Added BackendDefaults to Virtual Node

packages/@aws-cdk/aws-appmesh/lib/virtual-node.ts

@@ -113,39 +113,135 @@ export interface VirtualNodeBaseProps {
 }
 
 /**
- * Default Configuration for Virtual Nodes
+ * Default configuration that is applied to all backends for the virtual node.
+ * Any configuration defined will be overwritten by configurations specified for a particular backend.
  */
 export interface BackendDefaults {
+  /**
+   * Client policy for TLS
+   */
+  readonly tlsClientPolicy: TLSClientPolicyProps;
+}
+
+/**
+ * Properties with respect to TLS backend default.
+ */
+export interface TLSClientPolicyProps {
   /**
    * TLS enforced if True.
    *
-   * @default - none
+   * @default - True
    */
-  readonly enforce?: boolean
+  readonly enforce?: boolean;
 
   /**
    * TLS enforced on these ports. If not specified it is enforced on all ports.
    *
    * @default - none
    */
-  readonly ports?: number[]
+  readonly ports?: number[];
 
   /**
-   * Certificate discovery method, ACM-PCA or Local file hosting.
+   * To enforce the trust is one of file, acmpca, or sds.
    *
    * @default - none
    */
-  readonly certificateType: string;
+  readonly validation: TLSClientValidation;
+}
 
+/**
+ * Defines the TLS validation context trust.
+ */
+export abstract class TLSClientValidation {
   /**
-   * Certificate File path or Certificate ARN.
-   *
-   * @default - none
+   * TLS validation context trust for a local file
+   */
+  public static fileTrustValidation(props: FileTrustProps): TLSClientValidation {
+    return new FileTrust(props);
+  }
+
+  /**
+   * TLS validation context trust for AWS Certicate Manager (ACM) certificate.
+   */
+  public static acmTrustValidation(props: ACMTrustProps): TLSClientValidation {
+    return new ACMTrust(props);
+  }
+
+  /**
+   * Returns Trust context based on trust type.
+   */
+  public abstract bind(scope: cdk.Construct): CfnVirtualNode.TlsValidationContextProperty;
+}
+
+/**
+ * ACM Trust Properties
+ */
+export interface ACMTrustProps {
+  /**
+   * Amazon Resource Name of the Certificates
+   */
+  readonly certificateAuthorityArns: string[];
+}
+
+/**
+ * File Trust Properties
+ */
+export interface FileTrustProps {
+  /**
+   * Path to the Certificate Chain file on the file system where the Envoy is deployed.
    */
-  readonly certificate: string[];
+  readonly certificateChain: string;
+}
 
+/**
+ * Represents a Transport Layer Security (TLS) validation context trust for a local file
+ */
+export class FileTrust extends TLSClientValidation {
+  /**
+   * Path to the Certificate Chain file on the file system where the Envoy is deployed.
+   */
+  readonly certificateChain: string;
+
+  constructor(props: FileTrustProps) {
+    super();
+    this.certificateChain = props.certificateChain;
+  }
+
+  public bind(_scope: cdk.Construct): CfnVirtualNode.TlsValidationContextProperty {
+    return {
+      trust: {
+        file: {
+          certificateChain: this.certificateChain,
+        },
+      },
+    };
+  }
 }
 
+/**
+ * Represents a TLS validation context trust for an AWS Certicate Manager (ACM) certificate.
+ */
+export class ACMTrust extends TLSClientValidation {
+  /**
+   * Amazon Resource Name of the Certificates
+   */
+  readonly certificateAuthorityArns: string[];
+
+  constructor(props: ACMTrustProps) {
+    super();
+    this.certificateAuthorityArns = props.certificateAuthorityArns;
+  }
+
+  public bind(_scope: cdk.Construct): CfnVirtualNode.TlsValidationContextProperty {
+    return {
+      trust: {
+        acm: {
+          certificateAuthorityArns: this.certificateAuthorityArns,
+        },
+      },
+    };
+  }
+}
 
 /**
  * The properties used when creating a new VirtualNode
@@ -189,31 +285,17 @@ abstract class VirtualNodeBase extends cdk.Resource implements IVirtualNode {
    * Adds Default Backend Configuration for virtual node to communicate with Virtual Services.
    */
   public addBackendDefaults(backendDefaults: BackendDefaults) {
-    if (Object.keys(backendDefaults).length!==0) {
-      const enforce = backendDefaults.enforce || false;
-      const ports = backendDefaults.ports || undefined;
-      const certificateType = backendDefaults.certificateType || 'acm';
-      const certificate = backendDefaults.certificate || [];
-      this.backendDefaults.push({
-        clientPolicy: {
-          tls: {
-            enforce: enforce,
-            ports: ports,
-            validation: {
-              trust: certificateType === 'acm' ? {
-                acm: {
-                  certificateAuthorityArns: certificate,
-                },
-              } : {
-                file: {
-                  certificateChain: certificate[0],
-                },
-              },
-            },
-          },
+    // eslint-disable-next-line no-console
+    console.log(backendDefaults.tlsClientPolicy.enforce);
+    this.backendDefaults.push({
+      clientPolicy: {
+        tls: {
+          enforce: backendDefaults.tlsClientPolicy.enforce === undefined ? true : backendDefaults.tlsClientPolicy.enforce,
+          validation: backendDefaults.tlsClientPolicy.validation.bind(this),
+          ports: backendDefaults.tlsClientPolicy.ports ? backendDefaults.tlsClientPolicy.ports : undefined,
         },
-      });
-    }
+      },
+    });
   }
 
   /**

packages/@aws-cdk/aws-appmesh/test/integ.mesh.expected.json

@@ -698,7 +698,7 @@
                 "Validation": {
                   "Trust": {
                     "File": {
-                      "CertificateChain": "Path to Certificate"
+                      "CertificateChain": "path-to-file"
                     }
                   }
                 }
@@ -760,7 +760,7 @@
                 "Validation": {
                   "Trust": {
                     "File": {
-                      "CertificateChain": "Path to Certificate"
+                      "CertificateChain": "path-to-file"
                     }
                   }
                 }

packages/@aws-cdk/aws-appmesh/test/integ.mesh.ts

@@ -75,9 +75,11 @@ const node2 = mesh.addVirtualNode('node2', {
     },
   },
   backendDefaults: {
-    enforce: true,
-    certificate: ['Path to Certificate'],
-    certificateType: 'file',
+    tlsClientPolicy: {
+      validation: appmesh.TLSClientValidation.fileTrustValidation({
+        certificateChain: 'path-to-file',
+      }),
+    },
   },
   backends: [
     new appmesh.VirtualService(stack, 'service-3', {
@@ -104,9 +106,11 @@ const node3 = mesh.addVirtualNode('node3', {
 });
 
 node3.addBackendDefaults({
-  enforce: true,
-  certificate: ['Path to Certificate'],
-  certificateType: 'file',
+  tlsClientPolicy: {
+    validation: appmesh.TLSClientValidation.fileTrustValidation({
+      certificateChain: 'path-to-file',
+    }),
+  },
 });
 
 router.addRoute('route-2', {

packages/@aws-cdk/aws-appmesh/test/test.virtual-node.ts

@@ -122,8 +122,12 @@ export = {
         });
 
         node.addBackendDefaults({
-          certificateType: 'file',
-          certificate: ['path to certificate'],
+          tlsClientPolicy: {
+            validation: appmesh.TLSClientValidation.fileTrustValidation({
+              certificateChain: 'path-to-certificate',
+            }),
+            ports: [8080, 8081],
+          },
         });
 
         // THEN
@@ -141,11 +145,12 @@ export = {
               BackendDefaults: {
                 ClientPolicy: {
                   TLS: {
-                    Enforce: false,
+                    Enforce: true,
+                    Ports: [8080, 8081],
                     Validation: {
                       Trust: {
                         File: {
-                          CertificateChain: 'path to certificate',
+                          CertificateChain: 'path-to-certificate',
                         },
                       },
                     },