AWS CDK: Cognito with ApplicationLoadBalancedFargateService

Question

I'd like to secure my webapp running in an ECS Fargate container with Cognito. Using the convenient ecspatterns.ApplicationLoadBalancedFargateService with the Cognito example given at AuthenticateCognitoAction shown at https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-elasticloadbalancingv2-actions.AuthenticateCognitoAction.html is giving me a headache.

I've tried to first create the LoadBalancer shown in the Cognito example and then pass it as the loadBalancer parameter in ApplicationLoadBalancedFargateService constructor. And I've also tried first creating the ApplicationLoadBalancedFargateService and then doing fargateService.loadBalancer.addListener to add the Cognito Listener. Both solutions fail with:

Resource handler returned message: "A listener already exists on this port for this load balancer

What's the correct way of combining these two?

Answer 1

Thanks to this demo stack I found that you:

1. create the Cognito User Pool and Client
2. create ApplicationLoadBalancedFargateService
3. add a AuthenticateCognitoAction to the fargateService listener like this:

    fargateService.listener.addAction('Listener', {
      action: new actions.AuthenticateCognitoAction({
        userPool,
        userPoolClient,
        userPoolDomain,
        next: elbv2.ListenerAction.forward([fargateService.targetGroup]),
      }),
    })