TLS support for the ALB listener

[aweeraman]

I'm looking to configure TLS on the ALB listener, and looking at the manifest docs, there doesn't seem to be a way right now. Appreciate any pointers on whether this could be configured somehow. I could configure it manually or via the CLI, but would like to automate that configuration via CloudFormation as part of the copilot workflow to minimize manual changes.

Also, on a related note, is there a way to have an environment specific CloudFormation scripts, similar to the addons, but at an environment level?

[toricls]

Hi @aweeraman 👋

For TLS, I think this issue comment and the rest of conversations would help you. (TL;DR; You can use your Route 53 registered domain name for TLS on ALB, with the --domain option in copilot app init command.)

For environment level addons, Copilot does not support it today, but @efekarakus and I just talked about it yesterday! Let us know your use case, it must be very helpful to make things forward 🤗‬

[aweeraman]

Thanks @toricls, this is useful.

On the infra level addons, I have multiple services that depend on a database, and would like to create that independently instead of along with one of the services. Being able to provision that at the infra level would be better in my opinion. This database would depend on some values exported by the environment (VPC, subnets), so right now I would have to run env init, execute the cloudformation manually, and then deploy the services. Is there a better way to do it, so that I can avoid the manual intermediate step? Would like to avoid writing a wrapper shell script if copilot could help do that somehow.

[toricls]

Thanks for the detail! Unfortunately, I think the way you described would be the go-to solution today, like:

1. env init
2. Use CFN "exported" values for the environment to create database instance with a preferred tooling such as CloudFormation/CDK, Terraform, ... (I believe you may want to chose an IaC-ish tooling here)
3. Store the database connection string and others in AWS Systems Manager Parameter Store and reference it from service manifest as described in the Copilot docs here. Note that there is different service AWS Secrets Manager to store such secrets but Copilot does not support it today.

Or, if the requirements allow, maybe you can create your database as a service addon, then share the connection parameters with other services.

[aweeraman]

Ok. got it.

Do you have any plans of supporting the API gateway to expose services instead of via the ALB?

[toricls]

We don't have clear timeline yet, but in the meantime there already are feature requests as GitHub issues below, so I'd recommend you to subscribe them to be notified once it's ready :)

• Support for backend services fronted by Swagger/Open API driven API Gateway #784
• Support APIGW as ingress for Backend Services #2050

[toricls]

@aweeraman I'm going to mark this as answered regarding TLS + ALB. Feel free to open another discussion or GitHub issue if you need!