Added BackendDefaults to Virtual Node

packages/@aws-cdk/aws-appmesh/lib/virtual-node.ts

@@ -37,6 +37,11 @@ export interface IVirtualNode extends cdk.IResource {
    * Utility method to add Node Listeners for new or existing VirtualNodes
    */
   addListeners(...listeners: VirtualNodeListener[]): void;
+
+  /**
+   * Utility method to add Default Backend Configuration for new or existing VirtualNodes
+   */
+  addBackendDefaults(backendDefaults: BackendDefaults): void;
 }
 
 /**
@@ -97,8 +102,50 @@ export interface VirtualNodeBaseProps {
    * @default - No access logging
    */
   readonly accessLog?: AccessLog;
+
+  /**
+   * Default Configuration Virtual Node uses to communicate with Vritual Service
+   *
+   * @default - No Config
+   */
+  readonly backendDefaults?: BackendDefaults;
+}
+
+/**
+ * Default Configuration for Virtual Nodes
+ */
+export interface BackendDefaults {
+  /**
+   * TLS enforced if True.
+   *
+   * @default - none
+   */
+  readonly enforce?: boolean
+
+  /**
+   * TLS enforced on these ports. If not specified it is enforced on all ports.
+   *
+   * @default - none
+   */
+  readonly ports?: number[]
+
+  /**
+   * Certificate discovery method, ACM-PCA or Local file hosting.
+   *
+   * @default - none
+   */
+  readonly certificateType: string;
+
+  /**
+   * Certificate File path or Certificate ARN.
+   *
+   * @default - none
+   */
+  readonly certificate: string[];
+
 }
 
+
 /**
  * The properties used when creating a new VirtualNode
  */
@@ -122,6 +169,7 @@ abstract class VirtualNodeBase extends cdk.Resource implements IVirtualNode {
 
   protected readonly backends = new Array<CfnVirtualNode.BackendProperty>();
   protected readonly listeners = new Array<CfnVirtualNode.ListenerProperty>();
+  protected readonly backendDefaults = new Array<CfnVirtualNode.BackendDefaultsProperty>();
 
   /**
    * Add a Virtual Services that this node is expected to send outbound traffic to
@@ -136,6 +184,37 @@ abstract class VirtualNodeBase extends cdk.Resource implements IVirtualNode {
     }
   }
 
+  /**
+   * Adds Default Backend Configuration for virtual node to communicate with Virtual Services.
+   */
+  public addBackendDefaults(backendDefaults: BackendDefaults) {
+    if (Object.keys(backendDefaults).length!==0) {
+      const enforce = backendDefaults.enforce || false;
+      const ports = backendDefaults.ports || undefined;
+      const certificateType = backendDefaults.certificateType || 'acm';
+      const certificate = backendDefaults.certificate || [];
+      this.backendDefaults.push({
+        clientPolicy: {
+          tls: {
+            enforce: enforce,
+            ports: ports,
+            validation: {
+              trust: certificateType === 'acm' ? {
+                acm: {
+                  certificateAuthorityArns: certificate,
+                },
+              } : {
+                file: {
+                  certificateChain: certificate[0],
+                },
+              },
+            },
+          },
+        },
+      });
+    }
+  }
+
   /**
    * Utility method to add an inbound listener for this virtual node
    */
@@ -259,6 +338,9 @@ export class VirtualNode extends VirtualNodeBase {
 
     this.addBackends(...props.backends || []);
     this.addListeners(...props.listener ? [props.listener] : []);
+    if (props.backendDefaults) {
+      this.addBackendDefaults(props.backendDefaults);
+    }
     const accessLogging = props.accessLog?.bind(this);
 
     const node = new CfnVirtualNode(this, 'Resource', {
@@ -267,6 +349,7 @@ export class VirtualNode extends VirtualNodeBase {
       spec: {
         backends: cdk.Lazy.anyValue({ produce: () => this.backends }, { omitEmptyArray: true }),
         listeners: cdk.Lazy.anyValue({ produce: () => this.listeners }, { omitEmptyArray: true }),
+        backendDefaults: cdk.Lazy.anyValue({ produce: () => this.backendDefaults[0] }, { omitEmptyArray: true }),
         serviceDiscovery: {
           dns: props.dnsHostName !== undefined ? { hostname: props.dnsHostName } : undefined,
           awsCloudMap: props.cloudMapService !== undefined ? {

packages/@aws-cdk/aws-appmesh/test/integ.mesh.expected.json

@@ -691,6 +691,20 @@
           ]
         },
         "Spec": {
+          "BackendDefaults": {
+            "ClientPolicy": {
+              "TLS": {
+                "Enforce": true,
+                "Validation": {
+                  "Trust": {
+                    "File": {
+                      "CertificateChain": "Path to Certificate"
+                    }
+                  }
+                }
+              }
+            }
+          },
           "Backends": [
             {
               "VirtualService": {
@@ -739,6 +753,20 @@
           ]
         },
         "Spec": {
+          "BackendDefaults": {
+            "ClientPolicy": {
+              "TLS": {
+                "Enforce": true,
+                "Validation": {
+                  "Trust": {
+                    "File": {
+                      "CertificateChain": "Path to Certificate"
+                    }
+                  }
+                }
+              }
+            }
+          },
           "Listeners": [
             {
               "HealthCheck": {

packages/@aws-cdk/aws-appmesh/test/integ.mesh.ts

@@ -74,6 +74,11 @@ const node2 = mesh.addVirtualNode('node2', {
       unhealthyThreshold: 2,
     },
   },
+  backendDefaults: {
+    enforce: true,
+    certificate: ['Path to Certificate'],
+    certificateType: 'file',
+  },
   backends: [
     new appmesh.VirtualService(stack, 'service-3', {
       virtualServiceName: 'service3.domain.local',
@@ -98,6 +103,12 @@ const node3 = mesh.addVirtualNode('node3', {
   accessLog: appmesh.AccessLog.fromFilePath('/dev/stdout'),
 });
 
+node3.addBackendDefaults({
+  enforce: true,
+  certificate: ['Path to Certificate'],
+  certificateType: 'file',
+});
+
 router.addRoute('route-2', {
   routeTargets: [
     {

packages/@aws-cdk/aws-appmesh/test/test.virtual-node.ts

@@ -97,7 +97,64 @@ export = {
             },
           }),
         );
+        test.done();
+      },
+    },
+    'when a default backend configuration is added': {
+      'should add the backend default configuration to the resource'(test: Test) {
+        // GIVEN
+        const stack = new cdk.Stack();
+
+        // WHEN
+        const mesh = new appmesh.Mesh(stack, 'mesh', {
+          meshName: 'test-mesh',
+        });
+
+        const node = mesh.addVirtualNode('test-node', {
+          dnsHostName: 'test',
+        });
+
+        node.addListeners({
+          portMapping: {
+            port: 8081,
+            protocol: appmesh.Protocol.TCP,
+          },
+        });
 
+        node.addBackendDefaults({
+          certificateType: 'file',
+          certificate: ['path to certificate'],
+        });
+
+        // THEN
+        expect(stack).to(
+          haveResourceLike('AWS::AppMesh::VirtualNode', {
+            Spec: {
+              Listeners: [
+                {
+                  PortMapping: {
+                    Port: 8081,
+                    Protocol: 'tcp',
+                  },
+                },
+              ],
+              BackendDefaults: {
+                ClientPolicy: {
+                  TLS: {
+                    Enforce: false,
+                    Validation: {
+                      Trust: {
+                        File: {
+                          CertificateChain: 'path to certificate',
+                        },
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          }),
+        );
         test.done();
       },
     },