The recommended security policy for TLS listeners.
	* This is the default policy for listeners created using the AWS Management Console
	*
	* This policy includes TLS 1.3, and is backwards compatible with TLS 1.2
	*
	* When feature flag @aws-cdk/aws-elasticloadbalancingv2:usePostQuantumTlsPolicy is enabled,
	* listeners automatically use the post-quantum policy instead.
	*/
	RECOMMENDED_TLS = 'ELBSecurityPolicy-TLS13-1-2-2021-06',
	/**
	* TLS 1.3 and 1.2 with post-quantum hybrid key exchange using ML-KEM.
	*
	* This uses the non-restricted variant (without -Res-) to maintain AES-CBC cipher support
	* for TLS 1.2 clients, ensuring backward compatibility.
	*
	* @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html
	*/
	TLS13_12_PQ = 'ELBSecurityPolicy-TLS13-1-2-PQ-2025-09',
	/**
	* The recommended policy for http listeners.
	* This is the default security policy for listeners created using the AWS CLI
	*/
	RECOMMENDED = 'ELBSecurityPolicy-2016-08',
	/**
	* TLS1.2 and 1.3
	*/
	TLS13_RES = 'ELBSecurityPolicy-TLS13-1-2-Res-2021-06',
	/**
	* TLS1.2 and 1.3 and no SHA ciphers
	*/
	TLS13_EXT1 = 'ELBSecurityPolicy-TLS13-1-2-Ext1-2021-06',
	/**
	* TLS1.2 and 1.3 with all ciphers
	*/
	TLS13_EXT2 = 'ELBSecurityPolicy-TLS13-1-2-Ext2-2021-06',
	/**
	* TLS1.0 through 1.3 with all ciphers
	*/
	TLS13_10 = 'ELBSecurityPolicy-TLS13-1-0-2021-06',
	/**
	* TLS1.1 through 1.3 with all ciphers
	*/
	TLS13_11 = 'ELBSecurityPolicy-TLS13-1-1-2021-06',
	/**
	* TLS1.3 only
	*/
	TLS13_13 = 'ELBSecurityPolicy-TLS13-1-3-2021-06',
	/**
	* TLS 1.3 only with post-quantum hybrid key exchange using ML-KEM
	*
	* @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html
	*/
	TLS13_13_PQ = 'ELBSecurityPolicy-TLS13-1-3-PQ-2025-09',
	/**
	* TLS 1.2 and 1.3 with post-quantum hybrid key exchange using ML-KEM
	*
	* Restricted cipher suite for enhanced security with quantum resistance.
	* Removes AES-CBC algorithms. AWS Console default policy for post-quantum cryptography.
	*
	* @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html
	*/
	TLS13_12_RES_PQ = 'ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09',
	/**
	* TLS 1.2 and 1.3 with post-quantum hybrid key exchange using ML-KEM
	*
	* Extended cipher suite 1 with quantum resistance.
	*
	* @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html
	*/
	TLS13_12_EXT1_PQ = 'ELBSecurityPolicy-TLS13-1-2-Ext1-PQ-2025-09',
	/**
	* TLS 1.2 and 1.3 with post-quantum hybrid key exchange using ML-KEM
	*
	* Extended cipher suite 2 with quantum resistance.
	*
	* @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html
	*/
	TLS13_12_EXT2_PQ = 'ELBSecurityPolicy-TLS13-1-2-Ext2-PQ-2025-09',
	/**
	* TLS 1.0 through 1.3 with post-quantum hybrid key exchange using ML-KEM
	*
	* @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html
	*/
	TLS13_10_PQ = 'ELBSecurityPolicy-TLS13-1-0-PQ-2025-09',
	/**
	* TLS 1.3 only with AES 128 and 256 GCM SHA ciphers

Changing the existing property directly from an enum to a string may affect existing callers in jsii languages, and an enum/string union needs cross-language review. In my opinion, a safer native design would be an additional optional string property, mutually exclusive with sslPolicy, while continuing to add documented enum constants for discoverability.

Could you confirm whether the mixin workaround covers your compliance workflow? If a native L2 option is still needed, contributions are welcome; the implementation should cover both ALB and NLB listeners consistently and include cross-language API compatibility tests.

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[jk2l]

Hi, mixins work but it is simply replace from one type of property override into a different type of property override. I don't really see how is that help.