nlb listening to the port port 443/tls and 80/tcp same time ?

[sebastianovide]

following https://aws.github.io/copilot-cli/docs/manifest/lb-web-service/#nlb-additional-listeners (and Copilot Roadmap 🗺️) it seems that 1 container can listen to the port 80 and 443 at the same time... but it seems that cannot use different protocols (with a simple docker listening to the port 80)

nlb:
  port: 443/tls
  target_port: 80
  additional_listeners:
    - port: 80

error: validate manifest against environment "dev": validate unique exposed ports: validate "nlb.additional_listeners[0]": container "web-ping" is exposing the same port 80 with protocol TCP and TLS

ideas?

[CaptainCarpensir]

I can explain this!

The field port by default specifies the port that the load balancer listens on, as well as the port it routes traffic to on the container. The field target_port then overrides this value for the port the container is listening on.

This means that in your example the load balancer has port 443 exposed with TLS and port 80 exposed with TCP (ok), and the container is listening to port 80 with both TCP and TLS (causes the error). There is one thing I'm curious about though, and it's that because TLS just wraps TCP communication, I don't remember if TLS is terminated at the load balancer or not. If so, this actually shouldn't be an error because all the container would ever see is TCP. I'm going to do a double check and get back to you on that!

[CaptainCarpensir]

To fix this in the short term though, you can specify a target_port for the additional listener listening to a port other than 80.

[sebastianovide]

@CaptainCarpensir , but that means that I have to change Docker to listen to two different ports, correct? (I'd simply would need a NLB that listens to 443 and 80 and forwards the traffic to the app in Docker in the 80 port..)

[CaptainCarpensir]

Yeah that's the case right now, but I was right that the protocol that reaches container is TCP. This means it's a bug in the validation that we can fix, but the short term solution is to have Docker listen on two ports.

[iamhopaul123]

Hello! The fix is now released in v1.32.1: https://github.com/aws/copilot-cli/releases/tag/v1.32.1