使用ApplicationLoadBalancedFargateService替换ALB安全组的方法

当使用ApplicationLoadBalancedFargateService创建ALB时，CDK会自动生成默认安全组并开放对应端口给所有IP。要替换为仅允许特定IP访问，有两种可行方案：

方案1：修改默认安全组规则 #

直接获取CDK自动创建的ALB安全组，移除全开放规则后添加自定义IP规则：

const service = new ApplicationLoadBalancedFargateService(this, 'Admin', {
  cluster: context.ecsCluster,
  memoryLimitMiB: webService.memoryLimitMiB,
  desiredCount: webService.desiredCount,
  cpu: webService.cpu,
  taskImageOptions: imageOptions,
  taskSubnets: vpcParams.vpcSubnets,
  protocol: elbv2.ApplicationProtocol.HTTPS,
  sslPolicy: elbv2.SslPolicy.TLS12,
  certificate
});

// 获取ALB的默认安全组
const albDefaultSg = service.loadBalancer.connections.securityGroups[0];

// 移除默认的全443端口开放规则
albDefaultSg.connections.allowFromAnyIpv4(ec2.Port.tcp(443), ec2.SecurityGroupRuleRemoval.REMOVE);

// 添加指定IP的访问规则
albDefaultSg.addIngressRule(
  ec2.Peer.ipv4('11.22.33.44/32'),
  ec2.Port.tcp(443),
  'Allow inbound traffic from Australia DC'
);

方案2：手动指定自定义安全组 #

在创建服务时直接指定自定义安全组，跳过CDK的默认安全组生成逻辑：

// 先创建自定义安全组
const customSg = new ec2.SecurityGroup(this, 'AdminVpnSecurityGroup', {
  vpc: context.vpc,
  allowAllOutbound: true
});

customSg.addIngressRule(
  ec2.Peer.ipv4('11.22.33.44/32'),
  ec2.Port.tcp(443),
  'Allow inbound traffic from Australia DC'
);

// 创建服务时指定负载均衡器的安全组
const service = new ApplicationLoadBalancedFargateService(this, 'Admin', {
  cluster: context.ecsCluster,
  memoryLimitMiB: webService.memoryLimitMiB,
  desiredCount: webService.desiredCount,
  cpu: webService.cpu,
  taskImageOptions: imageOptions,
  taskSubnets: vpcParams.vpcSubnets,
  protocol: elbv2.ApplicationProtocol.HTTPS,
  sslPolicy: elbv2.SslPolicy.TLS12,
  certificate,
  loadBalancerConfiguration: {
    securityGroups: [customSg]
  }
});

两种方案都能实现仅允许特定IP访问ALB的需求，方案2更适合需要完全控制安全组规则的场景，方案1则适合在默认基础上调整规则的场景。

内容的提问来源于stack exchange，提问作者SarangK