aws-cdk-lib/aws-ecs-patterns: ALB services, option to only forward requests with the expected host

Describe the feature

Option to only forward requests where the host header matches the domainName set for the ApplicationLoadBalanced(Ec2/Fargate)Service.

Use Case

We noticed we were getting lots of requests hitting the workload with the wrong host header. This is because, even though we are setting the domain name (https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ecs_patterns.ApplicationLoadBalancedEc2Service.html#domainname), the ALB still forwards everything to the workload.

Proposed Solution

My suggestion is for an option like enforceHostHeader?: boolean that, if set, changes the rules on the ALB listener to be:

if host header matches the domainName, then forward to the target group
default action: serve a 400 bad request

This differs from the default listener behaviour which is just:

default action: forward to the target group

I suppose there's a case to be made that enforceHostHeader: true should be the default behaviour when domainName is set, but this would be a breaking change.

Other Information

I have escape-hatched this as follows:

const myDomainName = 'mydomain.example.com';
const myService = new ecsPatterns.ApplicationLoadBalancedEc2Service(this, `MyService`, {
    // ...
    domainName: myDomainName,
    openListener: true,
    protocol: elbv2.ApplicationProtocol.HTTPS,
    redirectHTTP: true,
});

myService.listener.addAction('ForwardIfMatchingDomain', {
    priority: 10,
    conditions: [
        elbv2.ListenerCondition.hostHeaders([myDomainName]),
    ],
    action: elbv2.ListenerAction.forward([myService.targetGroup]),
});
const cfnListener = myService.listener.node.defaultChild as elbv2.CfnListener;
cfnListener.addPropertyOverride('DefaultActions', [{
    Type: 'fixed-response',
    FixedResponseConfig: {
        ContentType: 'text/plain',
        MessageBody: 'Bad Request',
        StatusCode: '400',
    },
}]);

Acknowledgements

[X] I may be able to implement this feature request
[ ] This feature might incur a breaking change

CDK version used

2.54.0

Environment details (OS name and version, etc.)

n/a

aws / aws-cdk