如何在AWS CDK中设置私有NLB的Enforce inbound rules on PrivateLink traffic属性？

要实现这个配置，确实CDK的高层NetworkLoadBalancer构造和SecurityGroup相关API没有直接暴露该选项，但可以通过操作底层CloudFormation资源来完成，具体有两种方式：

• 基于CDK高层NetworkLoadBalancer构造扩展配置
  如果你已经用高层构造创建了私有NLB，可以通过获取其对应的底层CfnLoadBalancer资源，添加属性覆盖来关闭该规则：

  import * as elbv2 from 'aws-cdk-lib/aws-elasticloadbalancingv2';
  import * as ec2 from 'aws-cdk-lib/aws-ec2';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  
  export class MyNlbStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
  
      const myVpc = ec2.Vpc.fromLookup(this, 'MyVpc', { vpcId: 'vpc-xxxxxx' });
  
      // 创建私有NLB
      const nlb = new elbv2.NetworkLoadBalancer(this, 'MyPrivateNLB', {
        vpc: myVpc,
        internetFacing: false,
      });
  
      // 获取底层CloudFormation资源并添加属性
      const cfnNlb = nlb.node.defaultChild as elbv2.CfnLoadBalancer;
      cfnNlb.addPropertyOverride('Attributes', [
        {
          Key: 'enforceSecurityGroupInboundRulesOnPrivateLinkTraffic',
          Value: 'false',
        },
      ]);
    }
  }
  

• 直接使用底层CfnLoadBalancer创建NLB
  如果你直接用CloudFormation原生资源定义NLB，可以在attributes数组中直接指定该配置：

  import * as elbv2 from 'aws-cdk-lib/aws-elasticloadbalancingv2';
  import * as ec2 from 'aws-cdk-lib/aws-ec2';
  import { Stack, StackProps } from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  
  export class MyNlbStack extends Stack {
    constructor(scope: Construct, id: string, props?: StackProps) {
      super(scope, id, props);
  
      const myVpc = ec2.Vpc.fromLookup(this, 'MyVpc', { vpcId: 'vpc-xxxxxx' });
  
      // 直接创建底层Cfn负载均衡器，包含目标属性
      const cfnNlb = new elbv2.CfnLoadBalancer(this, 'MyPrivateNLB', {
        scheme: 'internal',
        subnets: myVpc.privateSubnets.map(subnet => subnet.subnetId),
        attributes: [
          {
            Key: 'enforceSecurityGroupInboundRulesOnPrivateLinkTraffic',
            Value: 'false',
          },
          // 可添加其他NLB属性，如deletion_protection等
        ],
      });
    }
  }
  

这里的属性键enforceSecurityGroupInboundRulesOnPrivateLinkTraffic对应控制台中的「Enforce inbound rules on PrivateLink traffic」，设置Value: 'false'就等同于控制台选择「Off」的状态。

内容的提问来源于stack exchange，提问作者aensm