01 Run describe-virtual-gateway command (OSX/Linux/UNIX) using the name of the Amazon App Mesh virtual gateway that you want to examine as the identifier parameter and custom query filters to describe the configuration specifications available for the selected virtual gateway:
aws appmesh describe-virtual-gateway
--region us-east-1
--mesh-name cc-production-app-mesh
--virtual-gateway-name cc-prod-mesh-virtual-gateway
--query 'virtualGateway.spec'
02 The command output should return the requested virtual gateway specifications:
{
"backendDefaults": {
"clientPolicy": {}
},
"listeners": [
{
"portMapping": {
"port": 80,
"protocol": "http"
}
}
],
"logging": {}
}
03 Modify the virtual gateway specifications returned at the previous step to include the Transport Layer Security (TLS) client policy that you want to apply to the specified virtual gateway (highlighted). This overwrites the existing data. The following client policy enforces TLS on all supported upstream ports and uses an AWS Certificate Manager Private Certificate Authority (ACM-PCA) identified by the ARN "arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/abcdabcd-1234-abcd-1234-abcd1234abcd" as validation method. Save the following document to a JSON file named virtual-gateway-tls-specs.json:
{
"backendDefaults": {
"clientPolicy": {
"tls": {
"enforce": true,
"ports": [],
"validation": {
"trust": {
"acm": {
"certificateAuthorityArns": [
"arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/abcdabcd-1234-abcd-1234-abcd1234abcd"
]
}
}
}
}
}
},
"listeners": [
{
"portMapping": {
"port": 80,
"protocol": "http"
}
}
],
"logging": {}
}
04 Run update-virtual-gateway command (OSX/Linux/UNIX) to enforce TLS for the specified Amazon App Mesh virtual gateway, using the configuration specifications defined at the previous step (i.e. virtual-gateway-tls-specs.json):
aws appmesh update-virtual-gateway
--region us-east-1
--mesh-name cc-production-app-mesh
--virtual-gateway-name cc-prod-mesh-virtual-gateway
--spec file://virtual-gateway-tls-specs.json
05 The command output should return the metadata available for the reconfigured virtual gateway:
{
"virtualGateway": {
"meshName": "cc-production-app-mesh",
"metadata": {
"arn": "arn:aws:appmesh:us-east-1:123456789012:mesh/cc-production-app-mesh/virtualGateway/cc-prod-mesh-virtual-gateway",
"createdAt": "2021-01-28T12:00:00.516000+00:00",
"lastUpdatedAt": "2021-01-28T17:00:00.079000+00:00",
"meshOwner": "123456789012",
"resourceOwner": "123456789012",
"uid": "1234abcd-1234-abcd-1234-abcd1234abcd",
"version": 2
},
"spec": {
"backendDefaults": {
"clientPolicy": {
"tls": {
"enforce": true,
"ports": [],
"validation": {
"trust": {
"acm": {
"certificateAuthorityArns": [
"arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/abcdabcd-1234-abcd-1234-abcd1234abcd"
]
}
}
}
}
}
},
"listeners": [
{
"portMapping": {
"port": 80,
"protocol": "http"
}
}
],
"logging": {}
},
"status": {
"status": "ACTIVE"
},
"virtualGatewayName": "cc-prod-mesh-virtual-gateway"
}
}
06 Repeat steps no. 1 – 5 for each App Mesh virtual gateway that you want to reconfigure, created for the specified service mesh.
07 Repeat steps no. 1 – 6 for each App Mesh service mesh available in the selected AWS region
08 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 – 7 to perform the entire remediation process for other regions.
Security