refactor(elasticloadbalancingv2): inline TLS policy selection logic

- Remove `getRecommendedTlsPolicy()` helper function and inline feature flag logic directly in listeners
- Update ApplicationListener to calculate SSL policy based on feature flag before calling super()
- Update NetworkListener to calculate SSL policy based on feature flag before calling super()
- Remove test file for feature flag disabled scenario (test-feature-flag-disabled.ts)
- Simplify SSL policy determination by checking `ELB_USE_POST_QUANTUM_TLS_POLICY` feature flag at listener construction time
- This change consolidates TLS policy selection logic and removes unnecessary abstraction layer

Author: pahud

packages/@aws-cdk-testing/framework-integ/test-feature-flag-disabled.ts

@@ -15,7 +15,7 @@ import { propertyInjectable } from '../../../core/lib/prop-injectable';
 import * as cxapi from '../../../cx-api';
 import { BaseListener, BaseListenerLookupOptions, IListener } from '../shared/base-listener';
 import { HealthCheck } from '../shared/base-target-group';
-import { ApplicationProtocol, ApplicationProtocolVersion, TargetGroupLoadBalancingAlgorithmType, IpAddressType, SslPolicy, getRecommendedTlsPolicy } from '../shared/enums';
+import { ApplicationProtocol, ApplicationProtocolVersion, TargetGroupLoadBalancingAlgorithmType, IpAddressType, SslPolicy } from '../shared/enums';
 import { IListenerCertificate, ListenerCertificate } from '../shared/listener-certificate';
 import { determineProtocolAndPort } from '../shared/util';
 
@@ -277,12 +277,17 @@ export class ApplicationListener extends BaseListener implements IApplicationLis
       advertiseTrustStoreCaNames = props.mutualAuthentication.advertiseTrustStoreCaNames ? 'on' : 'off';
     }
 
+    // Calculate SSL policy before calling super()
+    const sslPolicy = props.sslPolicy ?? (protocol === ApplicationProtocol.HTTPS ? 
+      (FeatureFlags.of(scope).isEnabled(cxapi.ELB_USE_POST_QUANTUM_TLS_POLICY) ? 
+        SslPolicy.RECOMMENDED_TLS_PQ : SslPolicy.RECOMMENDED_TLS) : undefined);
+
     super(scope, id, {
       loadBalancerArn: props.loadBalancer.loadBalancerArn,
       certificates: Lazy.any({ produce: () => this.certificateArns.map(certificateArn => ({ certificateArn })) }, { omitEmptyArray: true }),
       protocol,
       port,
-      sslPolicy: props.sslPolicy ?? (protocol === ApplicationProtocol.HTTPS ? getRecommendedTlsPolicy(scope) : undefined),
+      sslPolicy,
       mutualAuthentication: props.mutualAuthentication ? {
         advertiseTrustStoreCaNames,
         ignoreClientCertificateExpiry: props.mutualAuthentication?.ignoreClientCertificateExpiry,
@@ -591,6 +596,8 @@ export class ApplicationListener extends BaseListener implements IApplicationLis
     action.bind(this, this);
     this._setDefaultAction(action);
   }
+
+
 }
 
 /**

packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-listener.ts

@@ -4,13 +4,14 @@ import { NetworkListenerCertificate } from './network-listener-certificate';
 import { INetworkLoadBalancer } from './network-load-balancer';
 import { INetworkLoadBalancerTarget, INetworkTargetGroup, NetworkTargetGroup } from './network-target-group';
 import * as cxschema from '../../../cloud-assembly-schema';
-import { Duration, Resource, Lazy, Token } from '../../../core';
+import { Duration, Resource, Lazy, Token, FeatureFlags } from '../../../core';
 import { ValidationError } from '../../../core/lib/errors';
 import { addConstructMetadata, MethodMetadata } from '../../../core/lib/metadata-resource';
 import { propertyInjectable } from '../../../core/lib/prop-injectable';
+import * as cxapi from '../../../cx-api';
 import { BaseListener, BaseListenerLookupOptions, IListener } from '../shared/base-listener';
 import { HealthCheck } from '../shared/base-target-group';
-import { AlpnPolicy, Protocol, SslPolicy, getRecommendedTlsPolicy } from '../shared/enums';
+import { AlpnPolicy, Protocol, SslPolicy } from '../shared/enums';
 import { IListenerCertificate } from '../shared/listener-certificate';
 import { validateNetworkProtocol } from '../shared/util';
 
@@ -204,11 +205,16 @@ export class NetworkListener extends BaseListener implements INetworkListener {
       throw new ValidationError('Protocol must be TLS when alpnPolicy have been specified', scope);
     }
 
+    // Calculate SSL policy before calling super()
+    const sslPolicy = props.sslPolicy ?? (proto === Protocol.TLS ? 
+      (FeatureFlags.of(scope).isEnabled(cxapi.ELB_USE_POST_QUANTUM_TLS_POLICY) ? SslPolicy.RECOMMENDED_TLS_PQ : SslPolicy.RECOMMENDED_TLS) : 
+      undefined);
+
     super(scope, id, {
       loadBalancerArn: props.loadBalancer.loadBalancerArn,
       protocol: proto,
       port: props.port,
-      sslPolicy: props.sslPolicy ?? (proto === Protocol.TLS ? getRecommendedTlsPolicy(scope) : undefined),
+      sslPolicy: sslPolicy,
       certificates: Lazy.any({ produce: () => this.certificateArns.map(certificateArn => ({ certificateArn })) }, { omitEmptyArray: true }),
       alpnPolicy: props.alpnPolicy ? [props.alpnPolicy] : undefined,
     });
@@ -344,6 +350,8 @@ export class NetworkListener extends BaseListener implements INetworkListener {
     action.bind(this, this);
     this._setDefaultAction(action);
   }
+
+
 }
 
 /**

packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/nlb/network-listener.ts

@@ -1,6 +1,4 @@
-import { Construct } from 'constructs';
-import { FeatureFlags } from '../../../core';
-import * as cxapi from '../../../cx-api';
+
 
 /**
  * What kind of addresses to allocate to the load balancer
@@ -113,7 +111,7 @@ export enum SslPolicy {
    * This policy includes TLS 1.3, and is backwards compatible with TLS 1.2
    * 
    * When feature flag @aws-cdk/aws-elasticloadbalancingv2:usePostQuantumTlsPolicy is enabled,
-   * use getRecommendedTlsPolicy() function to get the post-quantum policy instead.
+   * listeners automatically use the post-quantum policy instead.
    */
   RECOMMENDED_TLS = 'ELBSecurityPolicy-TLS13-1-2-2021-06',
 
@@ -444,15 +442,4 @@ export enum DesyncMitigationMode {
   STRICTEST = 'strictest',
 }
 
-/**
- * Get the recommended TLS policy based on feature flags
- * 
- * @param scope The construct scope to check feature flags against
- * @returns The appropriate SSL policy string
- */
-export function getRecommendedTlsPolicy(scope: Construct): string {
-  if (FeatureFlags.of(scope).isEnabled(cxapi.ELB_USE_POST_QUANTUM_TLS_POLICY)) {
-    return SslPolicy.RECOMMENDED_TLS_PQ;
-  }
-  return SslPolicy.RECOMMENDED_TLS;
-}
+