コンソールで作成した ACM 証明書を、AWS CDK で作成した ALB に適用してカスタムドメインで接続してみた

import {
  aws_ec2 as ec2,
  aws_elasticloadbalancingv2 as elbv2,
  Stack,
} from 'aws-cdk-lib';
import { Construct } from 'constructs';

export class CdkSampleStack extends Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    /**
     * Application Load Balancer の作成
     */
    const alb = new elbv2.ApplicationLoadBalancer(this, 'ALB', {
      vpc: new ec2.Vpc(this, 'VPC'),
      internetFacing: true,
    });

    /**
     * リスナーの作成
     */
    alb.addListener('Listener', {
      port: 80,
      defaultAction: elbv2.ListenerAction.fixedResponse(200, {
        contentType: 'text/plain',
        messageBody: 'Hello, CDK!',
      }),
    });
  }
}

import {
  aws_ec2 as ec2,
  aws_elasticloadbalancingv2 as elbv2,
  Stack,
} from 'aws-cdk-lib';
import { Construct } from 'constructs';

export class CdkSampleStack extends Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    /**
     * Application Load Balancer の作成
     */
    const alb = new elbv2.ApplicationLoadBalancer(this, 'ALB', {
      vpc: new ec2.Vpc(this, 'VPC'),
      internetFacing: true,
    });

    /**
     * リスナーの作成
     */
    alb.addListener('Listener', {
      port: 443,
      certificates: [
        {
          certificateArn: process.env.CERTIFICATE_ARN || '',
        },
      ],
      defaultAction: elbv2.ListenerAction.fixedResponse(200, {
        contentType: 'text/plain',
        messageBody: 'Hello, CDK!',
      }),
    });
  }
}

$ npx cdk diff
Stack CdkSampleStack
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)
Security Group Changes
┌───┬──────────────────────────────┬─────┬──────────┬─────────────────┐
│   │ Group                        │ Dir │ Protocol │ Peer            │
├───┼──────────────────────────────┼─────┼──────────┼─────────────────┤
│ - │ ${ALB/SecurityGroup.GroupId} │ In  │ TCP 80   │ Everyone (IPv4) │
├───┼──────────────────────────────┼─────┼──────────┼─────────────────┤
│ + │ ${ALB/SecurityGroup.GroupId} │ In  │ TCP 443  │ Everyone (IPv4) │
└───┴──────────────────────────────┴─────┴──────────┴─────────────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)

Resources
[~] AWS::EC2::SecurityGroup ALB/SecurityGroup ALBSecurityGroup8B8624F8
 └─ [~] SecurityGroupIngress
     └─ @@ -1,9 +1,9 @@
        [ ] [
        [ ]   {
        [ ]     "CidrIp": "0.0.0.0/0",
        [-]     "Description": "Allow from anyone on port 80",
        [-]     "FromPort": 80,
        [+]     "Description": "Allow from anyone on port 443",
        [+]     "FromPort": 443,
        [ ]     "IpProtocol": "tcp",
        [-]     "ToPort": 80
        [+]     "ToPort": 443
        [ ]   }
        [ ] ]
[~] AWS::ElasticLoadBalancingV2::Listener ALB/Listener ALBListener3B99FF85
 ├─ [+] Certificates
 │   └─ [{"CertificateArn":"arn:aws:acm:ap-northeast-1:XXXXXXXXXXXX:certificate/83b506b2-476e-4b27-978a-03ad304ff460"}]
 ├─ [~] Port
 │   ├─ [-] 80
 │   └─ [+] 443
 └─ [~] Protocol
     ├─ [-] HTTP
     └─ [+] HTTPS

✨  Number of stacks with differences: 1