agent-claw: automated task changes

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/.jsiirc.json

@@ -0,0 +1,13 @@
+{
+  "targets": {
+    "java": {
+      "package": "software.amazon.awscdk.services.elasticloadbalancingv2"
+    },
+    "dotnet": {
+      "namespace": "Amazon.CDK.AWS.ElasticLoadBalancingV2"
+    },
+    "python": {
+      "module": "aws_cdk.aws_elasticloadbalancingv2"
+    }
+  }
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/index.d.ts

@@ -0,0 +1 @@
+export * from './lib';

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-listener-action.d.ts

@@ -0,0 +1,377 @@
+import type { Construct, IConstruct } from 'constructs';
+import { type IApplicationListener } from './application-listener';
+import type { IApplicationTargetGroup } from './application-target-group';
+import type { Duration, SecretValue } from '../../../core';
+import type { CfnListener, CfnListenerRule } from '../elasticloadbalancingv2.generated';
+import type { IListenerAction } from '../shared/listener-action';
+/**
+ * What to do when a client makes a request to a listener
+ *
+ * Some actions can be combined with other ones (specifically,
+ * you can perform authentication before serving the request).
+ *
+ * Multiple actions form a linked chain; the chain must always terminate in a
+ * *(weighted)forward*, *fixedResponse* or *redirect* action.
+ *
+ * If an action supports chaining, the next action can be indicated
+ * by passing it in the `next` property.
+ *
+ * (Called `ListenerAction` instead of the more strictly correct
+ * `ListenerAction` because this is the class most users interact
+ * with, and we want to make it not too visually overwhelming).
+ */
+export declare class ListenerAction implements IListenerAction {
+    private readonly defaultActionJson;
+    protected readonly next?: ListenerAction | undefined;
+    /**
+     * Authenticate using an identity provider (IdP) that is compliant with OpenID Connect (OIDC)
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html#oidc-requirements
+     */
+    static authenticateOidc(options: AuthenticateOidcOptions): ListenerAction;
+    /**
+     * Authenticate using JWT validation
+     *
+     * You can configure ALB to verify JSON Web Tokens (JWT) provided by clients
+     * for secure service-to-service (S2S) or machine-to-machine (M2M) communications.
+     *
+     * ALB validates the token signature and requires mandatory claims: 'iss' (issuer)
+     * and 'exp' (expiration). Additionally, if present, ALB validates 'nbf' (not before)
+     * and 'iat' (issued at time) claims.
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-verify-jwt.html
+     */
+    static authenticateJwt(options: AuthenticateJwtOptions): ListenerAction;
+    /**
+     * Forward to one or more Target Groups
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html#forward-actions
+     */
+    static forward(targetGroups: IApplicationTargetGroup[], options?: ForwardOptions): ListenerAction;
+    /**
+     * Forward to one or more Target Groups which are weighted differently
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html#forward-actions
+     */
+    static weightedForward(targetGroups: WeightedTargetGroup[], options?: ForwardOptions): ListenerAction;
+    /**
+     * Return a fixed response
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html#fixed-response-actions
+     */
+    static fixedResponse(statusCode: number, options?: FixedResponseOptions): ListenerAction;
+    /**
+     * Redirect to a different URI
+     *
+     * A URI consists of the following components:
+     * protocol://hostname:port/path?query. You must modify at least one of the
+     * following components to avoid a redirect loop: protocol, hostname, port, or
+     * path. Any components that you do not modify retain their original values.
+     *
+     * You can reuse URI components using the following reserved keywords:
+     *
+     * - `#{protocol}`
+     * - `#{host}`
+     * - `#{port}`
+     * - `#{path}` (the leading "/" is removed)
+     * - `#{query}`
+     *
+     * For example, you can change the path to "/new/#{path}", the hostname to
+     * "example.#{host}", or the query to "#{query}&value=xyz".
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html#redirect-actions
+     */
+    static redirect(options: RedirectOptions): ListenerAction;
+    /**
+     * If set, it is preferred as Action for the `ListenerRule`.
+     * This is necessary if `CfnListener.ActionProperty` and `CfnListenerRule.ActionProperty`
+     * have different structures.
+     */
+    private _actionJson?;
+    /**
+     * Create an instance of ListenerAction
+     *
+     * The default class should be good enough for most cases and
+     * should be created by using one of the static factory functions,
+     * but allow overriding to make sure we allow flexibility for the future.
+     */
+    protected constructor(defaultActionJson: CfnListener.ActionProperty, next?: ListenerAction | undefined);
+    /**
+     * Render the listener rule actions in this chain
+     */
+    renderRuleActions(): CfnListenerRule.ActionProperty[];
+    /**
+     * Render the listener default actions in this chain
+     */
+    renderActions(): CfnListener.ActionProperty[];
+    /**
+     * Called when the action is being used in a listener
+     */
+    bind(scope: Construct, listener: IApplicationListener, associatingConstruct?: IConstruct): void;
+    private _renumber;
+    /**
+     * Renumber the "order" fields in the actions array.
+     *
+     * We don't number for 0 or 1 elements, but otherwise number them 1...#actions
+     * so ELB knows about the right order.
+     *
+     * Do this in `ListenerAction` instead of in `Listener` so that we give
+     * users the opportunity to override by subclassing and overriding `renderActions`.
+     */
+    protected renumber(actions: CfnListener.ActionProperty[]): CfnListener.ActionProperty[];
+    /**
+     * Sets the Action for the `ListenerRule`.
+     * This method is required to set a dedicated Action to a `ListenerRule`
+     * when the Action for the `CfnListener` and the Action for the `CfnListenerRule`
+     * have different structures. (e.g. `AuthenticateOidcConfig`)
+     * @param actionJson Action for `ListenerRule`
+     */
+    protected addRuleAction(actionJson: CfnListenerRule.ActionProperty): void;
+}
+/**
+ * Options for `ListenerAction.forward()`
+ */
+export interface ForwardOptions {
+    /**
+     * For how long clients should be directed to the same target group
+     *
+     * Range between 1 second and 7 days.
+     *
+     * @default - No stickiness
+     */
+    readonly stickinessDuration?: Duration;
+}
+/**
+ * A Target Group and weight combination
+ */
+export interface WeightedTargetGroup {
+    /**
+     * The target group
+     */
+    readonly targetGroup: IApplicationTargetGroup;
+    /**
+     * The target group's weight
+     *
+     * Range is [0..1000).
+     *
+     * @default 1
+     */
+    readonly weight?: number;
+}
+/**
+ * Options for `ListenerAction.fixedResponse()`
+ */
+export interface FixedResponseOptions {
+    /**
+     * Content Type of the response
+     *
+     * Valid Values: text/plain | text/css | text/html | application/javascript | application/json
+     *
+     * @default - Automatically determined
+     */
+    readonly contentType?: string;
+    /**
+     * The response body
+     *
+     * @default - No body
+     */
+    readonly messageBody?: string;
+}
+/**
+ * Options for `ListenerAction.redirect()`
+ *
+ * A URI consists of the following components:
+ * protocol://hostname:port/path?query. You must modify at least one of the
+ * following components to avoid a redirect loop: protocol, hostname, port, or
+ * path. Any components that you do not modify retain their original values.
+ *
+ * You can reuse URI components using the following reserved keywords:
+ *
+ * - `#{protocol}`
+ * - `#{host}`
+ * - `#{port}`
+ * - `#{path}` (the leading "/" is removed)
+ * - `#{query}`
+ *
+ * For example, you can change the path to "/new/#{path}", the hostname to
+ * "example.#{host}", or the query to "#{query}&value=xyz".
+ */
+export interface RedirectOptions {
+    /**
+     * The hostname.
+     *
+     * This component is not percent-encoded. The hostname can contain #{host}.
+     *
+     * @default - No change
+     */
+    readonly host?: string;
+    /**
+     * The absolute path, starting with the leading "/".
+     *
+     * This component is not percent-encoded. The path can contain #{host}, #{path}, and #{port}.
+     *
+     * @default - No change
+     */
+    readonly path?: string;
+    /**
+     * The port.
+     *
+     * You can specify a value from 1 to 65535 or #{port}.
+     *
+     * @default - No change
+     */
+    readonly port?: string;
+    /**
+     * The protocol.
+     *
+     * You can specify HTTP, HTTPS, or #{protocol}. You can redirect HTTP to HTTP, HTTP to HTTPS, and HTTPS to HTTPS. You cannot redirect HTTPS to HTTP.
+     *
+     * @default - No change
+     */
+    readonly protocol?: string;
+    /**
+     * The query parameters, URL-encoded when necessary, but not percent-encoded.
+     *
+     * Do not include the leading "?", as it is automatically added. You can specify any of the reserved keywords.
+     *
+     * @default - No change
+     */
+    readonly query?: string;
+    /**
+     * The HTTP redirect code.
+     *
+     * The redirect is either permanent (HTTP 301) or temporary (HTTP 302).
+     *
+     * @default false
+     */
+    readonly permanent?: boolean;
+}
+/**
+ * Options for `ListenerAction.authenciateOidc()`
+ */
+export interface AuthenticateOidcOptions {
+    /**
+     * What action to execute next
+     */
+    readonly next: ListenerAction;
+    /**
+     * The query parameters (up to 10) to include in the redirect request to the authorization endpoint.
+     *
+     * @default - No extra parameters
+     */
+    readonly authenticationRequestExtraParams?: Record<string, string>;
+    /**
+     * The authorization endpoint of the IdP.
+     *
+     * This must be a full URL, including the HTTPS protocol, the domain, and the path.
+     */
+    readonly authorizationEndpoint: string;
+    /**
+     * The OAuth 2.0 client identifier.
+     */
+    readonly clientId: string;
+    /**
+     * The OAuth 2.0 client secret.
+     */
+    readonly clientSecret: SecretValue;
+    /**
+     * The OIDC issuer identifier of the IdP.
+     *
+     * This must be a full URL, including the HTTPS protocol, the domain, and the path.
+     */
+    readonly issuer: string;
+    /**
+     * The behavior if the user is not authenticated.
+     *
+     * @default UnauthenticatedAction.AUTHENTICATE
+     */
+    readonly onUnauthenticatedRequest?: UnauthenticatedAction;
+    /**
+     * The set of user claims to be requested from the IdP.
+     *
+     * To verify which scope values your IdP supports and how to separate multiple values, see the documentation for your IdP.
+     *
+     * @default "openid"
+     */
+    readonly scope?: string;
+    /**
+     * The name of the cookie used to maintain session information.
+     *
+     * @default "AWSELBAuthSessionCookie"
+     */
+    readonly sessionCookieName?: string;
+    /**
+     * The maximum duration of the authentication session.
+     *
+     * @default Duration.days(7)
+     */
+    readonly sessionTimeout?: Duration;
+    /**
+     * The token endpoint of the IdP.
+     *
+     * This must be a full URL, including the HTTPS protocol, the domain, and the path.
+     */
+    readonly tokenEndpoint: string;
+    /**
+     * The user info endpoint of the IdP.
+     *
+     * This must be a full URL, including the HTTPS protocol, the domain, and the path.
+     */
+    readonly userInfoEndpoint: string;
+    /**
+     * Allow HTTPS outbound traffic to communicate with the IdP.
+     *
+     * Set this property to false if the IP address used for the IdP endpoint is identifiable
+     * and you want to control outbound traffic.
+     * Then allow HTTPS outbound traffic to the IdP's IP address using the listener's `connections` property.
+     *
+     * @default true
+     * @see https://repost.aws/knowledge-center/elb-configure-authentication-alb
+     */
+    readonly allowHttpsOutbound?: boolean;
+}
+/**
+ * Options for `ListenerAction.authenticateJwt()`
+ */
+export interface AuthenticateJwtOptions {
+    /**
+     * What action to execute next
+     *
+     * Multiple actions form a linked chain; the chain must always terminate in a
+     * (weighted)forward, fixedResponse or redirect action.
+     */
+    readonly next: ListenerAction;
+    /**
+     * The issuer of the JWT token
+     *
+     * This must be a full URL, including the HTTPS protocol, the domain, and the path.
+     *
+     * @example 'https://issuer.example.com'
+     */
+    readonly issuer: string;
+    /**
+     * The JWKS (JSON Web Key Set) endpoint URL
+     *
+     * The endpoint must be publicly accessible and return the public keys used to verify JWT signatures.
+     *
+     * @example 'https://issuer.example.com/jwks'
+     */
+    readonly jwksEndpoint: string;
+}
+/**
+ * What to do with unauthenticated requests
+ */
+export declare enum UnauthenticatedAction {
+    /**
+     * Return an HTTP 401 Unauthorized error.
+     */
+    DENY = "deny",
+    /**
+     * Allow the request to be forwarded to the target.
+     */
+    ALLOW = "allow",
+    /**
+     * Redirect the request to the IdP authorization endpoint.
+     */
+    AUTHENTICATE = "authenticate"
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-listener-certificate.d.ts

@@ -0,0 +1,26 @@
+import { Construct } from 'constructs';
+import type { aws_elasticloadbalancingv2 as elbv2 } from '../../../interfaces';
+import type { IListenerCertificate } from '../shared/listener-certificate';
+/**
+ * Properties for adding a set of certificates to a listener
+ */
+export interface ApplicationListenerCertificateProps {
+    /**
+     * The listener to attach the rule to
+     */
+    readonly listener: elbv2.IListenerRef;
+    /**
+     * Certificates to attach
+     *
+     * Duplicates are not allowed.
+     *
+     * @default - One of 'certificates' and 'certificateArns' is required.
+     */
+    readonly certificates?: IListenerCertificate[];
+}
+/**
+ * Add certificates to a listener
+ */
+export declare class ApplicationListenerCertificate extends Construct {
+    constructor(scope: Construct, id: string, props: ApplicationListenerCertificateProps);
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-listener-certificate.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.ApplicationListenerCertificate=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var constructs_1=()=>{var tmp=require("constructs");return constructs_1=()=>tmp,tmp},errors_1=()=>{var tmp=require("../../../core/lib/errors");return errors_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp},elasticloadbalancingv2_generated_1=()=>{var tmp=require("../elasticloadbalancingv2.generated");return elasticloadbalancingv2_generated_1=()=>tmp,tmp};class ApplicationListenerCertificate extends constructs_1().Construct{static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_elasticloadbalancingv2.ApplicationListenerCertificate",version:"2.252.0"};constructor(scope,id,props){super(scope,id);try{jsiiDeprecationWarnings().aws_cdk_lib_aws_elasticloadbalancingv2_ApplicationListenerCertificateProps(props)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,ApplicationListenerCertificate),error}if(!props.certificateArns&&!props.certificates)throw new(errors_1()).ValidationError((0,literal_string_1().lit)`IsRequiredLeastCertificatearnsCertificates`,"At least one of 'certificateArns' or 'certificates' is required",this);const certificates=[...(props.certificates||[]).map(c=>({certificateArn:c.certificateArn})),...(props.certificateArns||[]).map(certificateArn=>({certificateArn}))];new(elasticloadbalancingv2_generated_1()).CfnListenerCertificate(this,"Resource",{listenerArn:props.listener.listenerRef.listenerArn,certificates})}}exports.ApplicationListenerCertificate=ApplicationListenerCertificate;

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-listener-rule.d.ts

@@ -0,0 +1,83 @@
+import { Construct } from 'constructs';
+import type { IApplicationListener } from './application-listener';
+import { ListenerAction } from './application-listener-action';
+import type { IApplicationTargetGroup } from './application-target-group';
+import type { ListenerCondition } from './conditions';
+/**
+ * Basic properties for defining a rule on a listener
+ */
+export interface BaseApplicationListenerRuleProps {
+    /**
+     * Priority of the rule
+     *
+     * The rule with the lowest priority will be used for every request.
+     *
+     * Priorities must be unique.
+     */
+    readonly priority: number;
+    /**
+     * Target groups to forward requests to.
+     *
+     * Only one of `action`, `fixedResponse`, `redirectResponse` or `targetGroups` can be specified.
+     *
+     * Implies a `forward` action.
+     *
+     * @default - No target groups.
+     */
+    readonly targetGroups?: IApplicationTargetGroup[];
+    /**
+     * Action to perform when requests are received
+     *
+     * Only one of `action`, `fixedResponse`, `redirectResponse` or `targetGroups` can be specified.
+     *
+     * @default - No action
+     */
+    readonly action?: ListenerAction;
+    /**
+     * Rule applies if matches the conditions.
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html
+     *
+     * @default - No conditions.
+     */
+    readonly conditions?: ListenerCondition[];
+}
+/**
+ * Properties for defining a listener rule
+ */
+export interface ApplicationListenerRuleProps extends BaseApplicationListenerRuleProps {
+    /**
+     * The listener to attach the rule to
+     */
+    readonly listener: IApplicationListener;
+}
+/**
+ * Define a new listener rule
+ */
+export declare class ApplicationListenerRule extends Construct {
+    /**
+     * The ARN of this rule
+     */
+    readonly listenerRuleArn: string;
+    private readonly conditions;
+    private readonly legacyConditions;
+    private readonly listener;
+    private action?;
+    constructor(scope: Construct, id: string, props: ApplicationListenerRuleProps);
+    /**
+     * Add a non-standard condition to this rule
+     */
+    addCondition(condition: ListenerCondition): void;
+    /**
+     * Configure the action to perform for this rule
+     */
+    configureAction(action: ListenerAction): void;
+    /**
+     * Validate the rule
+     */
+    private validateListenerRule;
+    /**
+     * Render the conditions for this rule
+     */
+    private renderConditions;
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-listener.d.ts

@@ -0,0 +1,505 @@
+import type { Construct } from 'constructs';
+import { ListenerAction } from './application-listener-action';
+import './application-listener-rule';
+import type { IApplicationLoadBalancer } from './application-load-balancer';
+import type { IApplicationLoadBalancerTarget, IApplicationTargetGroup } from './application-target-group';
+import { ApplicationTargetGroup } from './application-target-group';
+import type { ListenerCondition } from './conditions';
+import * as ec2 from '../../../aws-ec2';
+import type { Duration } from '../../../core';
+import type { aws_elasticloadbalancingv2 } from '../../../interfaces';
+import type { BaseListenerLookupOptions, IListener } from '../shared/base-listener';
+import { BaseListener } from '../shared/base-listener';
+import type { HealthCheck } from '../shared/base-target-group';
+import type { ApplicationProtocolVersion, TargetGroupLoadBalancingAlgorithmType } from '../shared/enums';
+import { ApplicationProtocol, SslPolicy } from '../shared/enums';
+import type { IListenerCertificate } from '../shared/listener-certificate';
+/**
+ * Basic properties for an ApplicationListener
+ */
+export interface BaseApplicationListenerProps {
+    /**
+     * The protocol to use
+     *
+     * @default - Determined from port if known.
+     */
+    readonly protocol?: ApplicationProtocol;
+    /**
+     * The port on which the listener listens for requests.
+     *
+     * @default - Determined from protocol if known.
+     */
+    readonly port?: number;
+    /**
+     * Certificate list of ACM cert ARNs. You must provide exactly one certificate if the listener protocol is HTTPS or TLS.
+     *
+     * @default - No certificates.
+     */
+    readonly certificates?: IListenerCertificate[];
+    /**
+     * The security policy that defines which ciphers and protocols are supported.
+     *
+     * @default - The current predefined security policy.
+     */
+    readonly sslPolicy?: SslPolicy;
+    /**
+     * Default target groups to load balance to
+     *
+     * All target groups will be load balanced to with equal weight and without
+     * stickiness. For a more complex configuration than that, use
+     * either `defaultAction` or `addAction()`.
+     *
+     * Cannot be specified together with `defaultAction`.
+     *
+     * @default - None.
+     */
+    readonly defaultTargetGroups?: IApplicationTargetGroup[];
+    /**
+     * Default action to take for requests to this listener
+     *
+     * This allows full control of the default action of the load balancer,
+     * including Action chaining, fixed responses and redirect responses.
+     *
+     * See the `ListenerAction` class for all options.
+     *
+     * Cannot be specified together with `defaultTargetGroups`.
+     *
+     * @default - None.
+     */
+    readonly defaultAction?: ListenerAction;
+    /**
+     * Allow anyone to connect to the load balancer on the listener port
+     *
+     * If this is specified, the load balancer will be opened up to anyone who can reach it.
+     * For internal load balancers this is anyone in the same VPC. For public load
+     * balancers, this is anyone on the internet.
+     *
+     * If you want to be more selective about who can access this load
+     * balancer, set this to `false` and use the listener's `connections`
+     * object to selectively grant access to the load balancer on the listener port.
+     *
+     * @default true
+     */
+    readonly open?: boolean;
+    /**
+     * The mutual authentication configuration information
+     *
+     * @default - No mutual authentication configuration
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/mutual-authentication.html
+     */
+    readonly mutualAuthentication?: MutualAuthentication;
+}
+/**
+ * The mutual authentication configuration information
+ *
+ */
+export interface MutualAuthentication {
+    /**
+     * The client certificate handling method
+     *
+     * @default MutualAuthenticationMode.OFF
+     */
+    readonly mutualAuthenticationMode?: MutualAuthenticationMode;
+    /**
+     * The trust store
+     *
+     * Cannot be used with MutualAuthenticationMode.OFF or MutualAuthenticationMode.PASS_THROUGH
+     *
+     * @default - no trust store
+     */
+    readonly trustStore?: aws_elasticloadbalancingv2.ITrustStoreRef;
+    /**
+     * Indicates whether expired client certificates are ignored
+     *
+     * Cannot be used with MutualAuthenticationMode.OFF or MutualAuthenticationMode.PASS_THROUGH
+     *
+     * @default false
+     */
+    readonly ignoreClientCertificateExpiry?: boolean;
+    /**
+     * Indicates whether trust store CA names are advertised
+     *
+     * @default false
+     */
+    readonly advertiseTrustStoreCaNames?: boolean;
+}
+/**
+ * The client certificate handling method
+ */
+export declare enum MutualAuthenticationMode {
+    /**
+     * Off
+     */
+    OFF = "off",
+    /**
+     * Application Load Balancer sends the whole client certificate chain to the target using HTTP headers
+     */
+    PASS_THROUGH = "passthrough",
+    /**
+     * Application Load Balancer performs X.509 client certificate authentication for clients when a load balancer negotiates TLS connections
+     */
+    VERIFY = "verify"
+}
+/**
+ * Properties for defining a standalone ApplicationListener
+ */
+export interface ApplicationListenerProps extends BaseApplicationListenerProps {
+    /**
+     * The load balancer to attach this listener to
+     */
+    readonly loadBalancer: IApplicationLoadBalancer;
+}
+/**
+ * Options for ApplicationListener lookup
+ */
+export interface ApplicationListenerLookupOptions extends BaseListenerLookupOptions {
+    /**
+     * ARN of the listener to look up
+     * @default - does not filter by listener arn
+     */
+    readonly listenerArn?: string;
+    /**
+     * Filter listeners by listener protocol
+     * @default - does not filter by listener protocol
+     */
+    readonly listenerProtocol?: ApplicationProtocol;
+}
+/**
+ * Define an ApplicationListener
+ *
+ * @resource AWS::ElasticLoadBalancingV2::Listener
+ */
+export declare class ApplicationListener extends BaseListener implements IApplicationListener {
+    /**
+     * Uniquely identifies this class.
+     */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * Look up an ApplicationListener.
+     */
+    static fromLookup(scope: Construct, id: string, options: ApplicationListenerLookupOptions): IApplicationListener;
+    /**
+     * Import an existing listener
+     */
+    static fromApplicationListenerAttributes(scope: Construct, id: string, attrs: ApplicationListenerAttributes): IApplicationListener;
+    readonly isApplicationListener = true;
+    /**
+     * Manage connections to this ApplicationListener
+     */
+    readonly connections: ec2.Connections;
+    /**
+     * Load balancer this listener is associated with
+     */
+    readonly loadBalancer: IApplicationLoadBalancer;
+    /**
+     * The port of the listener.
+     */
+    readonly port: number;
+    /**
+     * ARNs of certificates added to this listener
+     */
+    private readonly _certificateArns;
+    /**
+     * Listener protocol for this listener.
+     */
+    readonly protocol: ApplicationProtocol;
+    constructor(scope: Construct, id: string, props: ApplicationListenerProps);
+    /**
+     * Add one or more certificates to this listener.
+     *
+     * After the first certificate, this creates ApplicationListenerCertificates
+     * resources since cloudformation requires the certificates array on the
+     * listener resource to have a length of 1.
+     */
+    addCertificates(id: string, certificates: IListenerCertificate[]): void;
+    /**
+     * Perform the given default action on incoming requests
+     *
+     * This allows full control of the default action of the load balancer,
+     * including Action chaining, fixed responses and redirect responses. See
+     * the `ListenerAction` class for all options.
+     *
+     * It's possible to add routing conditions to the Action added in this way.
+     * At least one Action must be added without conditions (which becomes the
+     * default Action).
+     */
+    addAction(id: string, props: AddApplicationActionProps): void;
+    /**
+     * Load balance incoming requests to the given target groups.
+     *
+     * All target groups will be load balanced to with equal weight and without
+     * stickiness. For a more complex configuration than that, use `addAction()`.
+     *
+     * It's possible to add routing conditions to the TargetGroups added in this
+     * way. At least one TargetGroup must be added without conditions (which will
+     * become the default Action for this listener).
+     */
+    addTargetGroups(id: string, props: AddApplicationTargetGroupsProps): void;
+    /**
+     * Load balance incoming requests to the given load balancing targets.
+     *
+     * This method implicitly creates an ApplicationTargetGroup for the targets
+     * involved, and a 'forward' action to route traffic to the given TargetGroup.
+     *
+     * If you want more control over the precise setup, create the TargetGroup
+     * and use `addAction` yourself.
+     *
+     * It's possible to add conditions to the targets added in this way. At least
+     * one set of targets must be added without conditions.
+     *
+     * @returns The newly created target group
+     */
+    addTargets(id: string, props: AddApplicationTargetsProps): ApplicationTargetGroup;
+    /**
+     * Register that a connectable that has been added to this load balancer.
+     *
+     * Don't call this directly. It is called by ApplicationTargetGroup.
+     */
+    registerConnectable(connectable: ec2.IConnectable, portRange: ec2.Port): void;
+    /**
+     * Validate this listener.
+     */
+    protected validateListener(): string[];
+    /**
+     * Wrapper for _setDefaultAction which does a type-safe bind
+     */
+    private setDefaultAction;
+}
+/**
+ * Indicates that this resource can be referenced as an ALB Listener
+ */
+export interface IApplicationListenerRef extends IListener {
+    /**
+     * Indicates that this is an ALB listener
+     *
+     * Will always return true, but is necessary to prevent accidental structural
+     * equality in TypeScript.
+     */
+    readonly isApplicationListener: boolean;
+}
+/**
+ * Properties to reference an existing listener
+ */
+export interface IApplicationListener extends IListener, ec2.IConnectable, IApplicationListenerRef {
+    /**
+     * Add one or more certificates to this listener.
+     */
+    addCertificates(id: string, certificates: IListenerCertificate[]): void;
+    /**
+     * Load balance incoming requests to the given target groups.
+     *
+     * It's possible to add conditions to the TargetGroups added in this way.
+     * At least one TargetGroup must be added without conditions.
+     */
+    addTargetGroups(id: string, props: AddApplicationTargetGroupsProps): void;
+    /**
+     * Load balance incoming requests to the given load balancing targets.
+     *
+     * This method implicitly creates an ApplicationTargetGroup for the targets
+     * involved.
+     *
+     * It's possible to add conditions to the targets added in this way. At least
+     * one set of targets must be added without conditions.
+     *
+     * @returns The newly created target group
+     */
+    addTargets(id: string, props: AddApplicationTargetsProps): ApplicationTargetGroup;
+    /**
+     * Register that a connectable that has been added to this load balancer.
+     *
+     * Don't call this directly. It is called by ApplicationTargetGroup.
+     */
+    registerConnectable(connectable: ec2.IConnectable, portRange: ec2.Port): void;
+    /**
+     * Perform the given action on incoming requests
+     *
+     * This allows full control of the default action of the load balancer,
+     * including Action chaining, fixed responses and redirect responses. See
+     * the `ListenerAction` class for all options.
+     *
+     * It's possible to add routing conditions to the Action added in this way.
+     *
+     * It is not possible to add a default action to an imported IApplicationListener.
+     * In order to add actions to an imported IApplicationListener a `priority`
+     * must be provided.
+     */
+    addAction(id: string, props: AddApplicationActionProps): void;
+}
+/**
+ * Properties to reference an existing listener
+ */
+export interface ApplicationListenerAttributes {
+    /**
+     * ARN of the listener
+     */
+    readonly listenerArn: string;
+    /**
+     * Security group of the load balancer this listener is associated with
+     */
+    readonly securityGroup: ec2.ISecurityGroup;
+    /**
+     * The default port on which this listener is listening
+     */
+    readonly defaultPort?: number;
+}
+/**
+ * Properties for adding a conditional load balancing rule
+ */
+export interface AddRuleProps {
+    /**
+     * Priority of this target group
+     *
+     * The rule with the lowest priority will be used for every request.
+     * If priority is not given, these target groups will be added as
+     * defaults, and must not have conditions.
+     *
+     * Priorities must be unique.
+     *
+     * @default Target groups are used as defaults
+     */
+    readonly priority?: number;
+    /**
+     * Rule applies if matches the conditions.
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html
+     *
+     * @default - No conditions.
+     */
+    readonly conditions?: ListenerCondition[];
+}
+/**
+ * Properties for adding a new target group to a listener
+ */
+export interface AddApplicationTargetGroupsProps extends AddRuleProps {
+    /**
+     * Target groups to forward requests to
+     */
+    readonly targetGroups: IApplicationTargetGroup[];
+}
+/**
+ * Properties for adding a new action to a listener
+ */
+export interface AddApplicationActionProps extends AddRuleProps {
+    /**
+     * Action to perform
+     */
+    readonly action: ListenerAction;
+    /**
+     * `ListenerRule`s have a `Rule` suffix on their logicalId by default. This allows you to remove that suffix.
+     *
+     * Legacy behavior of the `addTargetGroups()` convenience method did not include the `Rule` suffix on the logicalId of the generated `ListenerRule`.
+     * At some point, increasing complexity of requirements can require users to switch from the `addTargetGroups()` method
+     * to the `addAction()` method.
+     * When migrating `ListenerRule`s deployed by a legacy version of `addTargetGroups()`,
+     * you will need to enable this flag to avoid changing the logicalId of your resource.
+     * Otherwise Cfn will attempt to replace the `ListenerRule` and fail.
+     *
+     * @default - use standard logicalId with the `Rule` suffix
+     */
+    readonly removeSuffix?: boolean;
+}
+/**
+ * Properties for adding new targets to a listener
+ */
+export interface AddApplicationTargetsProps extends AddRuleProps {
+    /**
+     * The protocol to use
+     *
+     * @default Determined from port if known
+     */
+    readonly protocol?: ApplicationProtocol;
+    /**
+     * The protocol version to use
+     *
+     * @default ApplicationProtocolVersion.HTTP1
+     */
+    readonly protocolVersion?: ApplicationProtocolVersion;
+    /**
+     * The port on which the listener listens for requests.
+     *
+     * @default Determined from protocol if known
+     */
+    readonly port?: number;
+    /**
+     * The time period during which the load balancer sends a newly registered
+     * target a linearly increasing share of the traffic to the target group.
+     *
+     * The range is 30-900 seconds (15 minutes).
+     *
+     * @default 0
+     */
+    readonly slowStart?: Duration;
+    /**
+     * The stickiness cookie expiration period.
+     *
+     * Setting this value enables load balancer stickiness.
+     *
+     * After this period, the cookie is considered stale. The minimum value is
+     * 1 second and the maximum value is 7 days (604800 seconds).
+     *
+     * @default Stickiness disabled
+     */
+    readonly stickinessCookieDuration?: Duration;
+    /**
+     * The name of an application-based stickiness cookie.
+     *
+     * Names that start with the following prefixes are not allowed: AWSALB, AWSALBAPP,
+     * and AWSALBTG; they're reserved for use by the load balancer.
+     *
+     * Note: `stickinessCookieName` parameter depends on the presence of `stickinessCookieDuration` parameter.
+     * If `stickinessCookieDuration` is not set, `stickinessCookieName` will be omitted.
+     *
+     * @default - If `stickinessCookieDuration` is set, a load-balancer generated cookie is used. Otherwise, no stickiness is defined.
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/sticky-sessions.html
+     */
+    readonly stickinessCookieName?: string;
+    /**
+     * The targets to add to this target group.
+     *
+     * Can be `Instance`, `IPAddress`, or any self-registering load balancing
+     * target. All target must be of the same type.
+     */
+    readonly targets?: IApplicationLoadBalancerTarget[];
+    /**
+     * The name of the target group.
+     *
+     * This name must be unique per region per account, can have a maximum of
+     * 32 characters, must contain only alphanumeric characters or hyphens, and
+     * must not begin or end with a hyphen.
+     *
+     * @default Automatically generated
+     */
+    readonly targetGroupName?: string;
+    /**
+     * The amount of time for Elastic Load Balancing to wait before deregistering a target.
+     *
+     * The range is 0-3600 seconds.
+     *
+     * @default Duration.minutes(5)
+     */
+    readonly deregistrationDelay?: Duration;
+    /**
+     * Health check configuration
+     *
+     * @default - The default value for each property in this configuration varies depending on the target.
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-targetgroup.html#aws-resource-elasticloadbalancingv2-targetgroup-properties
+     */
+    readonly healthCheck?: HealthCheck;
+    /**
+     * The load balancing algorithm to select targets for routing requests.
+     *
+     * @default round_robin.
+     */
+    readonly loadBalancingAlgorithmType?: TargetGroupLoadBalancingAlgorithmType;
+    /**
+     * Indicates whether anomaly mitigation is enabled.
+     *
+     * Only available when `loadBalancingAlgorithmType` is `TargetGroupLoadBalancingAlgorithmType.WEIGHTED_RANDOM`
+     *
+     * @default false
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html#automatic-target-weights
+     */
+    readonly enableAnomalyMitigation?: boolean;
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-load-balancer.d.ts

@@ -0,0 +1,738 @@
+import type { Construct } from 'constructs';
+import type { BaseApplicationListenerProps } from './application-listener';
+import { ApplicationListener } from './application-listener';
+import * as cloudwatch from '../../../aws-cloudwatch';
+import * as ec2 from '../../../aws-ec2';
+import type * as s3 from '../../../aws-s3';
+import type { Duration } from '../../../core';
+import type { ILoadBalancerRef } from '../elasticloadbalancingv2.generated';
+import type { BaseLoadBalancerLookupOptions, BaseLoadBalancerProps, ILoadBalancerV2 } from '../shared/base-load-balancer';
+import { BaseLoadBalancer } from '../shared/base-load-balancer';
+import type { DesyncMitigationMode } from '../shared/enums';
+import { IpAddressType, ApplicationProtocol } from '../shared/enums';
+/**
+ * Properties for defining an Application Load Balancer
+ *
+ * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html#load-balancer-attributes
+ */
+export interface ApplicationLoadBalancerProps extends BaseLoadBalancerProps {
+    /**
+     * Security group to associate with this load balancer
+     *
+     * @default A security group is created
+     */
+    readonly securityGroup?: ec2.ISecurityGroup;
+    /**
+     * The type of IP addresses to use
+     *
+     * @default IpAddressType.IPV4
+     */
+    readonly ipAddressType?: IpAddressType;
+    /**
+     * Indicates whether HTTP/2 is enabled.
+     *
+     * @default true
+     */
+    readonly http2Enabled?: boolean;
+    /**
+     * The load balancer idle timeout, in seconds
+     *
+     * @default 60
+     */
+    readonly idleTimeout?: Duration;
+    /**
+     * Indicates whether HTTP headers with invalid header fields are removed
+     * by the load balancer (true) or routed to targets (false)
+     *
+     * @default false
+     */
+    readonly dropInvalidHeaderFields?: boolean;
+    /**
+     * Determines how the load balancer handles requests that
+     * might pose a security risk to your application
+     *
+     * @default DesyncMitigationMode.DEFENSIVE
+     */
+    readonly desyncMitigationMode?: DesyncMitigationMode;
+    /**
+     * The client keep alive duration. The valid range is 60 to 604800 seconds (1 minute to 7 days).
+     *
+     * @default - Duration.seconds(3600)
+     */
+    readonly clientKeepAlive?: Duration;
+    /**
+     * Indicates whether the Application Load Balancer should preserve the host header in the HTTP request
+     * and send it to the target without any change.
+     *
+     * @default false
+     */
+    readonly preserveHostHeader?: boolean;
+    /**
+     * Indicates whether the two headers (x-amzn-tls-version and x-amzn-tls-cipher-suite),
+     * which contain information about the negotiated TLS version and cipher suite,
+     * are added to the client request before sending it to the target.
+     *
+     * The x-amzn-tls-version header has information about the TLS protocol version negotiated with the client,
+     * and the x-amzn-tls-cipher-suite header has information about the cipher suite negotiated with the client.
+     *
+     * Both headers are in OpenSSL format.
+     *
+     * @default false
+     */
+    readonly xAmznTlsVersionAndCipherSuiteHeaders?: boolean;
+    /**
+     * Indicates whether the X-Forwarded-For header should preserve the source port
+     * that the client used to connect to the load balancer.
+     *
+     * @default false
+     */
+    readonly preserveXffClientPort?: boolean;
+    /**
+     * Enables you to modify, preserve, or remove the X-Forwarded-For header in the HTTP request
+     * before the Application Load Balancer sends the request to the target.
+     *
+     * @default XffHeaderProcessingMode.APPEND
+     */
+    readonly xffHeaderProcessingMode?: XffHeaderProcessingMode;
+    /**
+     * Indicates whether to allow a WAF-enabled load balancer to route requests to targets
+     * if it is unable to forward the request to AWS WAF.
+     *
+     * @default false
+     */
+    readonly wafFailOpen?: boolean;
+}
+/**
+ * Processing mode of the X-Forwarded-For header in the HTTP request
+ * before the Application Load Balancer sends the request to the target.
+ */
+export declare enum XffHeaderProcessingMode {
+    /**
+     * Application Load Balancer adds the client IP address (of the last hop) to the X-Forwarded-For header
+     * in the HTTP request before it sends it to targets.
+     */
+    APPEND = "append",
+    /**
+     * Application Load Balancer preserves the X-Forwarded-For header in the HTTP request,
+     * and sends it to targets without any change.
+     */
+    PRESERVE = "preserve",
+    /**
+     * Application Load Balancer removes the X-Forwarded-For header
+     * in the HTTP request before it sends it to targets.
+     */
+    REMOVE = "remove"
+}
+/**
+ * Options for looking up an ApplicationLoadBalancer
+ */
+export interface ApplicationLoadBalancerLookupOptions extends BaseLoadBalancerLookupOptions {
+}
+/**
+ * Define an Application Load Balancer
+ *
+ * @resource AWS::ElasticLoadBalancingV2::LoadBalancer
+ */
+export declare class ApplicationLoadBalancer extends BaseLoadBalancer implements IApplicationLoadBalancer {
+    /**
+     * Uniquely identifies this class.
+     */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * Look up an application load balancer.
+     */
+    static fromLookup(scope: Construct, id: string, options: ApplicationLoadBalancerLookupOptions): IApplicationLoadBalancer;
+    /**
+     * Import an existing Application Load Balancer
+     */
+    static fromApplicationLoadBalancerAttributes(scope: Construct, id: string, attrs: ApplicationLoadBalancerAttributes): IApplicationLoadBalancer;
+    readonly isApplicationLoadBalancer = true;
+    readonly connections: ec2.Connections;
+    readonly ipAddressType?: IpAddressType;
+    readonly listeners: ApplicationListener[];
+    readonly metrics: IApplicationLoadBalancerMetrics;
+    constructor(scope: Construct, id: string, props: ApplicationLoadBalancerProps);
+    /**
+     * Add a new listener to this load balancer
+     */
+    addListener(id: string, props: BaseApplicationListenerProps): ApplicationListener;
+    /**
+     * Add a redirection listener to this load balancer
+     */
+    addRedirect(props?: ApplicationLoadBalancerRedirectConfig): ApplicationListener;
+    /**
+     * Enable access logging for this load balancer.
+     *
+     * A region must be specified on the stack containing the load balancer; you cannot enable logging on
+     * environment-agnostic stacks. See https://docs.aws.amazon.com/cdk/latest/guide/environments.html
+     */
+    logAccessLogs(bucket: s3.IBucket, prefix?: string): void;
+    /**
+     * Enable connection logging for this load balancer.
+     *
+     * A region must be specified on the stack containing the load balancer; you cannot enable logging on
+     * environment-agnostic stacks.
+     *
+     * @see https://docs.aws.amazon.com/cdk/latest/guide/environments.html
+     */
+    logConnectionLogs(bucket: s3.IBucket, prefix?: string): void;
+    /**
+     * Add a security group to this load balancer
+     */
+    addSecurityGroup(securityGroup: ec2.ISecurityGroup): void;
+    /**
+     * Return the given named metric for this Application Load Balancer
+     *
+     * @default Average over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.custom`` instead
+     */
+    metric(metricName: string, props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of concurrent TCP connections active from clients to the
+     * load balancer and from the load balancer to targets.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.activeConnectionCount`` instead
+     */
+    metricActiveConnectionCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of TLS connections initiated by the client that did not
+     * establish a session with the load balancer. Possible causes include a
+     * mismatch of ciphers or protocols.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.clientTlsNegotiationErrorCount`` instead
+     */
+    metricClientTlsNegotiationErrorCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of load balancer capacity units (LCU) used by your load balancer.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.consumedLCUs`` instead
+     */
+    metricConsumedLCUs(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of fixed-response actions that were successful.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.httpFixedResponseCount`` instead
+     */
+    metricHttpFixedResponseCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of redirect actions that were successful.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.httpRedirectCount`` instead
+     */
+    metricHttpRedirectCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of redirect actions that couldn't be completed because the URL
+     * in the response location header is larger than 8K.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.httpRedirectUrlLimitExceededCount`` instead
+     */
+    metricHttpRedirectUrlLimitExceededCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of HTTP 3xx/4xx/5xx codes that originate from the load balancer.
+     *
+     * This does not include any response codes generated by the targets.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.httpCodeElb`` instead
+     */
+    metricHttpCodeElb(code: HttpCodeElb, props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of HTTP 2xx/3xx/4xx/5xx response codes generated by all targets
+     * in the load balancer.
+     *
+     * This does not include any response codes generated by the load balancer.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.httpCodeTarget`` instead
+     */
+    metricHttpCodeTarget(code: HttpCodeTarget, props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of bytes processed by the load balancer over IPv6.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.ipv6ProcessedBytes`` instead
+     */
+    metricIpv6ProcessedBytes(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of IPv6 requests received by the load balancer.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.ipv6RequestCount`` instead
+     */
+    metricIpv6RequestCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of new TCP connections established from clients to the
+     * load balancer and from the load balancer to targets.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.newConnectionCount`` instead
+     */
+    metricNewConnectionCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of bytes processed by the load balancer over IPv4 and IPv6.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.processedBytes`` instead
+     */
+    metricProcessedBytes(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of connections that were rejected because the load balancer had
+     * reached its maximum number of connections.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.rejectedConnectionCount`` instead
+     */
+    metricRejectedConnectionCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of requests processed over IPv4 and IPv6.
+     *
+     * This count includes only the requests with a response generated by a target of the load balancer.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.requestCount`` instead
+     */
+    metricRequestCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of rules processed by the load balancer given a request rate averaged over an hour.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.ruleEvaluations`` instead
+     */
+    metricRuleEvaluations(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of connections that were not successfully established between the load balancer and target.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.targetConnectionErrorCount`` instead
+     */
+    metricTargetConnectionErrorCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The time elapsed, in seconds, after the request leaves the load balancer until a response from the target is received.
+     *
+     * @default Average over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.targetResponseTime`` instead
+     */
+    metricTargetResponseTime(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of TLS connections initiated by the load balancer that did not establish a session with the target.
+     *
+     * Possible causes include a mismatch of ciphers or protocols.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.targetTLSNegotiationErrorCount`` instead
+     */
+    metricTargetTLSNegotiationErrorCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of user authentications that could not be completed
+     *
+     * Because an authenticate action was misconfigured, the load balancer
+     * couldn't establish a connection with the IdP, or the load balancer
+     * couldn't complete the authentication flow due to an internal error.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.elbAuthError`` instead
+     */
+    metricElbAuthError(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of user authentications that could not be completed because the
+     * IdP denied access to the user or an authorization code was used more than
+     * once.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.elbAuthFailure`` instead
+     */
+    metricElbAuthFailure(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The time elapsed, in milliseconds, to query the IdP for the ID token and user info.
+     *
+     * If one or more of these operations fail, this is the time to failure.
+     *
+     * @default Average over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.elbAuthLatency`` instead
+     */
+    metricElbAuthLatency(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of authenticate actions that were successful.
+     *
+     * This metric is incremented at the end of the authentication workflow,
+     * after the load balancer has retrieved the user claims from the IdP.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationLoadBalancer.metrics.elbAuthSuccess`` instead
+     *
+     */
+    metricElbAuthSuccess(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+}
+/**
+ * Count of HTTP status originating from the load balancer
+ *
+ * This count does not include any response codes generated by the targets.
+ */
+export declare enum HttpCodeElb {
+    /**
+     * The number of HTTP 3XX redirection codes that originate from the load balancer.
+     */
+    ELB_3XX_COUNT = "HTTPCode_ELB_3XX_Count",
+    /**
+     * The number of HTTP 4XX client error codes that originate from the load balancer.
+     *
+     * Client errors are generated when requests are malformed or incomplete.
+     * These requests have not been received by the target. This count does not
+     * include any response codes generated by the targets.
+     */
+    ELB_4XX_COUNT = "HTTPCode_ELB_4XX_Count",
+    /**
+     * The number of HTTP 5XX server error codes that originate from the load balancer.
+     */
+    ELB_5XX_COUNT = "HTTPCode_ELB_5XX_Count",
+    /**
+     * The number of HTTP 500 server error codes that originate from the load balancer.
+     */
+    ELB_500_COUNT = "HTTPCode_ELB_500_Count",
+    /**
+     * The number of HTTP 502 server error codes that originate from the load balancer.
+     */
+    ELB_502_COUNT = "HTTPCode_ELB_502_Count",
+    /**
+     * The number of HTTP 503 server error codes that originate from the load balancer.
+     */
+    ELB_503_COUNT = "HTTPCode_ELB_503_Count",
+    /**
+     * The number of HTTP 504 server error codes that originate from the load balancer.
+     */
+    ELB_504_COUNT = "HTTPCode_ELB_504_Count"
+}
+/**
+ * Count of HTTP status originating from the targets
+ */
+export declare enum HttpCodeTarget {
+    /**
+     * The number of 2xx response codes from targets
+     */
+    TARGET_2XX_COUNT = "HTTPCode_Target_2XX_Count",
+    /**
+     * The number of 3xx response codes from targets
+     */
+    TARGET_3XX_COUNT = "HTTPCode_Target_3XX_Count",
+    /**
+     * The number of 4xx response codes from targets
+     */
+    TARGET_4XX_COUNT = "HTTPCode_Target_4XX_Count",
+    /**
+     * The number of 5xx response codes from targets
+     */
+    TARGET_5XX_COUNT = "HTTPCode_Target_5XX_Count"
+}
+/**
+ * Contains all metrics for an Application Load Balancer.
+ */
+export interface IApplicationLoadBalancerMetrics {
+    /**
+     * Return the given named metric for this Application Load Balancer
+     *
+     * @default Average over 5 minutes
+     */
+    custom(metricName: string, props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of concurrent TCP connections active from clients to the
+     * load balancer and from the load balancer to targets.
+     *
+     * @default Sum over 5 minutes
+     */
+    activeConnectionCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of TLS connections initiated by the client that did not
+     * establish a session with the load balancer. Possible causes include a
+     * mismatch of ciphers or protocols.
+     *
+     * @default Sum over 5 minutes
+     */
+    clientTlsNegotiationErrorCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of load balancer capacity units (LCU) used by your load balancer.
+     *
+     * @default Sum over 5 minutes
+     */
+    consumedLCUs(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of fixed-response actions that were successful.
+     *
+     * @default Sum over 5 minutes
+     */
+    httpFixedResponseCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of redirect actions that were successful.
+     *
+     * @default Sum over 5 minutes
+     */
+    httpRedirectCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of redirect actions that couldn't be completed because the URL
+     * in the response location header is larger than 8K.
+     *
+     * @default Sum over 5 minutes
+     */
+    httpRedirectUrlLimitExceededCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of HTTP 3xx/4xx/5xx codes that originate from the load balancer.
+     *
+     * This does not include any response codes generated by the targets.
+     *
+     * @default Sum over 5 minutes
+     */
+    httpCodeElb(code: HttpCodeElb, props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of HTTP 2xx/3xx/4xx/5xx response codes generated by all targets
+     * in the load balancer.
+     *
+     * This does not include any response codes generated by the load balancer.
+     *
+     * @default Sum over 5 minutes
+     */
+    httpCodeTarget(code: HttpCodeTarget, props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of bytes processed by the load balancer over IPv6.
+     *
+     * @default Sum over 5 minutes
+     */
+    ipv6ProcessedBytes(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of IPv6 requests received by the load balancer.
+     *
+     * @default Sum over 5 minutes
+     */
+    ipv6RequestCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of new TCP connections established from clients to the
+     * load balancer and from the load balancer to targets.
+     *
+     * @default Sum over 5 minutes
+     */
+    newConnectionCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of bytes processed by the load balancer over IPv4 and IPv6.
+     *
+     * @default Sum over 5 minutes
+     */
+    processedBytes(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of connections that were rejected because the load balancer had
+     * reached its maximum number of connections.
+     *
+     * @default Sum over 5 minutes
+     */
+    rejectedConnectionCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of requests processed over IPv4 and IPv6.
+     *
+     * This count includes only the requests with a response generated by a target of the load balancer.
+     *
+     * @default Sum over 5 minutes
+     */
+    requestCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of rules processed by the load balancer given a request rate averaged over an hour.
+     *
+     * @default Sum over 5 minutes
+     */
+    ruleEvaluations(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of connections that were not successfully established between the load balancer and target.
+     *
+     * @default Sum over 5 minutes
+     */
+    targetConnectionErrorCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The time elapsed, in seconds, after the request leaves the load balancer until a response from the target is received.
+     *
+     * @default Average over 5 minutes
+     */
+    targetResponseTime(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of TLS connections initiated by the load balancer that did not establish a session with the target.
+     *
+     * Possible causes include a mismatch of ciphers or protocols.
+     *
+     * @default Sum over 5 minutes
+     */
+    targetTLSNegotiationErrorCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of user authentications that could not be completed
+     *
+     * Because an authenticate action was misconfigured, the load balancer
+     * couldn't establish a connection with the IdP, or the load balancer
+     * couldn't complete the authentication flow due to an internal error.
+     *
+     * @default Sum over 5 minutes
+     */
+    elbAuthError(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of user authentications that could not be completed because the
+     * IdP denied access to the user or an authorization code was used more than
+     * once.
+     *
+     * @default Sum over 5 minutes
+     */
+    elbAuthFailure(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The time elapsed, in milliseconds, to query the IdP for the ID token and user info.
+     *
+     * If one or more of these operations fail, this is the time to failure.
+     *
+     * @default Average over 5 minutes
+     */
+    elbAuthLatency(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of authenticate actions that were successful.
+     *
+     * This metric is incremented at the end of the authentication workflow,
+     * after the load balancer has retrieved the user claims from the IdP.
+     *
+     * @default Sum over 5 minutes
+     */
+    elbAuthSuccess(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+}
+/**
+ * Indicates that this resource can be referenced as an Application LoadBalancer.
+ */
+export interface IApplicationLoadBalancerRef extends ILoadBalancerRef {
+    /**
+     * Indicates that this is an Application Load Balancer
+     *
+     * Will always return true, but is necessary to prevent accidental structural
+     * equality in TypeScript.
+     */
+    readonly isApplicationLoadBalancer: boolean;
+}
+/**
+ * An application load balancer
+ */
+export interface IApplicationLoadBalancer extends ILoadBalancerV2, ec2.IConnectable, IApplicationLoadBalancerRef {
+    /**
+     * The ARN of this load balancer
+     */
+    readonly loadBalancerArn: string;
+    /**
+     * The VPC this load balancer has been created in (if available).
+     * If this interface is the result of an import call to fromApplicationLoadBalancerAttributes,
+     * the vpc attribute will be undefined unless specified in the optional properties of that method.
+     */
+    readonly vpc?: ec2.IVpc;
+    /**
+     * The IP Address Type for this load balancer
+     *
+     * If the `@aws-cdk/aws-elasticloadbalancingV2:albDualstackWithoutPublicIpv4SecurityGroupRulesDefault`
+     * feature flag is set (the default for new projects), and `addListener()` is called with `open: true`,
+     * the load balancer's security group will automatically include both IPv4 and IPv6 ingress rules
+     * when using `IpAddressType.DUAL_STACK_WITHOUT_PUBLIC_IPV4`.
+     *
+     * For existing projects that only have IPv4 rules, you can opt-in to IPv6 ingress rules
+     * by enabling the feature flag in your cdk.json file. Note that enabling this feature flag
+     * will modify existing security group rules.
+     *
+     * @default IpAddressType.IPV4
+     */
+    readonly ipAddressType?: IpAddressType;
+    /**
+     * A list of listeners that have been added to the load balancer.
+     * This list is only valid for owned constructs.
+     */
+    readonly listeners: ApplicationListener[];
+    /**
+     * All metrics available for this load balancer
+     */
+    readonly metrics: IApplicationLoadBalancerMetrics;
+    /**
+     * Add a new listener to this load balancer
+     */
+    addListener(id: string, props: BaseApplicationListenerProps): ApplicationListener;
+}
+/**
+ * Properties to reference an existing load balancer
+ */
+export interface ApplicationLoadBalancerAttributes {
+    /**
+     * ARN of the load balancer
+     */
+    readonly loadBalancerArn: string;
+    /**
+     * ID of the load balancer's security group
+     */
+    readonly securityGroupId: string;
+    /**
+     * The canonical hosted zone ID of this load balancer
+     *
+     * @default - When not provided, LB cannot be used as Route53 Alias target.
+     */
+    readonly loadBalancerCanonicalHostedZoneId?: string;
+    /**
+     * The DNS name of this load balancer
+     *
+     * @default - When not provided, LB cannot be used as Route53 Alias target.
+     */
+    readonly loadBalancerDnsName?: string;
+    /**
+     * Whether the security group allows all outbound traffic or not
+     *
+     * Unless set to `false`, no egress rules will be added to the security group.
+     *
+     * @default true
+     */
+    readonly securityGroupAllowsAllOutbound?: boolean;
+    /**
+     * The VPC this load balancer has been created in, if available
+     *
+     * @default - If the Load Balancer was imported and a VPC was not specified,
+     * the VPC is not available.
+     */
+    readonly vpc?: ec2.IVpc;
+}
+/**
+ * Properties for a redirection config
+ */
+export interface ApplicationLoadBalancerRedirectConfig {
+    /**
+     * The protocol of the listener being created
+     *
+     * @default HTTP
+     */
+    readonly sourceProtocol?: ApplicationProtocol;
+    /**
+     * The port number to listen to
+     *
+     * @default 80
+     */
+    readonly sourcePort?: number;
+    /**
+     * The protocol of the redirection target
+     *
+     * @default HTTPS
+     */
+    readonly targetProtocol?: ApplicationProtocol;
+    /**
+     * The port number to redirect to
+     *
+     * @default 443
+     */
+    readonly targetPort?: number;
+    /**
+     * Allow anyone to connect to this listener
+     *
+     * If this is specified, the listener will be opened up to anyone who can reach it.
+     * For internal load balancers this is anyone in the same VPC. For public load
+     * balancers, this is anyone on the internet.
+     *
+     * If you want to be more selective about who can access this load
+     * balancer, set this to `false` and use the listener's `connections`
+     * object to selectively grant access to the listener.
+     *
+     * @default true
+     */
+    readonly open?: boolean;
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-target-group.d.ts

@@ -0,0 +1,351 @@
+import type { IConstruct, Construct } from 'constructs';
+import type { IApplicationListener } from './application-listener';
+import type { HttpCodeTarget } from './application-load-balancer';
+import * as cloudwatch from '../../../aws-cloudwatch';
+import * as ec2 from '../../../aws-ec2';
+import type { Duration } from '../../../core';
+import type { BaseTargetGroupProps, ITargetGroup, LoadBalancerTargetProps, TargetGroupAttributes } from '../shared/base-target-group';
+import { TargetGroupBase } from '../shared/base-target-group';
+import type { ApplicationProtocol, ApplicationProtocolVersion } from '../shared/enums';
+import { TargetGroupLoadBalancingAlgorithmType } from '../shared/enums';
+/**
+ * Properties for defining an Application Target Group
+ */
+export interface ApplicationTargetGroupProps extends BaseTargetGroupProps {
+    /**
+     * The protocol used for communication with the target.
+     *
+     * This is not applicable for Lambda targets.
+     *
+     * @default - Determined from port if known
+     */
+    readonly protocol?: ApplicationProtocol;
+    /**
+     * The protocol version to use
+     *
+     * @default ApplicationProtocolVersion.HTTP1
+     */
+    readonly protocolVersion?: ApplicationProtocolVersion;
+    /**
+     * The port on which the target receives traffic.
+     *
+     * This is not applicable for Lambda targets.
+     *
+     * @default - Determined from protocol if known
+     */
+    readonly port?: number;
+    /**
+     * The time period during which the load balancer sends a newly registered
+     * target a linearly increasing share of the traffic to the target group.
+     *
+     * The range is 30-900 seconds (15 minutes).
+     *
+     * @default 0
+     */
+    readonly slowStart?: Duration;
+    /**
+     * The stickiness cookie expiration period.
+     *
+     * Setting this value enables load balancer stickiness.
+     *
+     * After this period, the cookie is considered stale. The minimum value is
+     * 1 second and the maximum value is 7 days (604800 seconds).
+     *
+     * @default - Stickiness is disabled
+     */
+    readonly stickinessCookieDuration?: Duration;
+    /**
+     * The name of an application-based stickiness cookie.
+     *
+     * Names that start with the following prefixes are not allowed: AWSALB, AWSALBAPP,
+     * and AWSALBTG; they're reserved for use by the load balancer.
+     *
+     * Note: `stickinessCookieName` parameter depends on the presence of `stickinessCookieDuration` parameter.
+     * If `stickinessCookieDuration` is not set, `stickinessCookieName` will be omitted.
+     *
+     * @default - If `stickinessCookieDuration` is set, a load-balancer generated cookie is used. Otherwise, no stickiness is defined.
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/sticky-sessions.html
+     */
+    readonly stickinessCookieName?: string;
+    /**
+     * The load balancing algorithm to select targets for routing requests.
+     *
+     * @default TargetGroupLoadBalancingAlgorithmType.ROUND_ROBIN
+     */
+    readonly loadBalancingAlgorithmType?: TargetGroupLoadBalancingAlgorithmType;
+    /**
+     * The targets to add to this target group.
+     *
+     * Can be `Instance`, `IPAddress`, or any self-registering load balancing
+     * target. If you use either `Instance` or `IPAddress` as targets, all
+     * target must be of the same type.
+     *
+     * @default - No targets.
+     */
+    readonly targets?: IApplicationLoadBalancerTarget[];
+    /**
+     * Indicates whether anomaly mitigation is enabled.
+     *
+     * Only available when `loadBalancingAlgorithmType` is `TargetGroupLoadBalancingAlgorithmType.WEIGHTED_RANDOM`
+     *
+     * @default false
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html#automatic-target-weights
+     */
+    readonly enableAnomalyMitigation?: boolean;
+    /**
+     * Indicates whether the target group supports multi-value headers.
+     *
+     * If the value is true, the request and response headers exchanged between
+     * the load balancer and the Lambda function include arrays of values or strings.
+     *
+     * Only applicable for Lambda targets.
+     *
+     * @default false
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html#target-group-attributes
+     */
+    readonly multiValueHeadersEnabled?: boolean;
+}
+/**
+ * Contains all metrics for a Target Group of a Application Load Balancer.
+ */
+export interface IApplicationTargetGroupMetrics {
+    /**
+     * Return the given named metric for this Network Target Group
+     *
+     * @default Average over 5 minutes
+     */
+    custom(metricName: string, props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of IPv6 requests received by the target group
+     *
+     * @default Sum over 5 minutes
+     */
+    ipv6RequestCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of requests processed over IPv4 and IPv6.
+     *
+     * This count includes only the requests with a response generated by a target of the load balancer.
+     *
+     * @default Sum over 5 minutes
+     */
+    requestCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of healthy hosts in the target group
+     *
+     * @default Average over 5 minutes
+     */
+    healthyHostCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of unhealthy hosts in the target group
+     *
+     * @default Average over 5 minutes
+     */
+    unhealthyHostCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of HTTP 2xx/3xx/4xx/5xx response codes generated by all targets in this target group.
+     *
+     * This does not include any response codes generated by the load balancer.
+     *
+     * @default Sum over 5 minutes
+     */
+    httpCodeTarget(code: HttpCodeTarget, props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The average number of requests received by each target in a target group.
+     *
+     * The only valid statistic is Sum. Note that this represents the average not the sum.
+     *
+     * @default Sum over 5 minutes
+     */
+    requestCountPerTarget(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of connections that were not successfully established between the load balancer and target.
+     *
+     * @default Sum over 5 minutes
+     */
+    targetConnectionErrorCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The time elapsed, in seconds, after the request leaves the load balancer until a response from the target is received.
+     *
+     * @default Average over 5 minutes
+     */
+    targetResponseTime(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of TLS connections initiated by the load balancer that did not establish a session with the target.
+     *
+     * Possible causes include a mismatch of ciphers or protocols.
+     *
+     * @default Sum over 5 minutes
+     */
+    targetTLSNegotiationErrorCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+}
+/**
+ * Define an Application Target Group
+ */
+export declare class ApplicationTargetGroup extends TargetGroupBase implements IApplicationTargetGroup {
+    /**
+     * Uniquely identifies this class.
+     */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * Import an existing target group
+     */
+    static fromTargetGroupAttributes(scope: Construct, id: string, attrs: TargetGroupAttributes): IApplicationTargetGroup;
+    private readonly connectableMembers;
+    private readonly listeners;
+    private readonly protocol?;
+    private readonly port?;
+    private _metrics?;
+    constructor(scope: Construct, id: string, props?: ApplicationTargetGroupProps);
+    get metrics(): IApplicationTargetGroupMetrics;
+    /**
+     * Add a load balancing target to this target group
+     */
+    addTarget(...targets: IApplicationLoadBalancerTarget[]): void;
+    /**
+     * Enable sticky routing via a cookie to members of this target group.
+     *
+     * Note: If the `cookieName` parameter is set, application-based stickiness will be applied,
+     * otherwise it defaults to duration-based stickiness attributes (`lb_cookie`).
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/sticky-sessions.html
+     */
+    enableCookieStickiness(duration: Duration, cookieName?: string): void;
+    /**
+     * Register a connectable as a member of this target group.
+     *
+     * Don't call this directly. It will be called by load balancing targets.
+     */
+    registerConnectable(connectable: ec2.IConnectable, portRange?: ec2.Port): void;
+    /**
+     * Register a listener that is load balancing to this target group.
+     *
+     * Don't call this directly. It will be called by listeners.
+     */
+    registerListener(listener: IApplicationListener, associatingConstruct?: IConstruct): void;
+    /**
+     * Full name of first load balancer
+     */
+    get firstLoadBalancerFullName(): string;
+    /**
+     * Return the given named metric for this Application Load Balancer Target Group
+     *
+     * Returns the metric for this target group from the point of view of the first
+     * load balancer load balancing to it. If you have multiple load balancers load
+     * sending traffic to the same target group, you will have to override the dimensions
+     * on this metric.
+     *
+     * @default Average over 5 minutes
+     */
+    metric(metricName: string, props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of IPv6 requests received by the target group
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationTargetGroup.metrics.ipv6RequestCount`` instead
+     */
+    metricIpv6RequestCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of requests processed over IPv4 and IPv6.
+     *
+     * This count includes only the requests with a response generated by a target of the load balancer.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationTargetGroup.metrics.requestCount`` instead
+     */
+    metricRequestCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of healthy hosts in the target group
+     *
+     * @default Average over 5 minutes
+     * @deprecated Use ``ApplicationTargetGroup.metrics.healthyHostCount`` instead
+     */
+    metricHealthyHostCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of unhealthy hosts in the target group
+     *
+     * @default Average over 5 minutes
+     * @deprecated Use ``ApplicationTargetGroup.metrics.unhealthyHostCount`` instead
+     */
+    metricUnhealthyHostCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of HTTP 2xx/3xx/4xx/5xx response codes generated by all targets in this target group.
+     *
+     * This does not include any response codes generated by the load balancer.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationTargetGroup.metrics.httpCodeTarget`` instead
+     */
+    metricHttpCodeTarget(code: HttpCodeTarget, props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The average number of requests received by each target in a target group.
+     *
+     * The only valid statistic is Sum. Note that this represents the average not the sum.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use `ApplicationTargetGroup.metrics.requestCountPerTarget` instead
+     */
+    metricRequestCountPerTarget(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of connections that were not successfully established between the load balancer and target.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationTargetGroup.metrics.targetConnectionErrorCount`` instead
+     */
+    metricTargetConnectionErrorCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The time elapsed, in seconds, after the request leaves the load balancer until a response from the target is received.
+     *
+     * @default Average over 5 minutes
+     * @deprecated Use ``ApplicationTargetGroup.metrics.targetResponseTime`` instead
+     */
+    metricTargetResponseTime(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of TLS connections initiated by the load balancer that did not establish a session with the target.
+     *
+     * Possible causes include a mismatch of ciphers or protocols.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``ApplicationTargetGroup.metrics.tlsNegotiationErrorCount`` instead
+     */
+    metricTargetTLSNegotiationErrorCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    protected validateTargetGroup(): string[];
+}
+/**
+ * A Target Group for Application Load Balancers
+ */
+export interface IApplicationTargetGroup extends ITargetGroup {
+    /**
+     * All metrics available for this target group.
+     */
+    readonly metrics: IApplicationTargetGroupMetrics;
+    /**
+     * Register a listener that is load balancing to this target group.
+     *
+     * Don't call this directly. It will be called by listeners.
+     */
+    registerListener(listener: IApplicationListener, associatingConstruct?: IConstruct): void;
+    /**
+     * Register a connectable as a member of this target group.
+     *
+     * Don't call this directly. It will be called by load balancing targets.
+     */
+    registerConnectable(connectable: ec2.IConnectable, portRange?: ec2.Port): void;
+    /**
+     * Add a load balancing target to this target group
+     */
+    addTarget(...targets: IApplicationLoadBalancerTarget[]): void;
+}
+/**
+ * Interface for constructs that can be targets of an application load balancer
+ */
+export interface IApplicationLoadBalancerTarget {
+    /**
+     * Attach load-balanced target to a TargetGroup
+     *
+     * May return JSON to directly add to the [Targets] list, or return undefined
+     * if the target will register itself with the load balancer.
+     */
+    attachToApplicationTargetGroup(targetGroup: IApplicationTargetGroup): LoadBalancerTargetProps;
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/conditions.d.ts

@@ -0,0 +1,61 @@
+/**
+ * ListenerCondition providers definition.
+ */
+export declare abstract class ListenerCondition {
+    /**
+     * Create a host-header listener rule condition
+     *
+     * @param values Hosts for host headers
+     */
+    static hostHeaders(values: string[]): ListenerCondition;
+    /**
+     * Create a http-header listener rule condition
+     *
+     * @param name HTTP header name
+     * @param values HTTP header values
+     */
+    static httpHeader(name: string, values: string[]): ListenerCondition;
+    /**
+     * Create a http-request-method listener rule condition
+     *
+     * @param values HTTP request methods
+     */
+    static httpRequestMethods(values: string[]): ListenerCondition;
+    /**
+     * Create a path-pattern listener rule condition
+     *
+     * @param values Path patterns
+     */
+    static pathPatterns(values: string[]): ListenerCondition;
+    /**
+     * Create a query-string listener rule condition
+     *
+     * @param values Query string key/value pairs
+     */
+    static queryStrings(values: QueryStringCondition[]): ListenerCondition;
+    /**
+     * Create a source-ip listener rule condition
+     *
+     * @param values Source ips
+     */
+    static sourceIps(values: string[]): ListenerCondition;
+    /**
+     * Render the raw Cfn listener rule condition object.
+     */
+    abstract renderRawCondition(): any;
+}
+/**
+ * Properties for the key/value pair of the query string
+ */
+export interface QueryStringCondition {
+    /**
+     * The query string key for the condition
+     *
+     * @default - Any key can be matched.
+     */
+    readonly key?: string;
+    /**
+     * The query string value for the condition
+     */
+    readonly value: string;
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/conditions.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.ListenerCondition=void 0;const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var errors_1=()=>{var tmp=require("../../../core/lib/errors");return errors_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp};class ListenerCondition{static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_elasticloadbalancingv2.ListenerCondition",version:"2.252.0"};static hostHeaders(values){return new HostHeaderListenerCondition(values)}static httpHeader(name,values){return new HttpHeaderListenerCondition(name,values)}static httpRequestMethods(values){return new HttpRequestMethodListenerCondition(values)}static pathPatterns(values){return new PathPatternListenerCondition(values)}static queryStrings(values){return new QueryStringListenerCondition(values)}static sourceIps(values){return new SourceIpListenerCondition(values)}}exports.ListenerCondition=ListenerCondition;class HostHeaderListenerCondition extends ListenerCondition{values;constructor(values){super(),this.values=values}renderRawCondition(){return{field:"host-header",hostHeaderConfig:{values:this.values}}}}class HttpHeaderListenerCondition extends ListenerCondition{name;values;constructor(name,values){super(),this.name=name,this.values=values}renderRawCondition(){return{field:"http-header",httpHeaderConfig:{httpHeaderName:this.name,values:this.values}}}}class HttpRequestMethodListenerCondition extends ListenerCondition{values;constructor(values){super(),this.values=values}renderRawCondition(){return{field:"http-request-method",httpRequestMethodConfig:{values:this.values}}}}class PathPatternListenerCondition extends ListenerCondition{values;constructor(values){if(super(),this.values=values,values&&values.length>5)throw new(errors_1()).UnscopedValidationError((0,literal_string_1().lit)`RuleOnlyConditionValues`,"A rule can only have '5' condition values")}renderRawCondition(){return{field:"path-pattern",pathPatternConfig:{values:this.values}}}}class QueryStringListenerCondition extends ListenerCondition{values;constructor(values){super(),this.values=values}renderRawCondition(){return{field:"query-string",queryStringConfig:{values:this.values}}}}class SourceIpListenerCondition extends ListenerCondition{values;constructor(values){super(),this.values=values}renderRawCondition(){return{field:"source-ip",sourceIpConfig:{values:this.values}}}}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/trust-store-revocation.d.ts

@@ -0,0 +1,59 @@
+import type { Construct } from 'constructs';
+import type { IBucketRef } from '../../../aws-s3';
+import { Resource } from '../../../core';
+import type { aws_elasticloadbalancingv2 } from '../../../interfaces';
+/**
+ * Properties for the trust store revocation
+ */
+export interface TrustStoreRevocationProps {
+    /**
+     * The trust store
+     */
+    readonly trustStore: aws_elasticloadbalancingv2.ITrustStoreRef;
+    /**
+     * The revocation file to add
+     */
+    readonly revocationContents: RevocationContent[];
+}
+/**
+ * Information about a revocation file
+ */
+export interface RevocationContent {
+    /**
+     * The type of revocation file
+     *
+     * @default RevocationType.CRL
+     */
+    readonly revocationType?: RevocationType;
+    /**
+     * The Amazon S3 bucket for the revocation file
+     */
+    readonly bucket: IBucketRef;
+    /**
+     * The Amazon S3 path for the revocation file
+     */
+    readonly key: string;
+    /**
+     * The Amazon S3 object version of the revocation file
+     *
+     * @default - latest version
+     */
+    readonly version?: string;
+}
+/**
+ * The type of revocation file
+ */
+export declare enum RevocationType {
+    /**
+     * A signed list of revoked certificates
+     */
+    CRL = "CRL"
+}
+/**
+ * A new Trust Store Revocation
+ */
+export declare class TrustStoreRevocation extends Resource {
+    /** Uniquely identifies this class. */
+    static readonly PROPERTY_INJECTION_ID: string;
+    constructor(scope: Construct, id: string, props: TrustStoreRevocationProps);
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/trust-store-revocation.js

@@ -0,0 +1 @@
+"use strict";var __esDecorate=exports&&exports.__esDecorate||function(ctor,descriptorIn,decorators,contextIn,initializers,extraInitializers){function accept(f){if(f!==void 0&&typeof f!="function")throw new TypeError("Function expected");return f}for(var kind=contextIn.kind,key=kind==="getter"?"get":kind==="setter"?"set":"value",target=!descriptorIn&&ctor?contextIn.static?ctor:ctor.prototype:null,descriptor=descriptorIn||(target?Object.getOwnPropertyDescriptor(target,contextIn.name):{}),_,done=!1,i=decorators.length-1;i>=0;i--){var context={};for(var p in contextIn)context[p]=p==="access"?{}:contextIn[p];for(var p in contextIn.access)context.access[p]=contextIn.access[p];context.addInitializer=function(f){if(done)throw new TypeError("Cannot add initializers after decoration has completed");extraInitializers.push(accept(f||null))};var result=(0,decorators[i])(kind==="accessor"?{get:descriptor.get,set:descriptor.set}:descriptor[key],context);if(kind==="accessor"){if(result===void 0)continue;if(result===null||typeof result!="object")throw new TypeError("Object expected");(_=accept(result.get))&&(descriptor.get=_),(_=accept(result.set))&&(descriptor.set=_),(_=accept(result.init))&&initializers.unshift(_)}else(_=accept(result))&&(kind==="field"?initializers.unshift(_):descriptor[key]=_)}target&&Object.defineProperty(target,contextIn.name,descriptor),done=!0},__runInitializers=exports&&exports.__runInitializers||function(thisArg,initializers,value){for(var useValue=arguments.length>2,i=0;i<initializers.length;i++)value=useValue?initializers[i].call(thisArg,value):initializers[i].call(thisArg);return useValue?value:void 0};Object.defineProperty(exports,"__esModule",{value:!0}),exports.TrustStoreRevocation=exports.RevocationType=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},metadata_resource_1=()=>{var tmp=require("../../../core/lib/metadata-resource");return metadata_resource_1=()=>tmp,tmp},prop_injectable_1=()=>{var tmp=require("../../../core/lib/prop-injectable");return prop_injectable_1=()=>tmp,tmp},elasticloadbalancingv2_generated_1=()=>{var tmp=require("../elasticloadbalancingv2.generated");return elasticloadbalancingv2_generated_1=()=>tmp,tmp},RevocationType;(function(RevocationType2){RevocationType2.CRL="CRL"})(RevocationType||(exports.RevocationType=RevocationType={}));let TrustStoreRevocation=(()=>{let _classDecorators=[prop_injectable_1().propertyInjectable],_classDescriptor,_classExtraInitializers=[],_classThis,_classSuper=core_1().Resource;var TrustStoreRevocation2=class extends _classSuper{static{_classThis=this}static{const _metadata=typeof Symbol=="function"&&Symbol.metadata?Object.create(_classSuper[Symbol.metadata]??null):void 0;__esDecorate(null,_classDescriptor={value:_classThis},_classDecorators,{kind:"class",name:_classThis.name,metadata:_metadata},null,_classExtraInitializers),TrustStoreRevocation2=_classThis=_classDescriptor.value,_metadata&&Object.defineProperty(_classThis,Symbol.metadata,{enumerable:!0,configurable:!0,writable:!0,value:_metadata})}static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_elasticloadbalancingv2.TrustStoreRevocation",version:"2.252.0"};static PROPERTY_INJECTION_ID="aws-cdk-lib.aws-elasticloadbalancingv2.TrustStoreRevocation";constructor(scope,id,props){super(scope,id);try{jsiiDeprecationWarnings().aws_cdk_lib_aws_elasticloadbalancingv2_TrustStoreRevocationProps(props)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,TrustStoreRevocation2),error}(0,metadata_resource_1().addConstructMetadata)(this,props),new(elasticloadbalancingv2_generated_1()).CfnTrustStoreRevocation(this,"Resource",{trustStoreArn:props.trustStore.trustStoreRef.trustStoreArn,revocationContents:props.revocationContents?.map(content=>({revocationType:content.revocationType,s3Bucket:content.bucket.bucketRef.bucketName,s3Key:content.key,s3ObjectVersion:content.version}))})}static{__runInitializers(_classThis,_classExtraInitializers)}};return TrustStoreRevocation2=_classThis})();exports.TrustStoreRevocation=TrustStoreRevocation;

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/trust-store.d.ts

@@ -0,0 +1,86 @@
+import type { Construct } from 'constructs';
+import type { IBucketRef } from '../../../aws-s3';
+import type { IResource } from '../../../core';
+import { Resource } from '../../../core';
+import type { aws_elasticloadbalancingv2 } from '../../../interfaces';
+/**
+ * Represents a Trust Store
+ */
+export interface ITrustStore extends IResource, aws_elasticloadbalancingv2.ITrustStoreRef {
+    /**
+     * The name of the trust store
+     * @attribute
+     */
+    readonly trustStoreName: string;
+    /**
+     * The ARN of the trust store
+     * @attribute
+     */
+    readonly trustStoreArn: string;
+}
+/**
+ * Properties used for the Trust Store
+ */
+export interface TrustStoreProps {
+    /**
+     * The name of the trust store
+     *
+     * @default - Auto generated
+     */
+    readonly trustStoreName?: string;
+    /**
+     * The bucket that the trust store is hosted in
+     */
+    readonly bucket: IBucketRef;
+    /**
+     * The key in S3 to look at for the trust store
+     */
+    readonly key: string;
+    /**
+     * The version of the S3 object that contains your truststore.
+     * To specify a version, you must have versioning enabled for the S3 bucket.
+     *
+     * @default - latest version
+     */
+    readonly version?: string;
+}
+/**
+ * A new Trust Store
+ */
+export declare class TrustStore extends Resource implements ITrustStore {
+    /** Uniquely identifies this class. */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * Import from ARN
+     */
+    static fromTrustStoreArn(scope: Construct, id: string, trustStoreArn: string): ITrustStore;
+    /**
+     * The name of the trust store
+     *
+     * @attribute
+     */
+    readonly trustStoreName: string;
+    /**
+     * The number of CA certificates in the trust store
+     *
+     * @attribute
+     */
+    readonly numberOfCaCertificates: number;
+    /**
+     * The status of the trust store
+     *
+     * @attribute
+     */
+    readonly status: string;
+    /**
+     * The ARN of the trust store
+     *
+     * @attribute
+     */
+    readonly trustStoreArn: string;
+    /**
+     * A reference to this trust store
+     */
+    get trustStoreRef(): aws_elasticloadbalancingv2.TrustStoreReference;
+    constructor(scope: Construct, id: string, props: TrustStoreProps);
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/elasticloadbalancingv2-canned-metrics.generated.d.ts

@@ -0,0 +1,867 @@
+export interface MetricWithDims<D> {
+    readonly namespace: string;
+    readonly metricName: string;
+    readonly statistic: string;
+    readonly dimensionsMap: D;
+}
+export declare class ApplicationELBMetrics {
+    static activeConnectionCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static clientTlsNegotiationErrorCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static clientTlsNegotiationErrorCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static consumedLcUsAverage(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static desyncMitigationModeNonCompliantRequestCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static desyncMitigationModeNonCompliantRequestCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static elbAuthErrorSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static elbAuthErrorSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static elbAuthFailureSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static elbAuthFailureSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static elbAuthLatencySum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static elbAuthLatencySum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static elbAuthRefreshTokenSuccessSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static elbAuthRefreshTokenSuccessSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static elbAuthSuccessSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static elbAuthSuccessSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static elbAuthUserClaimsSizeExceededSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static elbAuthUserClaimsSizeExceededSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static grpcRequestCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static httpFixedResponseCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static httpFixedResponseCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static httpRedirectCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static httpRedirectCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static httpRedirectUrlLimitExceededCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static httpRedirectUrlLimitExceededCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static httpCodeElb3XxCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static httpCodeElb3XxCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static httpCodeElb4XxCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static httpCodeElb4XxCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static httpCodeElb5XxCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static httpCodeElb5XxCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static httpCodeElb500CountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static httpCodeElb502CountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static httpCodeElb503CountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static httpCodeElb504CountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static httpCodeTarget2XxCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static httpCodeTarget2XxCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static httpCodeTarget2XxCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static httpCodeTarget2XxCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static httpCodeTarget3XxCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static httpCodeTarget3XxCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static httpCodeTarget3XxCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static httpCodeTarget3XxCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static httpCodeTarget4XxCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static httpCodeTarget4XxCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static httpCodeTarget4XxCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static httpCodeTarget4XxCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static httpCodeTarget5XxCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static httpCodeTarget5XxCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static httpCodeTarget5XxCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static httpCodeTarget5XxCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static iPv6ProcessedBytesSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static iPv6RequestCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static newConnectionCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static nonStickyRequestCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static nonStickyRequestCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static processedBytesSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static rejectedConnectionCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static rejectedConnectionCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static requestCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static requestCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static ruleEvaluationsSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static targetConnectionErrorCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static targetConnectionErrorCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static targetConnectionErrorCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static targetConnectionErrorCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static targetResponseTimeAverage(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static targetResponseTimeAverage(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static targetResponseTimeAverage(this: void, dimensions: {
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static targetResponseTimeAverage(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static targetTlsNegotiationErrorCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static targetTlsNegotiationErrorCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static targetTlsNegotiationErrorCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static targetTlsNegotiationErrorCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static lambdaTargetProcessedBytesSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static requestCountPerTargetSum(this: void, dimensions: {
+        TargetGroup: string;
+    }): MetricWithDims<{
+        TargetGroup: string;
+    }>;
+    static requestCountPerTargetSum(this: void, dimensions: {
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static lambdaInternalErrorSum(this: void, dimensions: {
+        TargetGroup: string;
+    }): MetricWithDims<{
+        TargetGroup: string;
+    }>;
+    static lambdaInternalErrorSum(this: void, dimensions: {
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static lambdaUserErrorSum(this: void, dimensions: {
+        TargetGroup: string;
+    }): MetricWithDims<{
+        TargetGroup: string;
+    }>;
+    static lambdaUserErrorSum(this: void, dimensions: {
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static droppedInvalidHeaderRequestCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static forwardedInvalidHeaderRequestCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static healthyHostCountAverage(this: void, dimensions: {
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static healthyHostCountAverage(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static unHealthyHostCountAverage(this: void, dimensions: {
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static unHealthyHostCountAverage(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+}
+export declare class GatewayELBMetrics {
+    static healthyHostCountAverage(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static unHealthyHostCountAverage(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static activeFlowCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static consumedLcUsAverage(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static newFlowCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static processedBytesSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+}
+export declare class NetworkELBMetrics {
+    static activeFlowCountAverage(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static activeFlowCountAverage(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static activeFlowCountTcpAverage(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static activeFlowCountTcpAverage(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static activeFlowCountTlsAverage(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static activeFlowCountTlsAverage(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static activeFlowCountUdpAverage(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static activeFlowCountUdpAverage(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static clientTlsNegotiationErrorCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static consumedLcUsAverage(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static consumedLcUsTcpAverage(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static consumedLcUsTlsAverage(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static consumedLcUsUdpAverage(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static newFlowCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static newFlowCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static newFlowCountTcpSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static newFlowCountTcpSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static newFlowCountTlsSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static newFlowCountTlsSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static newFlowCountUdpSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static newFlowCountUdpSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static processedBytesSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static processedBytesSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static processedBytesTcpSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static processedBytesTcpSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static processedBytesTlsSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static processedBytesTlsSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static processedBytesUdpSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static processedBytesUdpSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static targetTlsNegotiationErrorCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static tcpClientResetCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static tcpClientResetCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static tcpElbResetCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static tcpElbResetCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static tcpTargetResetCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static tcpTargetResetCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static peakPacketsPerSecondSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static peakPacketsPerSecondSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static processedPacketsSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static processedPacketsSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static portAllocationErrorCountSum(this: void, dimensions: {
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+    }>;
+    static portAllocationErrorCountSum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+    }>;
+    static healthyHostCountMinimum(this: void, dimensions: {
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static healthyHostCountMinimum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static unHealthyHostCountMaximum(this: void, dimensions: {
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+    static unHealthyHostCountMaximum(this: void, dimensions: {
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }): MetricWithDims<{
+        AvailabilityZone: string;
+        LoadBalancer: string;
+        TargetGroup: string;
+    }>;
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/index.d.ts

@@ -0,0 +1,21 @@
+export * from './elasticloadbalancingv2.generated';
+export * from './alb/application-listener';
+export * from './alb/application-listener-certificate';
+export * from './alb/application-listener-rule';
+export * from './alb/application-load-balancer';
+export * from './alb/application-target-group';
+export * from './alb/application-listener-action';
+export * from './alb/conditions';
+export * from './alb/trust-store';
+export * from './alb/trust-store-revocation';
+export * from './nlb/network-listener';
+export * from './nlb/network-load-balancer';
+export * from './nlb/network-target-group';
+export * from './nlb/network-listener-action';
+export * from './shared/base-listener';
+export * from './shared/base-load-balancer';
+export * from './shared/base-target-group';
+export * from './shared/enums';
+import './shared/load-balancer-targets';
+export * from './shared/listener-certificate';
+export * from './shared/listener-action';

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/nlb/network-listener-action.d.ts

@@ -0,0 +1,92 @@
+import type { Construct } from 'constructs';
+import type { INetworkListenerRef } from './network-listener';
+import type { INetworkTargetGroup } from './network-target-group';
+import type { Duration } from '../../../core';
+import type { CfnListener, CfnListenerRule } from '../elasticloadbalancingv2.generated';
+import type { IListenerAction } from '../shared/listener-action';
+/**
+ * What to do when a client makes a request to a listener
+ *
+ * Some actions can be combined with other ones (specifically,
+ * you can perform authentication before serving the request).
+ *
+ * Multiple actions form a linked chain; the chain must always terminate in a
+ * *(weighted)forward*, *fixedResponse* or *redirect* action.
+ *
+ * If an action supports chaining, the next action can be indicated
+ * by passing it in the `next` property.
+ */
+export declare class NetworkListenerAction implements IListenerAction {
+    private readonly defaultActionJson;
+    protected readonly next?: NetworkListenerAction | undefined;
+    /**
+     * Forward to one or more Target Groups
+     */
+    static forward(targetGroups: INetworkTargetGroup[], options?: NetworkForwardOptions): NetworkListenerAction;
+    /**
+     * Forward to one or more Target Groups which are weighted differently
+     */
+    static weightedForward(targetGroups: NetworkWeightedTargetGroup[], options?: NetworkForwardOptions): NetworkListenerAction;
+    private _actionJson?;
+    /**
+     * Create an instance of NetworkListenerAction
+     *
+     * The default class should be good enough for most cases and
+     * should be created by using one of the static factory functions,
+     * but allow overriding to make sure we allow flexibility for the future.
+     */
+    protected constructor(defaultActionJson: CfnListener.ActionProperty, next?: NetworkListenerAction | undefined);
+    /**
+     * Render the listener rule actions in this chain
+     */
+    renderRuleActions(): CfnListenerRule.ActionProperty[];
+    /**
+     * Render the listener default actions in this chain
+     */
+    renderActions(): CfnListener.ActionProperty[];
+    /**
+     * Called when the action is being used in a listener
+     */
+    bind(scope: Construct, listener: INetworkListenerRef): void;
+    private _renumber;
+    /**
+     * Renumber the "order" fields in the actions array.
+     *
+     * We don't number for 0 or 1 elements, but otherwise number them 1...#actions
+     * so ELB knows about the right order.
+     *
+     * Do this in `NetworkListenerAction` instead of in `Listener` so that we give
+     * users the opportunity to override by subclassing and overriding `renderActions`.
+     */
+    protected renumber(actions: CfnListener.ActionProperty[]): CfnListener.ActionProperty[];
+}
+/**
+ * Options for `NetworkListenerAction.forward()`
+ */
+export interface NetworkForwardOptions {
+    /**
+     * For how long clients should be directed to the same target group
+     *
+     * Range between 1 second and 7 days.
+     *
+     * @default - No stickiness
+     */
+    readonly stickinessDuration?: Duration;
+}
+/**
+ * A Target Group and weight combination
+ */
+export interface NetworkWeightedTargetGroup {
+    /**
+     * The target group
+     */
+    readonly targetGroup: INetworkTargetGroup;
+    /**
+     * The target group's weight
+     *
+     * Range is [0..1000).
+     *
+     * @default 1
+     */
+    readonly weight?: number;
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/nlb/network-listener-action.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.NetworkListenerAction=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var errors_1=()=>{var tmp=require("../../../core/lib/errors");return errors_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp};class NetworkListenerAction{defaultActionJson;next;static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_elasticloadbalancingv2.NetworkListenerAction",version:"2.252.0"};static forward(targetGroups,options={}){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_elasticloadbalancingv2_NetworkForwardOptions(options)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.forward),error}if(targetGroups.length===0)throw new(errors_1()).UnscopedValidationError((0,literal_string_1().lit)`NeedLeastOneTargetGroup`,"Need at least one targetGroup in a NetworkListenerAction.forward()");return targetGroups.length===1&&options.stickinessDuration===void 0?new TargetGroupListenerAction(targetGroups,{type:"forward",targetGroupArn:targetGroups[0].targetGroupArn}):new TargetGroupListenerAction(targetGroups,{type:"forward",forwardConfig:{targetGroups:targetGroups.map(g=>({targetGroupArn:g.targetGroupArn})),targetGroupStickinessConfig:options.stickinessDuration?{durationSeconds:options.stickinessDuration.toSeconds(),enabled:!0}:void 0}})}static weightedForward(targetGroups,options={}){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_elasticloadbalancingv2_NetworkForwardOptions(options)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.weightedForward),error}if(targetGroups.length===0)throw new(errors_1()).UnscopedValidationError((0,literal_string_1().lit)`NeedLeastOneTargetGroup`,"Need at least one targetGroup in a NetworkListenerAction.weightedForward()");return new TargetGroupListenerAction(targetGroups.map(g=>g.targetGroup),{type:"forward",forwardConfig:{targetGroups:targetGroups.map(g=>({targetGroupArn:g.targetGroup.targetGroupArn,weight:g.weight})),targetGroupStickinessConfig:options.stickinessDuration?{durationSeconds:options.stickinessDuration.toSeconds(),enabled:!0}:void 0}})}_actionJson;constructor(defaultActionJson,next){this.defaultActionJson=defaultActionJson,this.next=next;try{jsiiDeprecationWarnings().aws_cdk_lib_aws_elasticloadbalancingv2_CfnListener_ActionProperty(defaultActionJson),jsiiDeprecationWarnings().aws_cdk_lib_aws_elasticloadbalancingv2_NetworkListenerAction(next)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,NetworkListenerAction),error}}renderRuleActions(){const actionJson=this._actionJson??this.defaultActionJson;return this._renumber([actionJson,...this.next?.renderRuleActions()??[]])}renderActions(){return this._renumber([this.defaultActionJson,...this.next?.renderActions()??[]])}bind(scope,listener){try{jsiiDeprecationWarnings().aws_cdk_lib_aws_elasticloadbalancingv2_INetworkListenerRef(listener)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.bind),error}Array.isArray(scope),Array.isArray(listener)}_renumber(actions){return actions.length<2?actions:actions.map((action,i)=>({...action,order:i+1}))}renumber(actions){return this._renumber(actions)}}exports.NetworkListenerAction=NetworkListenerAction;class TargetGroupListenerAction extends NetworkListenerAction{targetGroups;constructor(targetGroups,defaultActionJson){super(defaultActionJson),this.targetGroups=targetGroups}bind(_scope,listener){for(const tg of this.targetGroups)tg.registerListener(listener)}}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/nlb/network-listener-certificate.d.ts

@@ -0,0 +1,24 @@
+import { Construct } from 'constructs';
+import type { aws_elasticloadbalancingv2 as elbv2 } from '../../../interfaces';
+import type { IListenerCertificate } from '../shared/listener-certificate';
+/**
+ * Properties for adding a set of certificates to a listener
+ */
+export interface NetworkListenerCertificateProps {
+    /**
+     * The listener to attach the rule to
+     */
+    readonly listener: elbv2.IListenerRef;
+    /**
+     * Certificates to attach
+     *
+     * Duplicates are not allowed.
+     */
+    readonly certificates: IListenerCertificate[];
+}
+/**
+ * Add certificates to a listener
+ */
+export declare class NetworkListenerCertificate extends Construct {
+    constructor(scope: Construct, id: string, props: NetworkListenerCertificateProps);
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/nlb/network-listener-certificate.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.NetworkListenerCertificate=void 0;var constructs_1=()=>{var tmp=require("constructs");return constructs_1=()=>tmp,tmp},elasticloadbalancingv2_generated_1=()=>{var tmp=require("../elasticloadbalancingv2.generated");return elasticloadbalancingv2_generated_1=()=>tmp,tmp};class NetworkListenerCertificate extends constructs_1().Construct{constructor(scope,id,props){super(scope,id);const certificates=[...(props.certificates||[]).map(c=>({certificateArn:c.certificateArn}))];new(elasticloadbalancingv2_generated_1()).CfnListenerCertificate(this,"Resource",{listenerArn:props.listener.listenerRef.listenerArn,certificates})}}exports.NetworkListenerCertificate=NetworkListenerCertificate;

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/nlb/network-listener.d.ts

@@ -0,0 +1,261 @@
+import type { Construct } from 'constructs';
+import { NetworkListenerAction } from './network-listener-action';
+import type { INetworkLoadBalancer } from './network-load-balancer';
+import type { INetworkLoadBalancerTarget, INetworkTargetGroup } from './network-target-group';
+import { NetworkTargetGroup } from './network-target-group';
+import { Duration } from '../../../core';
+import type { BaseListenerLookupOptions, IListener } from '../shared/base-listener';
+import { BaseListener } from '../shared/base-listener';
+import type { HealthCheck } from '../shared/base-target-group';
+import type { AlpnPolicy } from '../shared/enums';
+import { Protocol, SslPolicy } from '../shared/enums';
+import type { IListenerCertificate } from '../shared/listener-certificate';
+/**
+ * Basic properties for a Network Listener
+ */
+export interface BaseNetworkListenerProps {
+    /**
+     * The port on which the listener listens for requests.
+     */
+    readonly port: number;
+    /**
+     * Default target groups to load balance to
+     *
+     * All target groups will be load balanced to with equal weight and without
+     * stickiness. For a more complex configuration than that, use
+     * either `defaultAction` or `addAction()`.
+     *
+     * Cannot be specified together with `defaultAction`.
+     *
+     * @default - None.
+     */
+    readonly defaultTargetGroups?: INetworkTargetGroup[];
+    /**
+     * Default action to take for requests to this listener
+     *
+     * This allows full control of the default Action of the load balancer,
+     * including weighted forwarding. See the `NetworkListenerAction` class for
+     * all options.
+     *
+     * Cannot be specified together with `defaultTargetGroups`.
+     *
+     * @default - None.
+     */
+    readonly defaultAction?: NetworkListenerAction;
+    /**
+     * Protocol for listener, expects TCP, TLS, UDP, or TCP_UDP.
+     *
+     * @default - TLS if certificates are provided. TCP otherwise.
+     */
+    readonly protocol?: Protocol;
+    /**
+     * Certificate list of ACM cert ARNs. You must provide exactly one certificate if the listener protocol is HTTPS or TLS.
+     *
+     * @default - No certificates.
+     */
+    readonly certificates?: IListenerCertificate[];
+    /**
+     * SSL Policy
+     *
+     * @default - Current predefined security policy.
+     */
+    readonly sslPolicy?: SslPolicy;
+    /**
+     * Application-Layer Protocol Negotiation (ALPN) is a TLS extension that is sent on the initial TLS handshake hello messages.
+     * ALPN enables the application layer to negotiate which protocols should be used over a secure connection, such as HTTP/1 and HTTP/2.
+     *
+     * Can only be specified together with Protocol TLS.
+     *
+     * @default - None
+     */
+    readonly alpnPolicy?: AlpnPolicy;
+    /**
+     * The load balancer TCP idle timeout.
+     *
+     * @default Duration.seconds(350)
+     */
+    readonly tcpIdleTimeout?: Duration;
+}
+/**
+ * Properties for a Network Listener attached to a Load Balancer
+ */
+export interface NetworkListenerProps extends BaseNetworkListenerProps {
+    /**
+     * The load balancer to attach this listener to
+     */
+    readonly loadBalancer: INetworkLoadBalancer;
+}
+/**
+ * Options for looking up a network listener.
+ */
+export interface NetworkListenerLookupOptions extends BaseListenerLookupOptions {
+    /**
+     * Protocol of the listener port
+     * @default - listener is not filtered by protocol
+     */
+    readonly listenerProtocol?: Protocol;
+}
+/**
+ * Define a Network Listener
+ *
+ * @resource AWS::ElasticLoadBalancingV2::Listener
+ */
+export declare class NetworkListener extends BaseListener implements INetworkListener {
+    /**
+     * Uniquely identifies this class.
+     */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * Looks up a network listener
+     */
+    static fromLookup(scope: Construct, id: string, options: NetworkListenerLookupOptions): INetworkListener;
+    /**
+     * Import an existing listener
+     */
+    static fromNetworkListenerArn(scope: Construct, id: string, networkListenerArn: string): INetworkListener;
+    readonly isNetworkListener = true;
+    /**
+     * The load balancer this listener is attached to
+     */
+    readonly loadBalancer: INetworkLoadBalancer;
+    /**
+     * ARNs of certificates added to this listener
+     */
+    private readonly _certificateArns;
+    /**
+     * the protocol of the listener
+     */
+    private readonly protocol;
+    constructor(scope: Construct, id: string, props: NetworkListenerProps);
+    /**
+     * Add one or more certificates to this listener.
+     *
+     * After the first certificate, this creates NetworkListenerCertificates
+     * resources since cloudformation requires the certificates array on the
+     * listener resource to have a length of 1.
+     */
+    addCertificates(id: string, certificates: IListenerCertificate[]): void;
+    /**
+     * Load balance incoming requests to the given target groups.
+     *
+     * All target groups will be load balanced to with equal weight and without
+     * stickiness. For a more complex configuration than that, use `addAction()`.
+     */
+    addTargetGroups(_id: string, ...targetGroups: INetworkTargetGroup[]): void;
+    /**
+     * Perform the given Action on incoming requests
+     *
+     * This allows full control of the default Action of the load balancer,
+     * including weighted forwarding. See the `NetworkListenerAction` class for
+     * all options.
+     */
+    addAction(_id: string, props: AddNetworkActionProps): void;
+    /**
+     * Load balance incoming requests to the given load balancing targets.
+     *
+     * This method implicitly creates a NetworkTargetGroup for the targets
+     * involved, and a 'forward' action to route traffic to the given TargetGroup.
+     *
+     * If you want more control over the precise setup, create the TargetGroup
+     * and use `addAction` yourself.
+     *
+     * It's possible to add conditions to the targets added in this way. At least
+     * one set of targets must be added without conditions.
+     *
+     * @returns The newly created target group
+     */
+    addTargets(id: string, props: AddNetworkTargetsProps): NetworkTargetGroup;
+    /**
+     * Wrapper for _setDefaultAction which does a type-safe bind
+     */
+    private setDefaultAction;
+}
+/**
+ * Indicates that this resource can be referenced as an NLB Listener
+ */
+export interface INetworkListenerRef extends IListener {
+    /**
+     * Indicates that this is an NLB listener
+     *
+     * Will always return true, but is necessary to prevent accidental structural
+     * equality in TypeScript.
+     */
+    readonly isNetworkListener: boolean;
+}
+/**
+ * Properties to reference an existing listener
+ */
+export interface INetworkListener extends IListener, INetworkListenerRef {
+}
+/**
+ * Properties for adding a new action to a listener
+ */
+export interface AddNetworkActionProps {
+    /**
+     * Action to perform
+     */
+    readonly action: NetworkListenerAction;
+}
+/**
+ * Properties for adding new network targets to a listener
+ */
+export interface AddNetworkTargetsProps {
+    /**
+     * The port on which the target receives traffic.
+     *
+     * @default Determined from protocol if known
+     */
+    readonly port: number;
+    /**
+     * Protocol for target group, expects TCP, TLS, UDP, or TCP_UDP.
+     *
+     * @default - inherits the protocol of the listener
+     */
+    readonly protocol?: Protocol;
+    /**
+     * The targets to add to this target group.
+     *
+     * Can be `Instance`, `IPAddress`, or any self-registering load balancing
+     * target. If you use either `Instance` or `IPAddress` as targets, all
+     * target must be of the same type.
+     */
+    readonly targets?: INetworkLoadBalancerTarget[];
+    /**
+     * The name of the target group.
+     *
+     * This name must be unique per region per account, can have a maximum of
+     * 32 characters, must contain only alphanumeric characters or hyphens, and
+     * must not begin or end with a hyphen.
+     *
+     * @default Automatically generated
+     */
+    readonly targetGroupName?: string;
+    /**
+     * The amount of time for Elastic Load Balancing to wait before deregistering a target.
+     *
+     * The range is 0-3600 seconds.
+     *
+     * @default Duration.minutes(5)
+     */
+    readonly deregistrationDelay?: Duration;
+    /**
+     * Indicates whether Proxy Protocol version 2 is enabled.
+     *
+     * @default false
+     */
+    readonly proxyProtocolV2?: boolean;
+    /**
+     * Indicates whether client IP preservation is enabled.
+     *
+     * @default false if the target group type is IP address and the
+     * target group protocol is TCP or TLS. Otherwise, true.
+     */
+    readonly preserveClientIp?: boolean;
+    /**
+     * Health check configuration
+     *
+     * @default - The default value for each property in this configuration varies depending on the target.
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-targetgroup.html#aws-resource-elasticloadbalancingv2-targetgroup-properties
+     */
+    readonly healthCheck?: HealthCheck;
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/nlb/network-load-balancer.d.ts

@@ -0,0 +1,335 @@
+import type { Construct } from 'constructs';
+import type { BaseNetworkListenerProps } from './network-listener';
+import { NetworkListener } from './network-listener';
+import * as cloudwatch from '../../../aws-cloudwatch';
+import * as ec2 from '../../../aws-ec2';
+import type { BaseLoadBalancerLookupOptions, BaseLoadBalancerProps, ILoadBalancerV2, SubnetMapping } from '../shared/base-load-balancer';
+import { BaseLoadBalancer } from '../shared/base-load-balancer';
+import { IpAddressType } from '../shared/enums';
+/**
+ * Indicates how traffic is distributed among the load balancer Availability Zones.
+ *
+ * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html#zonal-dns-affinity
+ */
+export declare enum ClientRoutingPolicy {
+    /**
+     * 100 percent zonal affinity
+     */
+    AVAILABILITY_ZONE_AFFINITY = "availability_zone_affinity",
+    /**
+     * 85 percent zonal affinity
+     */
+    PARTIAL_AVAILABILITY_ZONE_AFFINITY = "partial_availability_zone_affinity",
+    /**
+     * No zonal affinity
+     */
+    ANY_AVAILABILITY_ZONE = "any_availability_zone"
+}
+/**
+ * Properties for a network load balancer
+ */
+export interface NetworkLoadBalancerProps extends BaseLoadBalancerProps {
+    /**
+     * Security groups to associate with this load balancer
+     *
+     * @default - No security groups associated with the load balancer.
+     */
+    readonly securityGroups?: ec2.ISecurityGroup[];
+    /**
+     * The type of IP addresses to use
+     *
+     * If you want to add a UDP or TCP_UDP listener to the load balancer,
+     * you must choose IPv4.
+     *
+     * @default IpAddressType.IPV4
+     */
+    readonly ipAddressType?: IpAddressType;
+    /**
+     * The AZ affinity routing policy
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html#zonal-dns-affinity
+     *
+     * @default - AZ affinity is disabled.
+     */
+    readonly clientRoutingPolicy?: ClientRoutingPolicy;
+    /**
+     * Indicates whether to evaluate inbound security group rules for traffic sent to a Network Load Balancer through AWS PrivateLink.
+     *
+     * @default true
+     */
+    readonly enforceSecurityGroupInboundRulesOnPrivateLinkTraffic?: boolean;
+    /**
+     * Indicates whether zonal shift is enabled
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/network/zonal-shift.html
+     *
+     * @default false
+     */
+    readonly zonalShift?: boolean;
+    /**
+     * Indicates whether to use an IPv6 prefix from each subnet for source NAT.
+     *
+     * The IP address type must be IpAddressType.DUALSTACK.
+     *
+     * @default undefined - NLB default behavior is false
+     */
+    readonly enablePrefixForIpv6SourceNat?: boolean;
+    /**
+     * Subnet information for the load balancer.
+     *
+     * @default undefined - The VPC default strategy for subnets is used
+     */
+    readonly subnetMappings?: SubnetMapping[];
+    /**
+     * Create a Network Load Balancer without security groups.
+     *
+     * When true, creates an NLB that cannot have security groups attached.
+     * This is useful when you need to create a traditional NLB without security group associations.
+     *
+     * This property only takes effect when the feature flag
+     * `@aws-cdk/aws-elasticloadbalancingv2:networkLoadBalancerWithSecurityGroupByDefault` is enabled.
+     *
+     * @default false
+     */
+    readonly disableSecurityGroups?: boolean;
+}
+/**
+ * Properties to reference an existing load balancer
+ */
+export interface NetworkLoadBalancerAttributes {
+    /**
+     * ARN of the load balancer
+     */
+    readonly loadBalancerArn: string;
+    /**
+     * The canonical hosted zone ID of this load balancer
+     *
+     * @default - When not provided, LB cannot be used as Route53 Alias target.
+     */
+    readonly loadBalancerCanonicalHostedZoneId?: string;
+    /**
+     * The DNS name of this load balancer
+     *
+     * @default - When not provided, LB cannot be used as Route53 Alias target.
+     */
+    readonly loadBalancerDnsName?: string;
+    /**
+     * The VPC to associate with the load balancer.
+     *
+     * @default - When not provided, listeners cannot be created on imported load
+     * balancers.
+     */
+    readonly vpc?: ec2.IVpc;
+    /**
+     * Security groups to associate with this load balancer
+     *
+     * @default - No security groups associated with the load balancer.
+     */
+    readonly loadBalancerSecurityGroups?: string[];
+}
+/**
+ * Options for looking up an NetworkLoadBalancer
+ */
+export interface NetworkLoadBalancerLookupOptions extends BaseLoadBalancerLookupOptions {
+}
+/**
+ * Define a new network load balancer
+ *
+ * @resource AWS::ElasticLoadBalancingV2::LoadBalancer
+ */
+export declare class NetworkLoadBalancer extends BaseLoadBalancer implements INetworkLoadBalancer {
+    /**
+     * Uniquely identifies this class.
+     */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * Looks up the network load balancer.
+     */
+    static fromLookup(scope: Construct, id: string, options: NetworkLoadBalancerLookupOptions): INetworkLoadBalancer;
+    static fromNetworkLoadBalancerAttributes(scope: Construct, id: string, attrs: NetworkLoadBalancerAttributes): INetworkLoadBalancer;
+    readonly metrics: INetworkLoadBalancerMetrics;
+    readonly ipAddressType?: IpAddressType;
+    readonly connections: ec2.Connections;
+    private readonly isSecurityGroupsPropertyDefined;
+    private readonly _enforceSecurityGroupInboundRulesOnPrivateLinkTraffic?;
+    private enablePrefixForIpv6SourceNat?;
+    /**
+     * After the implementation of `IConnectable` (see https://github.com/aws/aws-cdk/pull/28494), the default
+     * value for `securityGroups` is set by the `ec2.Connections` constructor to an empty array.
+     * To keep backward compatibility (`securityGroups` is `undefined` if the related property is not specified)
+     * a getter has been added.
+     */
+    get securityGroups(): string[] | undefined;
+    constructor(scope: Construct, id: string, props: NetworkLoadBalancerProps);
+    get enforceSecurityGroupInboundRulesOnPrivateLinkTraffic(): string | undefined;
+    /**
+     * Add a listener to this load balancer
+     *
+     * @returns The newly created listener
+     */
+    addListener(id: string, props: BaseNetworkListenerProps): NetworkListener;
+    /**
+     * Add a security group to this load balancer
+     */
+    addSecurityGroup(securityGroup: ec2.ISecurityGroup): void;
+    /**
+     * Return the given named metric for this Network Load Balancer
+     *
+     * @default Average over 5 minutes
+     * @deprecated Use ``NetworkLoadBalancer.metrics.custom`` instead
+     */
+    metric(metricName: string, props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of concurrent TCP flows (or connections) from clients to targets.
+     *
+     * This metric includes connections in the SYN_SENT and ESTABLISHED states.
+     * TCP connections are not terminated at the load balancer, so a client
+     * opening a TCP connection to a target counts as a single flow.
+     *
+     * @default Average over 5 minutes
+     * @deprecated Use ``NetworkLoadBalancer.metrics.activeFlowCount`` instead
+     */
+    metricActiveFlowCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of load balancer capacity units (LCU) used by your load balancer.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``NetworkLoadBalancer.metrics.activeFlowCount`` instead
+     */
+    metricConsumedLCUs(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of new TCP flows (or connections) established from clients to targets in the time period.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``NetworkLoadBalancer.metrics.newFlowCount`` instead
+     */
+    metricNewFlowCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of bytes processed by the load balancer, including TCP/IP headers.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``NetworkLoadBalancer.metrics.processedBytes`` instead
+     */
+    metricProcessedBytes(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of reset (RST) packets sent from a client to a target.
+     *
+     * These resets are generated by the client and forwarded by the load balancer.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``NetworkLoadBalancer.metrics.tcpClientResetCount`` instead
+     */
+    metricTcpClientResetCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of reset (RST) packets generated by the load balancer.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``NetworkLoadBalancer.metrics.tcpElbResetCount`` instead
+     */
+    metricTcpElbResetCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of reset (RST) packets sent from a target to a client.
+     *
+     * These resets are generated by the target and forwarded by the load balancer.
+     *
+     * @default Sum over 5 minutes
+     * @deprecated Use ``NetworkLoadBalancer.metrics.tcpTargetResetCount`` instead
+     */
+    metricTcpTargetResetCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+}
+/**
+ * Contains all metrics for a Network Load Balancer.
+ */
+export interface INetworkLoadBalancerMetrics {
+    /**
+     * Return the given named metric for this Network Load Balancer
+     *
+     * @default Average over 5 minutes
+     */
+    custom(metricName: string, props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of concurrent TCP flows (or connections) from clients to targets.
+     *
+     * This metric includes connections in the SYN_SENT and ESTABLISHED states.
+     * TCP connections are not terminated at the load balancer, so a client
+     * opening a TCP connection to a target counts as a single flow.
+     *
+     * @default Average over 5 minutes
+     */
+    activeFlowCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of load balancer capacity units (LCU) used by your load balancer.
+     *
+     * @default Sum over 5 minutes
+     */
+    consumedLCUs(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of new TCP flows (or connections) established from clients to targets in the time period.
+     *
+     * @default Sum over 5 minutes
+     */
+    newFlowCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of bytes processed by the load balancer, including TCP/IP headers.
+     *
+     * @default Sum over 5 minutes
+     */
+    processedBytes(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of reset (RST) packets sent from a client to a target.
+     *
+     * These resets are generated by the client and forwarded by the load balancer.
+     *
+     * @default Sum over 5 minutes
+     */
+    tcpClientResetCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of reset (RST) packets generated by the load balancer.
+     *
+     * @default Sum over 5 minutes
+     */
+    tcpElbResetCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The total number of reset (RST) packets sent from a target to a client.
+     *
+     * These resets are generated by the target and forwarded by the load balancer.
+     *
+     * @default Sum over 5 minutes
+     */
+    tcpTargetResetCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+}
+/**
+ * A network load balancer
+ */
+export interface INetworkLoadBalancer extends ILoadBalancerV2, ec2.IVpcEndpointServiceLoadBalancer, ec2.IConnectable {
+    /**
+     * The VPC this load balancer has been created in (if available)
+     */
+    readonly vpc?: ec2.IVpc;
+    /**
+     * All metrics available for this load balancer
+     */
+    readonly metrics: INetworkLoadBalancerMetrics;
+    /**
+     * Security groups associated with this load balancer
+     */
+    readonly securityGroups?: string[];
+    /**
+     * The type of IP addresses to use
+     *
+     * @default IpAddressType.IPV4
+     */
+    readonly ipAddressType?: IpAddressType;
+    /**
+     * Indicates whether to evaluate inbound security group rules for traffic sent to a Network Load Balancer through AWS PrivateLink
+     *
+     * @default on
+     */
+    readonly enforceSecurityGroupInboundRulesOnPrivateLinkTraffic?: string;
+    /**
+     * Add a listener to this load balancer
+     *
+     * @returns The newly created listener
+     */
+    addListener(id: string, props: BaseNetworkListenerProps): NetworkListener;
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/nlb/network-target-group.d.ts

@@ -0,0 +1,166 @@
+import type { Construct } from 'constructs';
+import * as cloudwatch from '../../../aws-cloudwatch';
+import type { ITargetGroupRef } from '../elasticloadbalancingv2.generated';
+import type { INetworkListenerRef } from './network-listener';
+import type { BaseTargetGroupProps, ITargetGroup, LoadBalancerTargetProps, TargetGroupAttributes } from '../shared/base-target-group';
+import { TargetGroupBase } from '../shared/base-target-group';
+import { Protocol } from '../shared/enums';
+/**
+ * Properties for a new Network Target Group
+ */
+export interface NetworkTargetGroupProps extends BaseTargetGroupProps {
+    /**
+     * The port on which the target receives traffic.
+     */
+    readonly port: number;
+    /**
+     * Protocol for target group, expects TCP, TLS, UDP, or TCP_UDP.
+     *
+     * @default - TCP
+     */
+    readonly protocol?: Protocol;
+    /**
+     * Indicates whether Proxy Protocol version 2 is enabled.
+     *
+     * @default false
+     */
+    readonly proxyProtocolV2?: boolean;
+    /**
+     * Indicates whether client IP preservation is enabled.
+     *
+     * @default false if the target group type is IP address and the
+     * target group protocol is TCP or TLS. Otherwise, true.
+     */
+    readonly preserveClientIp?: boolean;
+    /**
+     * The targets to add to this target group.
+     *
+     * Can be `Instance`, `IPAddress`, or any self-registering load balancing
+     * target. If you use either `Instance` or `IPAddress` as targets, all
+     * target must be of the same type.
+     *
+     * @default - No targets.
+     */
+    readonly targets?: INetworkLoadBalancerTarget[];
+    /**
+     *
+     * Indicates whether the load balancer terminates connections at
+     * the end of the deregistration timeout.
+     *
+     * @default false
+     */
+    readonly connectionTermination?: boolean;
+}
+/**
+ * Contains all metrics for a Target Group of a Network Load Balancer.
+ */
+export interface INetworkTargetGroupMetrics {
+    /**
+     * Return the given named metric for this Network Target Group
+     *
+     * @default Average over 5 minutes
+     */
+    custom(metricName: string, props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of targets that are considered healthy.
+     *
+     * @default Average over 5 minutes
+     */
+    healthyHostCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of targets that are considered unhealthy.
+     *
+     * @default Average over 5 minutes
+     */
+    unHealthyHostCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+}
+/**
+ * Define a Network Target Group
+ */
+export declare class NetworkTargetGroup extends TargetGroupBase implements INetworkTargetGroup {
+    /**
+     * Uniquely identifies this class.
+     */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * Import an existing target group
+     */
+    static fromTargetGroupAttributes(scope: Construct, id: string, attrs: TargetGroupAttributes): INetworkTargetGroup;
+    readonly isNetworkTargetGroup = true;
+    private readonly listeners;
+    private _metrics?;
+    constructor(scope: Construct, id: string, props: NetworkTargetGroupProps);
+    get metrics(): INetworkTargetGroupMetrics;
+    /**
+     * Add a load balancing target to this target group
+     */
+    addTarget(...targets: INetworkLoadBalancerTarget[]): void;
+    /**
+     * Register a listener that is load balancing to this target group.
+     *
+     * Don't call this directly. It will be called by listeners.
+     */
+    registerListener(listener: INetworkListenerRef): void;
+    /**
+     * The number of targets that are considered healthy.
+     *
+     * @default Average over 5 minutes
+     * @deprecated Use ``NetworkTargetGroup.metrics.healthyHostCount`` instead
+     */
+    metricHealthyHostCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * The number of targets that are considered unhealthy.
+     *
+     * @default Average over 5 minutes
+     * @deprecated Use ``NetworkTargetGroup.metrics.healthyHostCount`` instead
+     */
+    metricUnHealthyHostCount(props?: cloudwatch.MetricOptions): cloudwatch.Metric;
+    /**
+     * Full name of first load balancer
+     */
+    get firstLoadBalancerFullName(): string;
+    protected validateTargetGroup(): string[];
+}
+/**
+ * Indicates that this resource can be referenced as an NLB TargetGroup
+ */
+export interface INetworkTargetGroupRef extends ITargetGroupRef {
+    /**
+     * Indicates that this is a Network Target Group
+     *
+     * Will always return true, but is necessary to prevent accidental structural
+     * equality in TypeScript.
+     */
+    readonly isNetworkTargetGroup: boolean;
+}
+/**
+ * A network target group
+ */
+export interface INetworkTargetGroup extends ITargetGroup, INetworkTargetGroupRef {
+    /**
+     * All metrics available for this target group.
+     */
+    readonly metrics: INetworkTargetGroupMetrics;
+    /**
+     * Register a listener that is load balancing to this target group.
+     *
+     * Don't call this directly. It will be called by listeners.
+     */
+    registerListener(listener: INetworkListenerRef): void;
+    /**
+     * Add a load balancing target to this target group
+     */
+    addTarget(...targets: INetworkLoadBalancerTarget[]): void;
+}
+/**
+ * Interface for constructs that can be targets of an network load balancer
+ */
+export interface INetworkLoadBalancerTarget {
+    /**
+     * Attach load-balanced target to a TargetGroup
+     *
+     * May return JSON to directly add to the [Targets] list, or return undefined
+     * if the target will register itself with the load balancer.
+     */
+    attachToNetworkTargetGroup(targetGroup: INetworkTargetGroup): LoadBalancerTargetProps;
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/base-listener.d.ts

@@ -0,0 +1,105 @@
+import type { Construct } from 'constructs';
+import type { IListenerAction } from './listener-action';
+import * as cxschema from '../../../cloud-assembly-schema';
+import type { IResource } from '../../../core';
+import { Resource } from '../../../core';
+import type * as cxapi from '../../../cx-api';
+import type { aws_elasticloadbalancingv2 } from '../../../interfaces';
+/**
+ * Options for listener lookup
+ */
+export interface BaseListenerLookupOptions {
+    /**
+     * Filter listeners by associated load balancer arn
+     * @default - does not filter by load balancer arn
+     */
+    readonly loadBalancerArn?: string;
+    /**
+     * Filter listeners by associated load balancer tags
+     * @default - does not filter by load balancer tags
+     */
+    readonly loadBalancerTags?: Record<string, string>;
+    /**
+     * Filter listeners by listener port
+     * @default - does not filter by listener port
+     */
+    readonly listenerPort?: number;
+}
+/**
+ * Options for querying the load balancer listener context provider
+ * @internal
+ */
+export interface ListenerQueryContextProviderOptions {
+    /**
+     * User's provided options
+     */
+    readonly userOptions: BaseListenerLookupOptions;
+    /**
+     * Type of load balancer expected
+     */
+    readonly loadBalancerType: cxschema.LoadBalancerType;
+    /**
+     * ARN of the listener to look up
+     * @default - does not filter by listener arn
+     */
+    readonly listenerArn?: string;
+    /**
+     * Optional protocol of the listener to look up
+     */
+    readonly listenerProtocol?: cxschema.LoadBalancerListenerProtocol;
+}
+/**
+ * Base interface for listeners
+ */
+export interface IListener extends IResource, aws_elasticloadbalancingv2.IListenerRef {
+    /**
+     * ARN of the listener
+     * @attribute
+     */
+    readonly listenerArn: string;
+}
+/**
+ * Base class for listeners
+ */
+export declare abstract class BaseListener extends Resource implements IListener {
+    /**
+     * Queries the load balancer listener context provider for load balancer
+     * listener info.
+     * @internal
+     */
+    protected static _queryContextProvider(scope: Construct, options: ListenerQueryContextProviderOptions): cxapi.LoadBalancerListenerContextResponse;
+    /**
+     * @attribute
+     */
+    readonly listenerArn: string;
+    /**
+     * A reference to this listener
+     */
+    get listenerRef(): aws_elasticloadbalancingv2.ListenerReference;
+    /**
+     * Attributes set on this listener
+     */
+    private readonly attributes;
+    private readonly _defaultAction;
+    constructor(scope: Construct, id: string, additionalProps: any);
+    /**
+     * Set a non-standard attribute on the listener
+     *
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-elasticloadbalancingv2-listener-listenerattribute.html
+     */
+    setAttribute(key: string, value: string | undefined): void;
+    /**
+     * Remove an attribute from the listener
+     */
+    removeAttribute(key: string): void;
+    /**
+     * Validate this listener
+     */
+    protected validateListener(): string[];
+    /**
+     * Configure the default action
+     *
+     * @internal
+     */
+    protected _setDefaultAction(action: IListenerAction): void;
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/base-listener.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.BaseListener=void 0;const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var util_1=()=>{var tmp=require("./util");return util_1=()=>tmp,tmp},cxschema=()=>{var tmp=require("../../../cloud-assembly-schema");return cxschema=()=>tmp,tmp},core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},errors_1=()=>{var tmp=require("../../../core/lib/errors");return errors_1=()=>tmp,tmp},helpers_internal_1=()=>{var tmp=require("../../../core/lib/helpers-internal");return helpers_internal_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp},elasticloadbalancingv2_generated_1=()=>{var tmp=require("../elasticloadbalancingv2.generated");return elasticloadbalancingv2_generated_1=()=>tmp,tmp};class BaseListener extends core_1().Resource{static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_elasticloadbalancingv2.BaseListener",version:"2.252.0"};static _queryContextProvider(scope,options){if(core_1().Token.isUnresolved(options.userOptions.loadBalancerArn)||Object.values(options.userOptions.loadBalancerTags??{}).some(core_1().Token.isUnresolved)||core_1().Token.isUnresolved(options.userOptions.listenerPort))throw new(errors_1()).ValidationError((0,literal_string_1().lit)`ArgumentsLookUpLoadBalancer`,"All arguments to look up a load balancer listener must be concrete (no Tokens)",scope);let cxschemaTags;return options.userOptions.loadBalancerTags&&(cxschemaTags=(0,util_1().mapTagMapToCxschema)(options.userOptions.loadBalancerTags)),core_1().ContextProvider.getValue(scope,{provider:cxschema().ContextProvider.LOAD_BALANCER_LISTENER_PROVIDER,props:{listenerArn:options.listenerArn,listenerPort:options.userOptions.listenerPort,listenerProtocol:options.listenerProtocol,loadBalancerArn:options.userOptions.loadBalancerArn,loadBalancerTags:cxschemaTags,loadBalancerType:options.loadBalancerType},dummyValue:{listenerArn:`arn:aws:elasticloadbalancing:us-west-2:123456789012:listener/${options.loadBalancerType}/my-load-balancer/50dc6c495c0c9188/f2f7dc8efc522ab2`,listenerPort:80,securityGroupIds:["sg-123456789012"]}}).value}listenerArn;get listenerRef(){return{listenerArn:this.listenerArn}}attributes={};_defaultAction;constructor(scope,id,additionalProps){super(scope,id),this._defaultAction=helpers_internal_1().Box.fromValue(void 0);const resource=new(elasticloadbalancingv2_generated_1()).CfnListener(this,"Resource",{...additionalProps,defaultActions:this._defaultAction.derive(a=>a?.renderActions()??[]),listenerAttributes:core_1().Lazy.any({produce:()=>(0,util_1().renderAttributes)(this.attributes)},{omitEmptyArray:!0})});this.listenerArn=resource.ref,this.node.addValidation({validate:()=>this.validateListener()})}setAttribute(key,value){this.attributes[key]=value}removeAttribute(key){this.setAttribute(key,void 0)}validateListener(){return this._defaultAction.get()?[]:["Listener needs at least one default action or target group (call addTargetGroups or addAction)"]}_setDefaultAction(action){this._defaultAction.get()&&core_1().Annotations.of(this).addWarningV2("@aws-cdk/aws-elbv2:listenerExistingDefaultActionReplaced","A default Action already existed on this Listener and was replaced. Configure exactly one default Action."),this._defaultAction.set(action)}}exports.BaseListener=BaseListener;

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/base-load-balancer.d.ts

@@ -0,0 +1,257 @@
+import type { Construct } from 'constructs';
+import * as ec2 from '../../../aws-ec2';
+import * as iam from '../../../aws-iam';
+import type * as s3 from '../../../aws-s3';
+import * as cxschema from '../../../cloud-assembly-schema';
+import type { IResource } from '../../../core';
+import { Resource } from '../../../core';
+import * as cxapi from '../../../cx-api';
+import type { aws_elasticloadbalancingv2 } from '../../../interfaces';
+/**
+ * The prefix to use for source NAT for a dual-stack network load balancer with UDP listeners.
+ */
+export declare class SourceNatIpv6Prefix {
+    readonly prefix: string;
+    /**
+     * Use an automatically assigned IPv6 prefix
+     */
+    static autoAssigned(): SourceNatIpv6Prefix;
+    /**
+     * Use a custom IPv6 prefix with /80 netmask
+     * @param prefix The IPv6 prefix
+     */
+    static fromIpv6Prefix(prefix: string): SourceNatIpv6Prefix;
+    /**
+     * @param prefix The IPv6 prefix
+     */
+    constructor(prefix: string);
+}
+/**
+ * Specifies a subnet for a load balancer
+ */
+export interface SubnetMapping {
+    /**
+     * The subnet.
+     */
+    readonly subnet: ec2.ISubnet;
+    /**
+     * The allocation ID of the Elastic IP address for an internet-facing load balancer.
+     *
+     * @default undefined - AWS default is to allocate a new IP address for internet-facing load balancers
+     */
+    readonly allocationId?: string;
+    /**
+     * The IPv6 address.
+     *
+     * @default undefined - AWS default is to allocate an IPv6 address from the subnet's pool
+     */
+    readonly ipv6Address?: string;
+    /**
+     * The private IPv4 address for an internal load balancer.
+     *
+     * @default undefined - AWS default is to allocate a private IPv4 address from the subnet's pool
+     */
+    readonly privateIpv4Address?: string;
+    /**
+     * The IPv6 prefix to use for source NAT for a dual-stack network load balancer with UDP listeners.
+     *
+     * Specify an IPv6 prefix (/80 netmask) from the subnet CIDR block
+     * or `SourceNatIpv6Prefix.autoAssigned()` to use an IPv6 prefix selected at random from the subnet CIDR block.
+     *
+     * @default undefined - AWS default is `SourceNatIpv6Prefix.autoAssigned()` for IPv6 load balancers
+     */
+    readonly sourceNatIpv6Prefix?: SourceNatIpv6Prefix;
+}
+/**
+ * Shared properties of both Application and Network Load Balancers
+ */
+export interface BaseLoadBalancerProps {
+    /**
+     * Name of the load balancer
+     *
+     * @default - Automatically generated name.
+     */
+    readonly loadBalancerName?: string;
+    /**
+     * The VPC network to place the load balancer in
+     */
+    readonly vpc: ec2.IVpc;
+    /**
+     * Whether the load balancer has an internet-routable address
+     *
+     * @default false
+     */
+    readonly internetFacing?: boolean;
+    /**
+     * Which subnets place the load balancer in
+     *
+     * @default - the Vpc default strategy.
+     *
+     */
+    readonly vpcSubnets?: ec2.SubnetSelection;
+    /**
+     * Indicates whether deletion protection is enabled.
+     *
+     * @default false
+     */
+    readonly deletionProtection?: boolean;
+    /**
+     * Indicates whether cross-zone load balancing is enabled.
+     *
+     * @default - false for Network Load Balancers and true for Application Load Balancers.
+     * This can not be `false` for Application Load Balancers.
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-elasticloadbalancingv2-loadbalancer-loadbalancerattribute.html
+     */
+    readonly crossZoneEnabled?: boolean;
+    /**
+     * Indicates whether the load balancer blocks traffic through the Internet Gateway (IGW).
+     *
+     * @default - false for internet-facing load balancers and true for internal load balancers
+     */
+    readonly denyAllIgwTraffic?: boolean;
+    /**
+     * The minimum capacity (LCU) for a load balancer.
+     *
+     * @default undefined - ELB default is 0 LCU
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/capacity-unit-reservation.html
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/network/capacity-unit-reservation.html
+     * @see https://exampleloadbalancer.com/ondemand_capacity_reservation_calculator.html
+     */
+    readonly minimumCapacityUnit?: number;
+}
+export interface ILoadBalancerV2 extends IResource, aws_elasticloadbalancingv2.ILoadBalancerRef {
+    /**
+     * The canonical hosted zone ID of this load balancer
+     *
+     * Example value: `Z2P70J7EXAMPLE`
+     *
+     * @attribute
+     */
+    readonly loadBalancerCanonicalHostedZoneId: string;
+    /**
+     * The DNS name of this load balancer
+     *
+     * Example value: `my-load-balancer-424835706.us-west-2.elb.amazonaws.com`
+     *
+     * @attribute
+     */
+    readonly loadBalancerDnsName: string;
+}
+/**
+ * Options for looking up load balancers
+ */
+export interface BaseLoadBalancerLookupOptions {
+    /**
+     * Find by load balancer's ARN
+     * @default - does not search by load balancer arn
+     */
+    readonly loadBalancerArn?: string;
+    /**
+     * Match load balancer tags.
+     * @default - does not match load balancers by tags
+     */
+    readonly loadBalancerTags?: Record<string, string>;
+}
+/**
+ * Options for query context provider
+ * @internal
+ */
+export interface LoadBalancerQueryContextProviderOptions {
+    /**
+     * User's lookup options
+     */
+    readonly userOptions: BaseLoadBalancerLookupOptions;
+    /**
+     * Type of load balancer
+     */
+    readonly loadBalancerType: cxschema.LoadBalancerType;
+}
+/**
+ * Base class for both Application and Network Load Balancers
+ */
+export declare abstract class BaseLoadBalancer extends Resource {
+    /**
+     * Queries the load balancer context provider for load balancer info.
+     * @internal
+     */
+    protected static _queryContextProvider(scope: Construct, options: LoadBalancerQueryContextProviderOptions): cxapi.LoadBalancerContextResponse;
+    /**
+     * The canonical hosted zone ID of this load balancer
+     *
+     * Example value: `Z2P70J7EXAMPLE`
+     *
+     * @attribute
+     */
+    readonly loadBalancerCanonicalHostedZoneId: string;
+    /**
+     * The DNS name of this load balancer
+     *
+     * Example value: `my-load-balancer-424835706.us-west-2.elb.amazonaws.com`
+     *
+     * @attribute
+     */
+    readonly loadBalancerDnsName: string;
+    /**
+     * The full name of this load balancer
+     *
+     * Example value: `app/my-load-balancer/50dc6c495c0c9188`
+     *
+     * @attribute
+     */
+    readonly loadBalancerFullName: string;
+    /**
+     * The name of this load balancer
+     *
+     * Example value: `my-load-balancer`
+     *
+     * @attribute
+     */
+    readonly loadBalancerName: string;
+    /**
+     * The ARN of this load balancer
+     *
+     * Example value: `arn:aws:elasticloadbalancing:us-west-2:123456789012:loadbalancer/app/my-internal-load-balancer/50dc6c495c0c9188`
+     *
+     * @attribute
+     */
+    readonly loadBalancerArn: string;
+    /**
+     * A reference to this load balancer
+     */
+    get loadBalancerRef(): aws_elasticloadbalancingv2.LoadBalancerReference;
+    /**
+     * @attribute
+     */
+    readonly loadBalancerSecurityGroups: string[];
+    /**
+     * The VPC this load balancer has been created in.
+     *
+     * This property is always defined (not `null` or `undefined`) for sub-classes of `BaseLoadBalancer`.
+     */
+    readonly vpc?: ec2.IVpc;
+    /**
+     * Attributes set on this load balancer
+     */
+    private readonly attributes;
+    constructor(scope: Construct, id: string, baseProps: BaseLoadBalancerProps, additionalProps: any);
+    /**
+     * Enable access logging for this load balancer.
+     *
+     * A region must be specified on the stack containing the load balancer; you cannot enable logging on
+     * environment-agnostic stacks. See https://docs.aws.amazon.com/cdk/latest/guide/environments.html
+     */
+    logAccessLogs(bucket: s3.IBucket, prefix?: string): void;
+    /**
+     * Set a non-standard attribute on the load balancer
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html#load-balancer-attributes
+     */
+    setAttribute(key: string, value: string | undefined): void;
+    /**
+     * Remove an attribute from the load balancer
+     */
+    removeAttribute(key: string): void;
+    protected resourcePolicyPrincipal(): iam.IPrincipal;
+    protected validateLoadBalancer(): string[];
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/base-target-group.d.ts

@@ -0,0 +1,365 @@
+import type { IConstruct, IDependable } from 'constructs';
+import { Construct, DependencyGroup } from 'constructs';
+import type { Protocol } from './enums';
+import { TargetType } from './enums';
+import type * as ec2 from '../../../aws-ec2';
+import * as cdk from '../../../core';
+import type { aws_elasticloadbalancingv2 } from '../../../interfaces';
+/**
+ * The IP address type of targets registered with a target group
+ */
+export declare enum TargetGroupIpAddressType {
+    /**
+     * IPv4 addresses
+     */
+    IPV4 = "ipv4",
+    /**
+     * IPv6 addresses
+     */
+    IPV6 = "ipv6"
+}
+/**
+ * Basic properties of both Application and Network Target Groups
+ */
+export interface BaseTargetGroupProps {
+    /**
+     * The name of the target group.
+     *
+     * This name must be unique per region per account, can have a maximum of
+     * 32 characters, must contain only alphanumeric characters or hyphens, and
+     * must not begin or end with a hyphen.
+     *
+     * @default - Automatically generated.
+     */
+    readonly targetGroupName?: string;
+    /**
+     * The virtual private cloud (VPC).
+     *
+     * only if `TargetType` is `Ip` or `InstanceId`
+     *
+     * @default - undefined
+     */
+    readonly vpc?: ec2.IVpc;
+    /**
+     * The amount of time for Elastic Load Balancing to wait before deregistering a target.
+     *
+     * The range is 0-3600 seconds.
+     *
+     * @default 300
+     */
+    readonly deregistrationDelay?: cdk.Duration;
+    /**
+     * Health check configuration
+     *
+     * @default - The default value for each property in this configuration varies depending on the target.
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-targetgroup.html#aws-resource-elasticloadbalancingv2-targetgroup-properties
+     */
+    readonly healthCheck?: HealthCheck;
+    /**
+     * The type of targets registered to this TargetGroup, either IP or Instance.
+     *
+     * All targets registered into the group must be of this type. If you
+     * register targets to the TargetGroup in the CDK app, the TargetType is
+     * determined automatically.
+     *
+     * @default - Determined automatically.
+     */
+    readonly targetType?: TargetType;
+    /**
+     * Indicates whether cross zone load balancing is enabled.
+     *
+     * @default - use load balancer configuration
+     * @see https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-elasticloadbalancingv2-targetgroup-targetgroupattribute.html
+     */
+    readonly crossZoneEnabled?: boolean;
+    /**
+     * The type of IP addresses of the targets registered with the target group.
+     *
+     * @default undefined - ELB defaults to IPv4
+     */
+    readonly ipAddressType?: TargetGroupIpAddressType;
+    /**
+     * Configuring target group health.
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html#target-group-attributes
+     * @default - use default configuration
+     */
+    readonly targetGroupHealth?: TargetGroupHealth;
+}
+/**
+ * Properties for configuring a target group health
+ * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html#target-group-attributes
+ */
+export interface TargetGroupHealth {
+    /**
+     * The minimum number of targets that must be healthy for DNS failover.
+     * If below this value, mark the zone as unhealthy in DNS.
+     * Use 0 for "off".
+     * @default 1
+     */
+    readonly dnsMinimumHealthyTargetCount?: number;
+    /**
+     * The minimum percentage of targets that must be healthy for DNS failover.
+     * If below this value, mark the zone as unhealthy in DNS.
+     * Use 0 for "off".
+     * @default 0
+     */
+    readonly dnsMinimumHealthyTargetPercentage?: number;
+    /**
+     * The minimum number of targets that must be healthy for unhealthy state routing.
+     * If below this value, send traffic to all targets including unhealthy ones.
+     * @default 1
+     */
+    readonly routingMinimumHealthyTargetCount?: number;
+    /**
+     * The minimum percentage of targets that must be healthy for unhealthy state routing.
+     * If below this value, send traffic to all targets including unhealthy ones.
+     * Use 0 for "off".
+     * @default 0
+     */
+    readonly routingMinimumHealthyTargetPercentage?: number;
+}
+/**
+ * Properties for configuring a health check
+ */
+export interface HealthCheck {
+    /**
+     * Indicates whether health checks are enabled. If the target type is lambda,
+     * health checks are disabled by default but can be enabled. If the target type
+     * is instance or ip, health checks are always enabled and cannot be disabled.
+     *
+     * @default - Determined automatically.
+     */
+    readonly enabled?: boolean;
+    /**
+     * The approximate number of seconds between health checks for an individual target.
+     * Must be 5 to 300 seconds
+     *
+     * @default - 10 seconds if protocol is `GENEVE`, 35 seconds if target type is `lambda`, else 30 seconds
+     */
+    readonly interval?: cdk.Duration;
+    /**
+     * The ping path destination where Elastic Load Balancing sends health check requests.
+     *
+     * @default /
+     */
+    readonly path?: string;
+    /**
+     * The port that the load balancer uses when performing health checks on the targets.
+     *
+     * @default 'traffic-port'
+     */
+    readonly port?: string;
+    /**
+     * The protocol the load balancer uses when performing health checks on targets.
+     *
+     * The TCP protocol is supported for health checks only if the protocol of the target group is TCP, TLS, UDP, or TCP_UDP.
+     * The TLS, UDP, and TCP_UDP protocols are not supported for health checks.
+     *
+     * @default - HTTP for ALBs, TCP for NLBs
+     */
+    readonly protocol?: Protocol;
+    /**
+     * The amount of time, in seconds, during which no response from a target means a failed health check.
+     * Must be 2 to 120 seconds.
+     *
+     * @default - 6 seconds if the protocol is HTTP, 5 seconds if protocol is `GENEVE`, 30 seconds if target type is `lambda`, 10 seconds for TCP, TLS, or HTTPS
+     */
+    readonly timeout?: cdk.Duration;
+    /**
+     * The number of consecutive health checks successes required before considering an unhealthy target healthy.
+     *
+     * For Application Load Balancers, the default is 5. For Network Load Balancers, the default is 3.
+     *
+     * @default - 5 for ALBs, 3 for NLBs
+     */
+    readonly healthyThresholdCount?: number;
+    /**
+     * The number of consecutive health check failures required before considering a target unhealthy.
+     *
+     * For Application Load Balancers, the default is 2. For Network Load
+     * Balancers, the range is between 2-10 and can be set accordingly.
+     *
+     * @default 2
+     */
+    readonly unhealthyThresholdCount?: number;
+    /**
+     * GRPC code to use when checking for a successful response from a target.
+     *
+     * You can specify values between 0 and 99. You can specify multiple values
+     * (for example, "0,1") or a range of values (for example, "0-5").
+     *
+     * @default 12
+     */
+    readonly healthyGrpcCodes?: string;
+    /**
+     * HTTP code to use when checking for a successful response from a target.
+     *
+     * For Application Load Balancers, you can specify values between 200 and
+     * 499, and the default value is 200. You can specify multiple values (for
+     * example, "200,202") or a range of values (for example, "200-299").
+     */
+    readonly healthyHttpCodes?: string;
+}
+/**
+ * Define the target of a load balancer
+ */
+export declare abstract class TargetGroupBase extends Construct implements ITargetGroup {
+    /**
+     * The ARN of the target group
+     */
+    readonly targetGroupArn: string;
+    /**
+     * A reference to this target group
+     */
+    get targetGroupRef(): aws_elasticloadbalancingv2.TargetGroupReference;
+    /**
+     * The environment this resource belongs to
+     */
+    get env(): cdk.ResourceEnvironment;
+    /**
+     * The full name of the target group
+     */
+    readonly targetGroupFullName: string;
+    /**
+     * The name of the target group
+     */
+    readonly targetGroupName: string;
+    /**
+     * ARNs of load balancers load balancing to this TargetGroup
+     */
+    readonly targetGroupLoadBalancerArns: string[];
+    /**
+     * Full name of first load balancer
+     *
+     * This identifier is emitted as a dimensions of the metrics of this target
+     * group.
+     *
+     * Example value: `app/my-load-balancer/123456789`
+     */
+    abstract readonly firstLoadBalancerFullName: string;
+    /**
+     * A token representing a list of ARNs of the load balancers that route traffic to this target group
+     */
+    readonly loadBalancerArns: string;
+    /**
+     * Health check for the members of this target group
+     */
+    get healthCheck(): HealthCheck;
+    set healthCheck(value: HealthCheck);
+    /**
+     * Default port configured for members of this target group
+     */
+    protected readonly defaultPort: number;
+    /**
+     * Configurable dependable with all resources that lead to load balancer attachment
+     */
+    protected readonly loadBalancerAttachedDependencies: DependencyGroup;
+    /**
+     * The types of the directly registered members of this target group
+     */
+    protected get targetType(): TargetType | undefined;
+    protected set targetType(value: TargetType | undefined);
+    /**
+     * Attributes of this target group
+     */
+    private readonly attributes;
+    private readonly _healthCheck;
+    private readonly _targetType;
+    /**
+     * The JSON objects returned by the directly registered members of this target group
+     */
+    private readonly _targetsJson;
+    /**
+     * The target group VPC
+     *
+     * @default - Required if adding instances instead of Lambdas to TargetGroup
+     */
+    private vpc?;
+    /**
+     * The target group resource
+     */
+    private readonly resource;
+    constructor(scope: Construct, id: string, baseProps: BaseTargetGroupProps, additionalProps: any);
+    /**
+     * List of constructs that need to be depended on to ensure the TargetGroup is associated to a load balancer
+     */
+    get loadBalancerAttached(): IDependable;
+    /**
+     * Set/replace the target group's health check
+     */
+    configureHealthCheck(healthCheck: HealthCheck): void;
+    /**
+     * Set a non-standard attribute on the target group
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html#target-group-attributes
+     */
+    setAttribute(key: string, value: string | undefined): void;
+    /**
+     * Register the given load balancing target as part of this group
+     */
+    protected addLoadBalancerTarget(props: LoadBalancerTargetProps): void;
+    protected validateTargetGroup(): string[];
+    protected validateHealthCheck(): string[];
+}
+/**
+ * Properties to reference an existing target group
+ */
+export interface TargetGroupAttributes {
+    /**
+     * ARN of the target group
+     */
+    readonly targetGroupArn: string;
+    /**
+     * A Token representing the list of ARNs for the load balancer routing to this target group
+     */
+    readonly loadBalancerArns?: string;
+}
+/**
+ * A target group
+ */
+export interface ITargetGroup extends IConstruct, aws_elasticloadbalancingv2.ITargetGroupRef {
+    /**
+     * The name of the target group
+     */
+    readonly targetGroupName: string;
+    /**
+     * ARN of the target group
+     */
+    readonly targetGroupArn: string;
+    /**
+     * A token representing a list of ARNs of the load balancers that route traffic to this target group
+     */
+    readonly loadBalancerArns: string;
+    /**
+     * Return an object to depend on the listeners added to this target group
+     */
+    readonly loadBalancerAttached: IDependable;
+}
+/**
+ * Result of attaching a target to load balancer
+ */
+export interface LoadBalancerTargetProps {
+    /**
+     * What kind of target this is
+     */
+    readonly targetType: TargetType;
+    /**
+     * JSON representing the target's direct addition to the TargetGroup list
+     *
+     * May be omitted if the target is going to register itself later.
+     */
+    readonly targetJson?: any;
+}
+/**
+ * Extract the full load balancer name (used for metrics) from the listener ARN:
+ *
+ * Turns
+ *
+ *     arn:aws:elasticloadbalancing:us-west-2:123456789012:listener/app/my-load-balancer/50dc6c495c0c9188/f2f7dc8efc522ab2
+ *
+ * Into
+ *
+ *     app/my-load-balancer/50dc6c495c0c9188
+ */
+export declare function loadBalancerNameFromListenerArn(listenerArn: string): string;

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/enums.d.ts

@@ -0,0 +1,388 @@
+/**
+ * What kind of addresses to allocate to the load balancer
+ */
+export declare enum IpAddressType {
+    /**
+     * Allocate IPv4 addresses
+     */
+    IPV4 = "ipv4",
+    /**
+     * Allocate both IPv4 and IPv6 addresses
+     */
+    DUAL_STACK = "dualstack",
+    /**
+     * IPv6 only public addresses, with private IPv4 and IPv6 addresses
+     */
+    DUAL_STACK_WITHOUT_PUBLIC_IPV4 = "dualstack-without-public-ipv4"
+}
+/**
+ * Backend protocol for network load balancers and health checks
+ */
+export declare enum Protocol {
+    /**
+     * HTTP (ALB health checks and NLB health checks)
+     */
+    HTTP = "HTTP",
+    /**
+     * HTTPS (ALB health checks and NLB health checks)
+     */
+    HTTPS = "HTTPS",
+    /**
+     * TCP (NLB, NLB health checks)
+     */
+    TCP = "TCP",
+    /**
+     * TLS (NLB)
+     */
+    TLS = "TLS",
+    /**
+     * UDP (NLB)
+     */
+    UDP = "UDP",
+    /**
+     * Listen to both TCP and UDP on the same port (NLB)
+     */
+    TCP_UDP = "TCP_UDP"
+}
+/**
+ * Load balancing protocol for application load balancers
+ */
+export declare enum ApplicationProtocol {
+    /**
+     * HTTP
+     */
+    HTTP = "HTTP",
+    /**
+     * HTTPS
+     */
+    HTTPS = "HTTPS"
+}
+/**
+ * Load balancing protocol version for application load balancers
+ */
+export declare enum ApplicationProtocolVersion {
+    /**
+     * GRPC
+     */
+    GRPC = "GRPC",
+    /**
+     * HTTP1
+     */
+    HTTP1 = "HTTP1",
+    /**
+     * HTTP2
+     */
+    HTTP2 = "HTTP2"
+}
+/**
+ * Elastic Load Balancing provides the following security policies for Application Load Balancers
+ *
+ * We recommend the Recommended policy for general use. You can
+ * use the ForwardSecrecy policy if you require Forward Secrecy
+ * (FS).
+ *
+ * You can use one of the TLS policies to meet compliance and security
+ * standards that require disabling certain TLS protocol versions, or to
+ * support legacy clients that require deprecated ciphers.
+ *
+ * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html
+ */
+export declare enum SslPolicy {
+    /**
+     * The recommended security policy for TLS listeners.
+     * This is the default policy for listeners created using the AWS Management Console
+     *
+     * This policy includes TLS 1.3, and is backwards compatible with TLS 1.2
+     *
+     * When feature flag @aws-cdk/aws-elasticloadbalancingv2:usePostQuantumTlsPolicy is enabled,
+     * listeners automatically use the post-quantum policy instead.
+     */
+    RECOMMENDED_TLS = "ELBSecurityPolicy-TLS13-1-2-2021-06",
+    /**
+     * TLS 1.3 and 1.2 with post-quantum hybrid key exchange using ML-KEM.
+     *
+     * This uses the non-restricted variant (without -Res-) to maintain AES-CBC cipher support
+     * for TLS 1.2 clients, ensuring backward compatibility.
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html
+     */
+    TLS13_12_PQ = "ELBSecurityPolicy-TLS13-1-2-PQ-2025-09",
+    /**
+     * The recommended policy for http listeners.
+     * This is the default security policy for listeners created using the AWS CLI
+     */
+    RECOMMENDED = "ELBSecurityPolicy-2016-08",
+    /**
+     * TLS1.2 and 1.3
+     */
+    TLS13_RES = "ELBSecurityPolicy-TLS13-1-2-Res-2021-06",
+    /**
+     * TLS1.2 and 1.3 and no SHA ciphers
+     */
+    TLS13_EXT1 = "ELBSecurityPolicy-TLS13-1-2-Ext1-2021-06",
+    /**
+     * TLS1.2 and 1.3 with all ciphers
+     */
+    TLS13_EXT2 = "ELBSecurityPolicy-TLS13-1-2-Ext2-2021-06",
+    /**
+     * TLS1.0 through 1.3 with all ciphers
+     */
+    TLS13_10 = "ELBSecurityPolicy-TLS13-1-0-2021-06",
+    /**
+     * TLS1.1 through 1.3 with all ciphers
+     */
+    TLS13_11 = "ELBSecurityPolicy-TLS13-1-1-2021-06",
+    /**
+     * TLS1.3 only
+     */
+    TLS13_13 = "ELBSecurityPolicy-TLS13-1-3-2021-06",
+    /**
+     * TLS 1.3 only with post-quantum hybrid key exchange using ML-KEM
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html
+     */
+    TLS13_13_PQ = "ELBSecurityPolicy-TLS13-1-3-PQ-2025-09",
+    /**
+     * TLS 1.2 and 1.3 with post-quantum hybrid key exchange using ML-KEM
+     *
+     * Restricted cipher suite for enhanced security with quantum resistance.
+     * Removes AES-CBC algorithms. AWS Console default policy for post-quantum cryptography.
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html
+     */
+    TLS13_12_RES_PQ = "ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09",
+    /**
+     * TLS 1.2 and 1.3 with post-quantum hybrid key exchange using ML-KEM
+     *
+     * Extended cipher suite 1 with quantum resistance.
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html
+     */
+    TLS13_12_EXT1_PQ = "ELBSecurityPolicy-TLS13-1-2-Ext1-PQ-2025-09",
+    /**
+     * TLS 1.2 and 1.3 with post-quantum hybrid key exchange using ML-KEM
+     *
+     * Extended cipher suite 2 with quantum resistance.
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html
+     */
+    TLS13_12_EXT2_PQ = "ELBSecurityPolicy-TLS13-1-2-Ext2-PQ-2025-09",
+    /**
+     * TLS 1.0 through 1.3 with post-quantum hybrid key exchange using ML-KEM
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html
+     */
+    TLS13_10_PQ = "ELBSecurityPolicy-TLS13-1-0-PQ-2025-09",
+    /**
+     * TLS 1.3 only with AES 128 and 256 GCM SHA ciphers
+     */
+    FIPS_TLS13_13 = "ELBSecurityPolicy-TLS13-1-3-FIPS-2023-04",
+    /**
+     * TLS 1.2 and 1.3 with AES and ECDHE GCM/SHA ciphers
+     */
+    FIPS_TLS13_12_RES = "ELBSecurityPolicy-TLS13-1-2-Res-FIPS-2023-04",
+    /**
+     * TLS 1.2 and 1.3 with ECDHE SHA/GCM ciphers, excluding SHA1 ciphers
+     */
+    FIPS_TLS13_12 = "ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04",
+    /**
+     * TLS 1.2 and 1.3 with all ECDHE ciphers
+     */
+    FIPS_TLS13_12_EXT0 = "ELBSecurityPolicy-TLS13-1-2-Ext0-FIPS-2023-04",
+    /**
+     * TLS 1.2 and 1.3 with all AES and ECDHE ciphers excluding SHA1 ciphers
+     */
+    FIPS_TLS13_12_EXT1 = "ELBSecurityPolicy-TLS13-1-2-Ext1-FIPS-2023-04",
+    /**
+     * TLS 1.2 and 1.3 with all ciphers
+     */
+    FIPS_TLS13_12_EXT2 = "ELBSecurityPolicy-TLS13-1-2-Ext2-FIPS-2023-04",
+    /**
+     * TLS1.1 through 1.3 with all ciphers
+     */
+    FIPS_TLS13_11 = "ELBSecurityPolicy-TLS13-1-1-FIPS-2023-04",
+    /**
+     *  TLS1.0 through 1.3 with all ciphers
+     */
+    FIPS_TLS13_10 = "ELBSecurityPolicy-TLS13-1-0-FIPS-2023-04",
+    /**
+     * TLS 1.3 only with post-quantum hybrid key exchange using ML-KEM
+     *
+     * FIPS-compliant with quantum resistance.
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html#fips-security-policies
+     */
+    FIPS_TLS13_13_PQ = "ELBSecurityPolicy-TLS13-1-3-FIPS-PQ-2025-09",
+    /**
+     * TLS 1.2 and 1.3 with post-quantum hybrid key exchange using ML-KEM
+     *
+     * FIPS-compliant with quantum resistance.
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html#fips-security-policies
+     */
+    FIPS_TLS13_12_PQ = "ELBSecurityPolicy-TLS13-1-2-FIPS-PQ-2025-09",
+    /**
+     * TLS 1.2 and 1.3 with post-quantum hybrid key exchange using ML-KEM
+     *
+     * Restricted cipher suite for enhanced security with quantum resistance.
+     * FIPS-compliant. AWS recommended policy for post-quantum cryptography with FIPS.
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html#fips-security-policies
+     */
+    FIPS_TLS13_12_RES_PQ = "ELBSecurityPolicy-TLS13-1-2-Res-FIPS-PQ-2025-09",
+    /**
+     * TLS 1.2 and 1.3 with post-quantum hybrid key exchange using ML-KEM
+     *
+     * Extended cipher suite 0 with quantum resistance. FIPS-compliant.
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html#fips-security-policies
+     */
+    FIPS_TLS13_12_EXT0_PQ = "ELBSecurityPolicy-TLS13-1-2-Ext0-FIPS-PQ-2025-09",
+    /**
+     * TLS 1.2 and 1.3 with post-quantum hybrid key exchange using ML-KEM
+     *
+     * Extended cipher suite 1 with quantum resistance. FIPS-compliant.
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html#fips-security-policies
+     */
+    FIPS_TLS13_12_EXT1_PQ = "ELBSecurityPolicy-TLS13-1-2-Ext1-FIPS-PQ-2025-09",
+    /**
+     * TLS 1.2 and 1.3 with post-quantum hybrid key exchange using ML-KEM
+     *
+     * Extended cipher suite 2 with quantum resistance. FIPS-compliant.
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html#fips-security-policies
+     */
+    FIPS_TLS13_12_EXT2_PQ = "ELBSecurityPolicy-TLS13-1-2-Ext2-FIPS-PQ-2025-09",
+    /**
+     * TLS 1.0 through 1.3 with post-quantum hybrid key exchange using ML-KEM
+     *
+     * FIPS-compliant with quantum resistance.
+     *
+     * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html#fips-security-policies
+     */
+    FIPS_TLS13_10_PQ = "ELBSecurityPolicy-TLS13-1-0-FIPS-PQ-2025-09",
+    /**
+     * Strong foward secrecy ciphers and TLV1.2 only (2020 edition).
+     * Same as FORWARD_SECRECY_TLS12_RES, but only supports GCM versions of the TLS ciphers
+     */
+    FORWARD_SECRECY_TLS12_RES_GCM = "ELBSecurityPolicy-FS-1-2-Res-2020-10",
+    /**
+     * Strong forward secrecy ciphers and TLS1.2 only
+     */
+    FORWARD_SECRECY_TLS12_RES = "ELBSecurityPolicy-FS-1-2-Res-2019-08",
+    /**
+     * Forward secrecy ciphers and TLS1.2 only
+     */
+    FORWARD_SECRECY_TLS12 = "ELBSecurityPolicy-FS-1-2-2019-08",
+    /**
+     * Forward secrecy ciphers only with TLS1.1 and 1.2
+     */
+    FORWARD_SECRECY_TLS11 = "ELBSecurityPolicy-FS-1-1-2019-08",
+    /**
+     * Forward secrecy ciphers only
+     */
+    FORWARD_SECRECY = "ELBSecurityPolicy-FS-2018-06",
+    /**
+     * TLS1.2 only and no SHA ciphers
+     */
+    TLS12 = "ELBSecurityPolicy-TLS-1-2-2017-01",
+    /**
+     * TLS1.2 only with all ciphers
+     */
+    TLS12_EXT = "ELBSecurityPolicy-TLS-1-2-Ext-2018-06",
+    /**
+     * TLS1.1 and 1.2 with all ciphers
+     */
+    TLS11 = "ELBSecurityPolicy-TLS-1-1-2017-01",
+    /**
+     * Support for DES-CBC3-SHA
+     *
+     * Do not use this security policy unless you must support a legacy client
+     * that requires the DES-CBC3-SHA cipher, which is a weak cipher.
+     */
+    LEGACY = "ELBSecurityPolicy-TLS-1-0-2015-04"
+}
+/**
+ * How to interpret the load balancing target identifiers
+ */
+export declare enum TargetType {
+    /**
+     * Targets identified by instance ID
+     */
+    INSTANCE = "instance",
+    /**
+     * Targets identified by IP address
+     */
+    IP = "ip",
+    /**
+     * Target is a single Lambda Function
+     */
+    LAMBDA = "lambda",
+    /**
+     * Target is a single Application Load Balancer
+     */
+    ALB = "alb"
+}
+/**
+ * Application-Layer Protocol Negotiation Policies for network load balancers.
+ * Which protocols should be used over a secure connection.
+ */
+export declare enum AlpnPolicy {
+    /**
+     * Negotiate only HTTP/1.*. The ALPN preference list is http/1.1, http/1.0
+     */
+    HTTP1_ONLY = "HTTP1Only",
+    /**
+     * Negotiate only HTTP/2. The ALPN preference list is h2
+     */
+    HTTP2_ONLY = "HTTP2Only",
+    /**
+     * Prefer HTTP/1.* over HTTP/2 (which can be useful for HTTP/2 testing). The ALPN preference list is http/1.1, http/1.0, h2
+     */
+    HTTP2_OPTIONAL = "HTTP2Optional",
+    /**
+     * Prefer HTTP/2 over HTTP/1.*. The ALPN preference list is h2, http/1.1, http/1.0
+     */
+    HTTP2_PREFERRED = "HTTP2Preferred",
+    /**
+     * Do not negotiate ALPN
+     */
+    NONE = "None"
+}
+/**
+ * Load balancing algorithmm type for target groups
+ */
+export declare enum TargetGroupLoadBalancingAlgorithmType {
+    /**
+     * round_robin
+     */
+    ROUND_ROBIN = "round_robin",
+    /**
+     * least_outstanding_requests
+     */
+    LEAST_OUTSTANDING_REQUESTS = "least_outstanding_requests",
+    /**
+     * weighted_random
+     */
+    WEIGHTED_RANDOM = "weighted_random"
+}
+/**
+ * How the load balancer handles requests that might pose a security risk to your application
+ *
+ * @see https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html#desync-mitigation-mode
+ */
+export declare enum DesyncMitigationMode {
+    /**
+     * Allows all traffic
+     */
+    MONITOR = "monitor",
+    /**
+     * Provides durable mitigation against HTTP desync while maintaining the availability of your application
+     */
+    DEFENSIVE = "defensive",
+    /**
+     * Receives only requests that comply with RFC 7230
+     */
+    STRICTEST = "strictest"
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/imported.d.ts

@@ -0,0 +1,35 @@
+import type { IDependable } from 'constructs';
+import { Construct } from 'constructs';
+import type { ITargetGroup } from './base-target-group';
+import * as cdk from '../../../core';
+import type { aws_elasticloadbalancingv2 } from '../../../interfaces';
+/**
+ * Base internal class for existing target groups
+ */
+export declare abstract class ImportedTargetGroupBase extends Construct implements ITargetGroup {
+    /**
+     * ARN of the target group
+     */
+    readonly targetGroupArn: string;
+    /**
+     * A reference to this target group
+     */
+    get targetGroupRef(): aws_elasticloadbalancingv2.TargetGroupReference;
+    /**
+     * The environment this resource belongs to
+     */
+    get env(): cdk.ResourceEnvironment;
+    /**
+     * The name of the target group
+     */
+    readonly targetGroupName: string;
+    /**
+     * A token representing a list of ARNs of the load balancers that route traffic to this target group
+     */
+    readonly loadBalancerArns: string;
+    /**
+     * Return an object to depend on the listeners added to this target group
+     */
+    readonly loadBalancerAttached: IDependable;
+    constructor(scope: Construct, id: string, props: TargetGroupImportProps);
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/imported.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.ImportedTargetGroupBase=void 0;var constructs_1=()=>{var tmp=require("constructs");return constructs_1=()=>tmp,tmp},cdk=()=>{var tmp=require("../../../core");return cdk=()=>tmp,tmp};class ImportedTargetGroupBase extends constructs_1().Construct{targetGroupArn;get targetGroupRef(){return{targetGroupArn:this.targetGroupArn}}get env(){return cdk().Stack.of(this).env}targetGroupName;loadBalancerArns;loadBalancerAttached=new(constructs_1()).DependencyGroup;constructor(scope,id,props){super(scope,id),this.targetGroupArn=props.targetGroupArn,this.targetGroupName=cdk().Stack.of(scope).splitArn(props.targetGroupArn,cdk().ArnFormat.SLASH_RESOURCE_NAME).resourceName.split("/")[0],this.loadBalancerArns=props.loadBalancerArns||cdk().Aws.NO_VALUE}}exports.ImportedTargetGroupBase=ImportedTargetGroupBase;

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/listener-action.d.ts

@@ -0,0 +1,14 @@
+import type { CfnListener, CfnListenerRule } from '../elasticloadbalancingv2.generated';
+/**
+ * Interface for listener actions
+ */
+export interface IListenerAction {
+    /**
+     * Render the listener default actions in this chain
+     */
+    renderActions(): CfnListener.ActionProperty[];
+    /**
+     * Render the listener rule actions in this chain
+     */
+    renderRuleActions(): CfnListenerRule.ActionProperty[];
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/listener-action.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0});

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/listener-certificate.d.ts

@@ -0,0 +1,28 @@
+import type { ICertificateRef } from '../../../interfaces/generated/aws-certificatemanager-interfaces.generated';
+/**
+ * A certificate source for an ELBv2 listener
+ */
+export interface IListenerCertificate {
+    /**
+     * The ARN of the certificate to use
+     */
+    readonly certificateArn: string;
+}
+/**
+ * A certificate source for an ELBv2 listener
+ */
+export declare class ListenerCertificate implements IListenerCertificate {
+    /**
+     * Use an ACM certificate as a listener certificate
+     */
+    static fromCertificateManager(this: void, acmCertificate: ICertificateRef): ListenerCertificate;
+    /**
+     * Use any certificate, identified by its ARN, as a listener certificate
+     */
+    static fromArn(this: void, certificateArn: string): ListenerCertificate;
+    /**
+     * The ARN of the certificate to use
+     */
+    readonly certificateArn: string;
+    protected constructor(certificateArn: string);
+}

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/listener-certificate.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.ListenerCertificate=void 0;var jsiiDeprecationWarnings=()=>{var tmp=require("../../../.warnings.jsii.js");return jsiiDeprecationWarnings=()=>tmp,tmp};const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");class ListenerCertificate{static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_elasticloadbalancingv2.ListenerCertificate",version:"2.252.0"};static fromCertificateManager(acmCertificate){try{jsiiDeprecationWarnings().aws_cdk_lib_interfaces_aws_certificatemanager_ICertificateRef(acmCertificate)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.fromCertificateManager),error}return new ListenerCertificate(acmCertificate.certificateRef.certificateId)}static fromArn(certificateArn){return new ListenerCertificate(certificateArn)}certificateArn;constructor(certificateArn){this.certificateArn=certificateArn}}exports.ListenerCertificate=ListenerCertificate;

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/load-balancer-targets.d.ts

@@ -0,0 +1,3 @@
+import type { LoadBalancerTargetProps } from './base-target-group';
+import type { IApplicationLoadBalancerTarget, IApplicationTargetGroup } from '../alb/application-target-group';
+import type { INetworkLoadBalancerTarget, INetworkTargetGroup } from '../nlb/network-target-group';

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/load-balancer-targets.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.IpTarget=exports.InstanceTarget=void 0;const JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti");var enums_1=()=>{var tmp=require("./enums");return enums_1=()=>tmp,tmp};class InstanceTarget{instanceId;port;static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_elasticloadbalancingv2.InstanceTarget",version:"2.252.0"};constructor(instanceId,port){this.instanceId=instanceId,this.port=port}attachToApplicationTargetGroup(targetGroup){return this.attach(targetGroup)}attachToNetworkTargetGroup(targetGroup){return this.attach(targetGroup)}attach(_targetGroup){return{targetType:enums_1().TargetType.INSTANCE,targetJson:{id:this.instanceId,port:this.port}}}}exports.InstanceTarget=InstanceTarget;class IpTarget{ipAddress;port;availabilityZone;static[JSII_RTTI_SYMBOL_1]={fqn:"aws-cdk-lib.aws_elasticloadbalancingv2.IpTarget",version:"2.252.0"};constructor(ipAddress,port,availabilityZone){this.ipAddress=ipAddress,this.port=port,this.availabilityZone=availabilityZone}attachToApplicationTargetGroup(targetGroup){return this.attach(targetGroup)}attachToNetworkTargetGroup(targetGroup){return this.attach(targetGroup)}attach(_targetGroup){return{targetType:enums_1().TargetType.IP,targetJson:{id:this.ipAddress,port:this.port,availabilityZone:this.availabilityZone}}}}exports.IpTarget=IpTarget;

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/util.d.ts

@@ -0,0 +1,46 @@
+import { ApplicationProtocol, Protocol } from './enums';
+import type * as cxschema from '../../../cloud-assembly-schema';
+export type Attributes = {
+    [key: string]: string | undefined;
+};
+/**
+ * Render an attribute dict to a list of { key, value } pairs
+ */
+export declare function renderAttributes(attributes: Attributes): any[];
+/**
+ * Return the appropriate default port for a given protocol
+ */
+export declare function defaultPortForProtocol(proto: ApplicationProtocol): number;
+/**
+ * Return the appropriate default protocol for a given port
+ */
+export declare function defaultProtocolForPort(port: number): ApplicationProtocol;
+/**
+ * Given a protocol and a port, try to guess the other one if it's undefined
+ */
+export declare function determineProtocolAndPort(protocol: ApplicationProtocol | undefined, port: number | undefined): [ApplicationProtocol | undefined, number | undefined];
+/**
+ * Helper function to default undefined input props
+ */
+export declare function ifUndefined<T>(x: T | undefined, def: T): T;
+/**
+ * Helper function for ensuring network listeners and target groups only accept valid
+ * protocols.
+ */
+export declare function validateNetworkProtocol(protocol: Protocol): void;
+/**
+ * Helper to map a map of tags to cxschema tag format.
+ * @internal
+ */
+export declare function mapTagMapToCxschema(tagMap: Record<string, string>): cxschema.Tag[];
+export declare function parseLoadBalancerFullName(arn: string): string;
+/**
+ * Transforms:
+ *
+ *   arn:aws:elasticloadbalancing:us-east-1:123456789:targetgroup/my-target-group/da693d633af407a0
+ *
+ * Into:
+ *
+ *   targetgroup/my-target-group/da693d633af407a0
+ */
+export declare function parseTargetGroupFullName(arn: string): string;

cdk/node_modules/aws-cdk-lib/aws-elasticloadbalancingv2/lib/shared/util.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.renderAttributes=renderAttributes,exports.defaultPortForProtocol=defaultPortForProtocol,exports.defaultProtocolForPort=defaultProtocolForPort,exports.determineProtocolAndPort=determineProtocolAndPort,exports.ifUndefined=ifUndefined,exports.validateNetworkProtocol=validateNetworkProtocol,exports.mapTagMapToCxschema=mapTagMapToCxschema,exports.parseLoadBalancerFullName=parseLoadBalancerFullName,exports.parseTargetGroupFullName=parseTargetGroupFullName;var enums_1=()=>{var tmp=require("./enums");return enums_1=()=>tmp,tmp},core_1=()=>{var tmp=require("../../../core");return core_1=()=>tmp,tmp},errors_1=()=>{var tmp=require("../../../core/lib/errors");return errors_1=()=>tmp,tmp},literal_string_1=()=>{var tmp=require("../../../core/lib/private/literal-string");return literal_string_1=()=>tmp,tmp};function renderAttributes(attributes){const ret=[];for(const[key,value]of Object.entries(attributes))value!==void 0&&ret.push({key,value});return ret}function defaultPortForProtocol(proto){switch(proto){case enums_1().ApplicationProtocol.HTTP:return 80;case enums_1().ApplicationProtocol.HTTPS:return 443;default:throw new(errors_1()).UnscopedValidationError((0,literal_string_1().lit)`UnrecognizedProtocol`,`Unrecognized protocol: ${proto}`)}}function defaultProtocolForPort(port){switch(port){case 80:case 8e3:case 8008:case 8080:return enums_1().ApplicationProtocol.HTTP;case 443:case 8443:return enums_1().ApplicationProtocol.HTTPS;default:throw new(errors_1()).UnscopedValidationError((0,literal_string_1().lit)`DonTKnowDefaultProtocol`,`Don't know default protocol for port: ${port}; please supply a protocol`)}}function determineProtocolAndPort(protocol,port){return protocol===void 0&&port===void 0?[void 0,void 0]:(protocol===void 0&&(protocol=defaultProtocolForPort(port)),port===void 0&&(port=defaultPortForProtocol(protocol)),[protocol,port])}function ifUndefined(x,def){return x??def}function validateNetworkProtocol(protocol){const NLB_PROTOCOLS=[enums_1().Protocol.TCP,enums_1().Protocol.TLS,enums_1().Protocol.UDP,enums_1().Protocol.TCP_UDP];if(NLB_PROTOCOLS.indexOf(protocol)===-1)throw new(errors_1()).UnscopedValidationError((0,literal_string_1().lit)`MustBeProtocol`,`The protocol must be one of ${NLB_PROTOCOLS.join(", ")}. Found ${protocol}`)}function mapTagMapToCxschema(tagMap){return Object.entries(tagMap).map(([key,value])=>({key,value}))}function parseLoadBalancerFullName(arn){if(core_1().Token.isUnresolved(arn)){const arnParts=core_1().Fn.split("/",arn);return`${core_1().Fn.select(1,arnParts)}/${core_1().Fn.select(2,arnParts)}/${core_1().Fn.select(3,arnParts)}`}else{const resourceName=core_1().Arn.split(arn,core_1().ArnFormat.SLASH_RESOURCE_NAME).resourceName;if(!resourceName)throw new(errors_1()).UnscopedValidationError((0,literal_string_1().lit)`ProvidedDoesBelongLoad`,`Provided ARN does not belong to a load balancer: ${arn}`);return resourceName}}function parseTargetGroupFullName(arn){const resource=core_1().Arn.split(arn,core_1().ArnFormat.NO_RESOURCE_NAME).resource;if(!resource)throw new(errors_1()).UnscopedValidationError((0,literal_string_1().lit)`ProvidedDoesBelongTarget`,`Provided ARN does not belong to a target group: ${arn}`);return resource}