aws-elasticloadbalancingv2: support tcp idle timeout for Network Load Balancer

[mazyu36]

Describe the feature

AWS Network Load Balancer now supports configurable TCP idle timeout.

Announcement: https://aws.amazon.com/about-aws/whats-new/2024/09/aws-network-load-balancer-tcp-idle-timeout/

Use Case

To set idle timeout for NLB.

Proposed Solution

It is likely that it cannot be set at present, and we need to wait for CloudFormation support.
It is necessary to set tcp.idle_timeout.seconds in the listener's Attributes.

aws elbv2 modify-listener-attributes \
          --listener-arn arn:aws:elasticloadbalancing:us-east-1:000011112222:listener/network/NLBTest/123/123 \
          --attributes \
              Key=tcp.idle_timeout.seconds,Value=600 

https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-nlb-tcp-configurable-idle-timeout/

However, there is no way to configure it using CloudFormation.
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-listener.html

I also tried adding it to the load balancer's attributes, like with ALB, but I couldn't do it.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

all

Environment details (OS name and version, etc.)

all

[khushail]

Hi @mazyu36 , thanks for requesting this.

As mentioned in the LoadBalancerAttribute and the CLI reference, the idle timeout is available for ALB only.

To set the load balancer attributes thru CLI, I tried running the command like this. Please note that this is for HTTP Application load balancer which I referenced here.(have not run using CDK , trying that for now)

aws elbv2 modify-load-balancer-attributes --load-balancer-arn arn:aws:elasticloadbalancing:us-east-1:3********6:loadbalancer/app/elastic-load-balancer-testing/c3*******f --attributes Key=idle_timeout.timeout_seconds,Value=600

and you are correct in saying Cloudformation does not support TCP Idle timeout for NLB as clearly mentioned in the above referenced doc here -

The following attributes are supported by only Application Load Balancers:

    idle_timeout.timeout_seconds - The idle timeout value, in seconds. The valid range is 1-4000 seconds. The default is 60 seconds.

For the support by cloudormation, you could create an issue with Cloudformation team by adding it on the Coverage roadmap

[khushail]

@mazyu36 I tried deploying using Escape hatches, as a workaround to set the idle timeout from 60 to 600 seconds, it succeeded with ALB. Sharing the code snippet -

    const lb = new elbv2.ApplicationLoadBalancer(this, 'LB', {
      vpc: new ec2.Vpc(this, 'VPC'),
      internetFacing: true,
      loadBalancerName:"lbname"
    });

    (lb.node.defaultChild as elbv2.CfnLoadBalancer).loadBalancerAttributes = [
      {
        key: 'idle_timeout.timeout_seconds',
        value: '600'
      }
    ];

But when i changed it to -

        key: 'tcp.idle_timeout.timeout_seconds',

it failed with this error -

3:45:32 PM | UPDATE_FAILED        | AWS::ElasticLoadBalancingV2::LoadBalancer | LB8A12904C
Resource handler returned message: "Load balancer attribute key 'tcp.idle_timeout.timeout_seconds' is not recognized (Service: ElasticLoadBalancingV2, Status Code: 400
, Request ID: 3b3415e3-d7f4-43f1-9435-886d902b8e75)" (RequestToken: 7ba202d3-5863-cc87-b64c-c754ae87b54b, HandlerErrorCode: InvalidRequest)

So this is reproducible. I highly doubt if tcp.idle_timeout.timeout_seconds is supported as its not mentioned anywhere in the available docs , its given as idle_timeout.timeout_seconds only but I will file a ticket to check with the cloudformation team and keep you posted here.

[mazyu36]

Hi, @khushail.
Thank you for your investigation.

I'm sorry for causing confusion.
To use this feature, it needs to be set to the Listener attributes, not to the Load Balancer attributes.
(Just in case, I tried to set this to the loadBalancerAttributes and documented the result in the issue.)

Therefore, I think there is no need to support tcp.idle_timeout.timeout_seconds in the loadBalancerAttributes.

Since I think there is currently no way to set the Listener attribute, I have raised an issue as follows:
aws-cloudformation/cloudformation-coverage-roadmap#2121

[khushail]

sounds good. Thanks for the clarification @mazyu36 and raising the issue with Cloudformation team. :)

[badmintoncryer]

@mazyu36 Cloudformation now supports LisntenerAttributes !

https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.CfnListener.ListenerAttributeProperty.html

[mazyu36]

@badmintoncryer
Thanks! I'm woking on it.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.