fix(ecs-patterns): resolve target group conflict when updating ALB internetFacing or loadBalancerName (under feature flag) #35508

puretension · 2025-09-16T15:53:39Z

fix(ecs-patterns): resolve target group conflict when switching ALB public/private

Issue # (if applicable)

Reason for this change

When switching ApplicationLoadBalancedFargateService from public to private (or vice versa), CloudFormation fails with "target group cannot be associated with more than one load balancer" error. This happens because both old and new load balancers try to use the same target group during replacement.

Updating the loadBalancerName of ApplicationLoadBalancedFargateService can also trigger the same issue.

Description of changes

Modified target group naming in ApplicationLoadBalancedServiceBase to include the load balancer type and name. e.g:

Public load balancer: target group named "ECS"
Private load balancer: target group named "ECSPrivate"
Private load balancer with name "Foo": target group named "ECSFooPrivate"

This ensures each load balancer gets its own target group, preventing conflicts during CloudFormation updates.

⚠️ Destructive Changes

This PR contains intentional destructive changes to fix the target group conflict issue:

Target Group Names Changed, e.g:
- Public ALB: ECS (unchanged)
- Private ALB: ECSPrivate (new)
Impact: When switching from public to private ALB (or vice versa), CloudFormation will:
1. Create new target group with different name
2. Delete old target group
3. This prevents the "target group cannot be associated with more than one load balancer" error
Justification: This is the intended fix for issue (aws_ecs_patterns): ApplicationLoadBalancedFargateService fails to update when switched from public to private - Fails due to target group #33253. The destructive change is necessary to resolve the CloudFormation conflict.

Breaking Change: ❌ No - This only affects the internal target group naming, not user-facing APIs.

Describe any new or updated permissions being added

No new IAM permissions required.

Description of how you validated changes

Added unit tests verifying target group names for both public and private configurations
Created integration test integ.alb-fargate-service-public-private-switch.ts that deploys both public and private ALB services
Verified CloudFormation templates generate different target group names

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

aws-cdk-automation

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

Abogical

Hi @puretension, Thank you for your contribution!

As this PR has breaking (destructive) changes, a feature flag will be needed here. See this guide which will help you add a new feature flag for this PR. This fix will then only take effect when the feature flag is set.

Also, see my comment on setting the ID below.

packages/aws-cdk-lib/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts

Pull request has been modified.

Abogical

Thank you for the quick edit!

Following steps 4-6 in the feature flag guide, the following is needed:

Add an entry for your feature flag in the README file.
In your tests, ensure that you test your feature with and without the feature flag enabled. You can do this by passing the feature flag to the context property when instantiating an App.
const myFeatureFlag = { [cxapi.MY_FEATURE_FLAG]: true };
const app = new App({
   context: myFeatureFlag,
}),
const stackUnderTest = new Stack(app);
In your PR title (which goes into CHANGELOG), add a (under feature flag) suffix. e.g:

fix(core): impossible to use the same physical stack name for two stacks (under feature flag)
context: myFeatureFlag,
}),
const stackUnderTest = new Stack(app);
In your PR title (which goes into CHANGELOG), add a (under feature flag) suffix. e.g:
fix(core): impossible to use the same physical stack name for two stacks (under feature flag)

Pull request has been modified.

puretension · 2025-10-10T14:07:30Z

Thank you for the really quick feedback! I've completed missed steps 4-6.

I added the feature flag documentation to the README, implemented tests for both enabled and disabled scenarios following
your specified pattern, and the PR title already includes the "(under feature flag)" suffix. I really appreciate your
detailed guidance as this is my first CDK contribution.

All changes have been committed and pushed. Please let me know if there's anything else needed!

Abogical · 2025-10-13T08:41:04Z

README.md

+When enabled, ECS patterns will generate unique target group IDs that include the load balancer name and type (public/private). This prevents CloudFormation conflicts when switching between public and private load balancers.
+
+Without this flag, switching an ApplicationLoadBalancedFargateService from public to private (or vice versa) fails with "target group cannot be associated with more than one load balancer" error.
+


This is the wrong README file to edit. The README file to edit is at packages/aws-cdk-lib/cx-api/README.md

@Abogical Thank you for the correction!
I apologize for the basic mistake of editing the wrong README file.😅
I've now moved the feature flag documentation from the root README.md to the correct location at packages/aws-cdk-lib/cx-api/README.md as requested.

I'll be more careful to follow the documentation guidelines precisely in future contributions.
Thank you for your patience and guidance!

Pull request has been modified.

Abogical

Integration test snapshot needs to be updated:

CHANGED    aws-elasticloadbalancingv2-targets/test/integ.alb-target 3.735s
@aws-cdk-testing/framework-integ:       Resources
@aws-cdk-testing/framework-integ:       [-] AWS::ElasticLoadBalancingV2::TargetGroup ServiceLBPublicListenerECSGroup0CC8688C destroy
@aws-cdk-testing/framework-integ:       [+] AWS::ElasticLoadBalancingV2::TargetGroup ServiceLBPublicListenerECSPrivateGroup93D5832E
@aws-cdk-testing/framework-integ:       [~] AWS::ElasticLoadBalancingV2::Listener ServiceLBPublicListener46709EAA
@aws-cdk-testing/framework-integ:        └─ [~] DefaultActions
@aws-cdk-testing/framework-integ:            └─ @@ -1,7 +1,7 @@
@aws-cdk-testing/framework-integ:               [ ] [
@aws-cdk-testing/framework-integ:               [ ]   {
@aws-cdk-testing/framework-integ:               [ ]     "TargetGroupArn": {
@aws-cdk-testing/framework-integ:               [-]       "Ref": "ServiceLBPublicListenerECSGroup0CC8688C"
@aws-cdk-testing/framework-integ:               [+]       "Ref": "ServiceLBPublicListenerECSPrivateGroup93D5832E"
@aws-cdk-testing/framework-integ:               [ ]     },
@aws-cdk-testing/framework-integ:               [ ]     "Type": "forward"
@aws-cdk-testing/framework-integ:               [ ]   }
@aws-cdk-testing/framework-integ:       [~] AWS::ECS::Service Service9571FDD8
@aws-cdk-testing/framework-integ:        ├─ [~] LoadBalancers
@aws-cdk-testing/framework-integ:        │   └─ @@ -3,7 +3,7 @@
@aws-cdk-testing/framework-integ:        │      [ ]     "ContainerName": "nginx",
@aws-cdk-testing/framework-integ:        │      [ ]     "ContainerPort": 80,
@aws-cdk-testing/framework-integ:        │      [ ]     "TargetGroupArn": {
@aws-cdk-testing/framework-integ:        │      [-]       "Ref": "ServiceLBPublicListenerECSGroup0CC8688C"
@aws-cdk-testing/framework-integ:        │      [+]       "Ref": "ServiceLBPublicListenerECSPrivateGroup93D5832E"
@aws-cdk-testing/framework-integ:        │      [ ]     }
@aws-cdk-testing/framework-integ:        │      [ ]   }
@aws-cdk-testing/framework-integ:        │      [ ] ]
@aws-cdk-testing/framework-integ:        └─ [~] DependsOn
@aws-cdk-testing/framework-integ:            └─ @@ -1,5 +1,5 @@
@aws-cdk-testing/framework-integ:               [ ] [
@aws-cdk-testing/framework-integ:               [ ]   "ServiceLBPublicListener46709EAA",
@aws-cdk-testing/framework-integ:               [-]   "ServiceLBPublicListenerECSGroup0CC8688C",
@aws-cdk-testing/framework-integ:               [+]   "ServiceLBPublicListenerECSPrivateGroup93D5832E",
@aws-cdk-testing/framework-integ:               [ ]   "TaskTaskRoleE98524A1"
@aws-cdk-testing/framework-integ:               [ ] ]
@aws-cdk-testing/framework-integ:       [~] AWS::ElasticLoadBalancingV2::TargetGroup NlblistenerTargetsGroupDD2A3CB0
@aws-cdk-testing/framework-integ:        └─ [~] DependsOn
@aws-cdk-testing/framework-integ:            └─ @@ -1,4 +1,4 @@
@aws-cdk-testing/framework-integ:               [ ] [
@aws-cdk-testing/framework-integ:               [ ]   "ServiceLBPublicListener46709EAA",
@aws-cdk-testing/framework-integ:               [-]   "ServiceLBPublicListenerECSGroup0CC8688C"
@aws-cdk-testing/framework-integ:               [+]   "ServiceLBPublicListenerECSPrivateGroup93D5832E"
@aws-cdk-testing/framework-integ:               [ ] ]

Pull request has been modified.

Abogical

Yet another snapshot to be updated. Unfortunately, there can be a lot of snapshots to update especially modifying this package:

CHANGED    aws-ecs-patterns/test/fargate/integ.alb-fargate-service-public-private-switch

Pull request has been modified.

mergify · 2025-10-15T08:25:29Z

This pull request has been removed from the queue for the following reason: pull request branch update failed.

The pull request can't be updated.

You should update or rebase your pull request manually. If you do, this pull request will automatically be requeued once the queue conditions match again.
If you think this was a flaky issue, you can requeue the pull request, without updating it, by posting a @mergifyio requeue comment.

mergify · 2025-10-15T08:27:56Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

Abogical · 2025-10-15T08:28:54Z

@Mergifyio update

mergify · 2025-10-15T08:29:23Z

update

❌ Mergify doesn't have permission to update

For security reasons, Mergify can't update this pull request. Try updating locally.
GitHub response: refusing to allow a GitHub App to create or update workflow .github/workflows/codeql.yml without workflows permission

Abogical · 2025-10-15T08:29:37Z

@Mergifyio rebase

mergify · 2025-10-15T08:30:25Z

rebase

✅ Branch has been successfully rebased

puretension · 2025-10-15T12:17:20Z

@Abogical Thank you so much for your patience, guidance, and approval throughout this entire contribution process! 🙏

The previous CI Codebuild PR Build failure was likely due to the branch being out of sync🤔.
The rebase should have resolved the ESLint issues that were blocking the merge.

Should I change something more for safely merge? Or is there anything else I need to address before this can be merged?

Abogical · 2025-10-15T13:46:20Z

@Abogical Thank you so much for your patience, guidance, and approval throughout this entire contribution process! 🙏

@puretension You're welcome!

The previous CI Codebuild PR Build failure was likely due to the branch being out of sync🤔.
The rebase should have resolved the ESLint issues that were blocking the merge.

Should I change something more for safely merge? Or is there anything else I need to address before this can be merged?

There seems to be a build issue in our workflow that approves PR's. We're working on this atm. Hopefully, when this is resolved, the PR can be merged.

Abogical · 2025-10-15T14:00:18Z

@Mergifyio rebase

…ublic/private Fixes aws#33253

- Add snapshot files for integ.alb-fargate-service-public-private-switch.ts - Includes CloudFormation template showing different target group names - ECS target group for public ALB, ECSPrivate for private ALB

…d-balanced-service-base.ts Co-authored-by: A. Abdel-Rahman <github@abogic.al>

…r feature flag) - Add ECS_PATTERNS_UNIQUE_TARGET_GROUP_ID feature flag - Include loadBalancerName in target group ID when flag is enabled - Prevents CloudFormation conflicts during load balancer replacement - Addresses both internetFacing and loadBalancerName changes Fixes aws#33253 Signed-off-by: puretension <rlrlfhtm5@gmail.com>

Signed-off-by: puretension <rlrlfhtm5@gmail.com>

…tests - Add ECS_PATTERNS_UNIQUE_TARGET_GROUP_ID feature flag documentation to README - Add comprehensive tests for feature flag enabled/disabled/default scenarios - Addresses reviewer feedback for feature flag implementation Signed-off-by: puretension <rlrlfhtm5@gmail.com>

… location Signed-off-by: puretension <rlrlfhtm5@gmail.com>

…naming Updates the integration test snapshot to reflect the new target group naming convention introduced by the feature flag. Private ALB now uses 'ECSPrivate' target group name to prevent CloudFormation conflicts during public/private ALB switching. Signed-off-by: puretension <rlrlfhtm5@gmail.com>

… integration test The integration test for switching between public and private ALB intentionally creates destructive changes to demonstrate the fix for target group conflicts. This is expected behavior when the feature flag is enabled. Signed-off-by: puretension <rlrlfhtm5@gmail.com>

…Destroy Update allowDestroy to use the actual CloudFormation resource names generated by CDK instead of construct IDs. Signed-off-by: puretension <rlrlfhtm5@gmail.com>

- Update allowDestroy list with correct resource IDs - Regenerate snapshots to reflect ECSPrivate target group naming - Fix integration test failures caused by target group name changes Signed-off-by: puretension <rlrlfhtm5@gmail.com>

…GroupId Signed-off-by: puretension <rlrlfhtm5@gmail.com>

mergify · 2025-10-15T14:00:48Z

rebase

✅ Branch has been successfully rebased

github-actions bot added the beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK label Sep 16, 2025

aws-cdk-automation requested a review from a team September 16, 2025 15:53

github-actions bot added bug This issue is a bug. effort/medium Medium work item – several days of effort p1 labels Sep 16, 2025

aws-cdk-automation previously requested changes Sep 16, 2025

View reviewed changes

github-actions bot mentioned this pull request Oct 1, 2025

Monthly PR metrics report #35642

Open

Abogical self-assigned this Oct 10, 2025

Abogical previously requested changes Oct 10, 2025

View reviewed changes

packages/aws-cdk-lib/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts Outdated Show resolved Hide resolved

puretension requested a deployment to test-pipeline October 10, 2025 12:55 — with GitHub Actions Waiting

puretension requested a deployment to test-pipeline October 10, 2025 13:32 — with GitHub Actions Waiting

Abogical previously requested changes Oct 10, 2025

View reviewed changes

puretension changed the title ~~fix(ecs-patterns): resolve target group conflict when switching ALB public/private~~ fix(ecs-patterns): resolve target group conflict when switching ALB public/private (under feature flag) Oct 10, 2025

puretension requested a deployment to test-pipeline October 10, 2025 14:06 — with GitHub Actions Waiting

Abogical previously requested changes Oct 13, 2025

View reviewed changes

puretension requested a deployment to test-pipeline October 13, 2025 08:56 — with GitHub Actions Waiting

Abogical previously requested changes Oct 13, 2025

View reviewed changes

puretension requested a deployment to test-pipeline October 13, 2025 11:09 — with GitHub Actions Waiting

puretension requested a deployment to test-pipeline October 13, 2025 11:44 — with GitHub Actions Waiting

puretension requested a deployment to test-pipeline October 13, 2025 12:19 — with GitHub Actions Waiting

puretension requested a deployment to test-pipeline October 13, 2025 12:57 — with GitHub Actions Waiting

Abogical previously requested changes Oct 13, 2025

View reviewed changes

puretension requested a deployment to test-pipeline October 13, 2025 13:33 — with GitHub Actions Waiting

mergify bot removed the queued label Oct 15, 2025

mergify bot requested a deployment to test-pipeline October 15, 2025 08:26 Waiting

Abogical force-pushed the fix/ecs-patterns-public-private-targetgroup-33253 branch from 9b7336d to e46ee93 Compare October 15, 2025 08:30

Abogical requested a deployment to test-pipeline October 15, 2025 08:31 — with GitHub Actions Waiting

Abogical changed the title ~~fix(ecs-patterns): resolve target group conflict when switching ALB public/private (under feature flag)~~ fix(ecs-patterns): resolve target group conflict when updating ALB internetFacing or loadBalancerName (under feature flag) Oct 15, 2025

puretension and others added 12 commits October 15, 2025 14:00

fix(ecs-patterns): resolve target group conflict when switching ALB p…

4292fb8

…ublic/private Fixes aws#33253

feat: add integration test snapshot for ALB public/private switch

744ecac

- Add snapshot files for integ.alb-fargate-service-public-private-switch.ts - Includes CloudFormation template showing different target group names - ECS target group for public ALB, ECSPrivate for private ALB

Update packages/aws-cdk-lib/aws-ecs-patterns/lib/base/application-loa…

cde1365

…d-balanced-service-base.ts Co-authored-by: A. Abdel-Rahman <github@abogic.al>

fix: remove trailing spaces to fix ESLint errors

e333b09

Signed-off-by: puretension <rlrlfhtm5@gmail.com>

docs(ecs-patterns): move feature flag documentation to correct README…

730ae73

… location Signed-off-by: puretension <rlrlfhtm5@gmail.com>

fix(ecs-patterns): use correct CloudFormation resource names in allow…

7be3ae3

…Destroy Update allowDestroy to use the actual CloudFormation resource names generated by CDK instead of construct IDs. Signed-off-by: puretension <rlrlfhtm5@gmail.com>

fix(ecs-patterns): update feature flag documentation for uniqueTarget…

cb7df73

…GroupId Signed-off-by: puretension <rlrlfhtm5@gmail.com>

Abogical force-pushed the fix/ecs-patterns-public-private-targetgroup-33253 branch from e46ee93 to cb7df73 Compare October 15, 2025 14:00

Abogical requested a deployment to test-pipeline October 15, 2025 14:01 — with GitHub Actions Waiting

		When enabled, ECS patterns will generate unique target group IDs that include the load balancer name and type (public/private). This prevents CloudFormation conflicts when switching between public and private load balancers.

		Without this flag, switching an ApplicationLoadBalancedFargateService from public to private (or vice versa) fails with "target group cannot be associated with more than one load balancer" error.

fix(ecs-patterns): resolve target group conflict when updating ALB internetFacing or loadBalancerName (under feature flag) #35508

Are you sure you want to change the base?

fix(ecs-patterns): resolve target group conflict when updating ALB internetFacing or loadBalancerName (under feature flag) #35508

Conversation

puretension commented Sep 16, 2025 • edited by Abogical Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

⚠️ Destructive Changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Abogical left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Abogical left a comment

Choose a reason for hiding this comment

Uh oh!

puretension commented Oct 10, 2025

Uh oh!

Abogical Oct 13, 2025

Choose a reason for hiding this comment

Uh oh!

puretension Oct 13, 2025

Choose a reason for hiding this comment

Uh oh!

Abogical left a comment

Choose a reason for hiding this comment

Uh oh!

Abogical left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mergify bot commented Oct 15, 2025

Uh oh!

mergify bot commented Oct 15, 2025

Uh oh!

Abogical commented Oct 15, 2025

Uh oh!

mergify bot commented Oct 15, 2025

❌ Mergify doesn't have permission to update

Uh oh!

Abogical commented Oct 15, 2025

Uh oh!

mergify bot commented Oct 15, 2025

✅ Branch has been successfully rebased

Uh oh!

puretension commented Oct 15, 2025

Uh oh!

Abogical commented Oct 15, 2025

Uh oh!

Abogical commented Oct 15, 2025

Uh oh!

mergify bot commented Oct 15, 2025

✅ Branch has been successfully rebased

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

puretension commented Sep 16, 2025 •

edited by Abogical

Loading

aws-cdk-automation left a comment •

edited

Loading

Abogical left a comment •

edited

Loading

Abogical left a comment •

edited

Loading