Native ALB-hardening options (S3 access logs, SSL policy, ingress CIDR allowlist) to replace hand-written transforms

[luisdalmolin]

Summary

Consumers hardening the public ALB currently have to hand-write raw transform callbacks for three common concerns. It'd be great to expose first-class options for these so the boilerplate (and the risk of getting the listener/protocol guards wrong) lives in the package instead of every sst.config.ts.

The three concerns, all of which we drive today via web.transform / reverb.transform:

1. ALB access logs to S3

Ship ALB access logs to an S3 bucket via the underlying loadBalancer.accessLogs. Today this needs a transform.loadBalancer callback plus a manually-created bucket, bucket policy (regional ELB service-account grant), public-access block, and lifecycle rule.

Proposed shape:

web: {
  loadBalancerAccessLogs: {
    bucket: myBucket,      // or let the package create + wire the delivery policy
    prefix: 'alb',
    enabled: true,
  },
}

2. Listener SSL policy

Pin a modern TLS policy on HTTPS/TLS listeners (e.g. ELBSecurityPolicy-TLS13-1-2-2021-06) instead of AWS's default, which still permits TLS 1.0/1.1. Today this is a transform.listener callback that has to guard protocol === 'HTTPS' || protocol === 'TLS' itself (an HTTP listener rejects an SSL policy). A sslPolicy option that the package applies only to the TLS-bearing listeners would remove that footgun.

Proposed shape:

web: {
  sslPolicy: 'ELBSecurityPolicy-TLS13-1-2-2021-06',
}

3. Load balancer ingress allowlist (edge CIDRs)

Restrict the LB security group ingress to a fixed set of upstream CIDRs (e.g. Cloudflare edge ranges) so a WAF in front of the ALB can't be bypassed by hitting the ALB hostname directly. The package docstring already shows the loadBalancerSecurityGroup transform as the sanctioned pattern for this — promoting it to an option (that generates both the 443 and the 80→redirect ingress rules from one CIDR list) would cover the common case.

Proposed shape:

web: {
  ingressCidrs: {
    v4: ['173.245.48.0/20', ...],
    v6: ['2400:cb00::/32', ...],
  },
}

Motivation

In our production config, a single shared albTransform (applied to both the web and reverb services) does exactly these three things and nothing else. If they were native options we could delete the whole block. All three are generic ALB-hardening concerns rather than app-specific ones, so they seem like a good fit for the package.

Notes

• Whatever the final API, having the package own the "apply SSL policy only to HTTPS/TLS listeners" and "S3 access logs only work with SSE-S3, never a KMS CMK" details would prevent the two most common ways to get this wrong by hand.
• These should be available on web and reverb (and ideally any load-balanced service) since the same transform is shared across both today.
• Happy to open a PR if the proposed shape sounds reasonable.