Kazuho Cryer-Shinozuka AWS CDK Top Contributor  ·  AWS Community Builder

// HTTPS listener with JWT verification → forward on success
const listener = lb.addListener('Listener', {
  protocol: elbv2.ApplicationProtocol.HTTPS,
  port: 443,
  certificates: [certificate],

  defaultAction: elbv2.ListenerAction.authenticateJwt({
    issuer: 'https://issuer.example.com',
    jwksEndpoint:
      'https://issuer.example.com/.well-known/jwks.json',

    next: elbv2.ListenerAction.forward([myTargetGroup]),
  }),
});

// Enable ABAC on the bucket
const bucket = new s3.Bucket(this, 'Bucket', {
  abacStatus: true,
  encryption: s3.BucketEncryption.KMS,
});

// Canonical ABAC deny: block access unless the caller's
// project tag matches the bucket's project tag.
bucket.addToResourcePolicy(new iam.PolicyStatement({
  effect: iam.Effect.DENY,
  principals: [new iam.AnyPrincipal()],
  actions: ['s3:ListBucket', 's3:GetObject', 's3:PutObject'],
  resources: [bucket.bucketArn, bucket.arnForObjects('*')],
  conditions: {
    StringNotEquals: {
      'aws:ResourceTag/project': '${aws:PrincipalTag/project}',
    },
  },
}));

// cdk.json — opt into the new default
{
  "context": {
    "@aws-cdk/aws-elasticloadbalancingv2:networkLoadBalancerWithSecurityGroupByDefault": true
  }
}

// Application code stays the same — SG is auto-created
const nlb = new elbv2.NetworkLoadBalancer(this, 'NLB', {
  vpc,
  // no securityGroups: a default SG is generated
});

// connections now actually adds an SG rule
// (was a silent no-op without the flag)
nlb.connections.allowFrom(other, ec2.Port.tcp(443));