mTLS support in API construct

[morcs]

I'd like to add the mTLS config to the Api construct. It's possible through the older ApiGatewayV1Api construct and is implemented on the underlying CDK v2 API gateway/custom domain constructs, so I think it should be relatively straightforward.

I'm happy to work on this myself and PR if it's not something that's already been ruled out?

[Samantaaparajita]

Ok

…

On Wed, 10 Jan 2024, 8:18 pm James Morcom, ***@***.***> wrote: I'd like to add the mTLS config to the Api construct. It's possible through the older ApiGatewayV1Api construct and is implemented on the underlying CDK API gateway/custom domain constructs, so I think it should be relatively straightforward. I'm happy to work on this myself and PR if it's not something that's already been ruled out? Thanks, James — Reply to this email directly, view it on GitHub <#3616>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A2ULKXCGI2RZTQCJHNAVKALYN2S5JAVCNFSM6AAAAABBU5LLKKVHI2DSMVQWIX3LMV43ASLTON2WKOZSGA3TINJTG4ZDQNA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[jayair]

Oh interesting. Can you point me to the CDK doc on the props you use to set this in ApiGatewayV1Api? I can figure out how we want to do it for the Api construct.

[morcs]

Awesome, thanks Jay!

There's an optional mtls property on aws-cdk-lib/aws_apigatewayv2/DomainName:

https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_apigatewayv2.DomainName.html

This allows us to provide an S3 bucket reference and key (plus optional S3 version) to the pem encoded public key file used to validate client certificates.

N.b. This is already available in SST, via the legacy ApiGatewayV1Api construct https://docs.sst.dev/constructs/ApiGatewayV1Api#mtls, it's just not exposed on the newer Api (HTTP API) construct, if that makes sense.

[jayair]

Ah I see. Let me check with the team.

[fwang]

I'm happy to work on this myself and PR if it's not something that's already been ruled out?

@morcs that would be great!