Skip to content

Conversation

@juliareynolds-nava
Copy link
Collaborator

🎫 Ticket

https://jira.cms.gov/browse/PLT-1312

🛠 Changes

AB2D currently uses HTTP target groups, which allows traffic to flow unencrypted from the load balancers to the groups. These groups should be recreated and configured to use HTTPS.

Furthermore, the listeners associated with the internal load balancers 'ab2d--microservices' use HTTP, which allows traffic to flow unencrypted from internal clients to the load balancers. These listeners should be recreated and configured to use HTTPS.

ℹ️ Context

To ensure that ab2d traffic is encrypted at all points.

🧪 Validation

See checks.

@juliareynolds-nava juliareynolds-nava requested a review from a team November 4, 2025 14:25
@juliareynolds-nava juliareynolds-nava marked this pull request as ready for review November 4, 2025 14:25
@juliareynolds-nava juliareynolds-nava requested a review from a team as a code owner November 4, 2025 14:25
@bennavapbc
Copy link
Collaborator

@juliareynolds-nava Semi-related to this PR, I'm working on updating the terraform to remove the properties service in the remove-properties-service branch. Feel free to update anything in your PR to support removing the properties service as it relates to your PR (I trust you more than me!).

Copy link
Member

@gsf gsf left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like a great start but my guess is that the actions checks are not adequately checking whether this new infrastructure works. I believe we'll run into issues with the app using https and requiring TLS certs. Has this configuration been tested in a lower environment?


data "aws_acm_certificate" "this" {
domain = local.parent_env == "prod" ? "api.ab2d.cms.gov" : "${local.parent_env}.ab2d.cms.gov"
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, so we're using the same certificate for the internal and external load balancers? I suppose that's fine as long as nothing is checking the validity of the certificate on the internal load balancer. I think we need to discuss further about which certificates we're using across these internal resources.

@juliareynolds-nava juliareynolds-nava marked this pull request as draft November 10, 2025 19:26
@juliareynolds-nava juliareynolds-nava marked this pull request as ready for review November 12, 2025 21:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants