如何在AWS CDK中为NLB型Global Accelerator端点开启客户端IP保留？

我有一个关联了带安全组的Network Load Balancer（NLB）的Global Accelerator。根据AWS官方文档，客户端IP地址保留功能默认关闭，但可手动开启。但我发现AWS CDK中的NetworkLoadBalancerEndpoint类仅包含NLB和权重两个属性，无法通过它开启该功能。

当前代码如下：

class GlobalAcceleratorConstruct(Construct):

    def __init__(self, scope: Construct, id_: str, nlb: NetworkLoadBalancer) -> None:
        super().__init__(scope, id_)

        accelerator = aws_globalaccelerator.Accelerator(self, f'NlbAccelerator')

        listener = aws_globalaccelerator.Listener(self, f'NlbAcceleratorListener', accelerator=accelerator,
                   port_ranges=[aws_globalaccelerator.PortRange(from_port=NLB_LISTENING_PORT)])

        endpoint = NetworkLoadBalancerEndpoint(nlb)
        self._endpoint_group = aws_globalaccelerator.EndpointGroup(self, 'NlbAcceleratorEndpointGroup', listener=listener,
                   endpoints=[endpoint])

解决方案 #

客户端IP保留功能的配置项不在NetworkLoadBalancerEndpoint中，而是在EndpointGroup的构造参数里。只需在创建EndpointGroup时添加preserve_client_ip=True即可开启该功能：

class GlobalAcceleratorConstruct(Construct):

    def __init__(self, scope: Construct, id_: str, nlb: NetworkLoadBalancer) -> None:
        super().__init__(scope, id_)

        accelerator = aws_globalaccelerator.Accelerator(self, f'NlbAccelerator')

        listener = aws_globalaccelerator.Listener(self, f'NlbAcceleratorListener', accelerator=accelerator,
                   port_ranges=[aws_globalaccelerator.PortRange(from_port=NLB_LISTENING_PORT)])

        endpoint = NetworkLoadBalancerEndpoint(nlb)
        self._endpoint_group = aws_globalaccelerator.EndpointGroup(self, 'NlbAcceleratorEndpointGroup', 
                   listener=listener,
                   endpoints=[endpoint],
                   preserve_client_ip=True)

注意事项 #

开启该功能后，Global Accelerator会将客户端原始IP传递给NLB，此时需要确保：

• NLB的安全组允许来自Global Accelerator服务CIDR范围的流量
• 若需基于客户端IP做安全组规则，需同时允许客户端IP段的流量

内容的提问来源于stack exchange，提问作者Daniel