From 78a7182c2a262fe4f635deb103be8757e5a20efc Mon Sep 17 00:00:00 2001
From: Ashish Dhingra <67916761+ashishdhingra@users.noreply.github.com>
Date: Mon, 14 Oct 2024 12:08:29 -0700
Subject: [PATCH] chore(elasticloadbalancingv2): add details about Network Load
 Balancer and EC2 IConnectable interface. (#31704)

### Issue # (if applicable)

Closes #31644.

### Reason for this change
User reported that using `connections` with NLB without security group specified, doesn't create security group automatically. NLB do not have security groups, and no automatic security group configuration is done.

### Description of changes
Add details about Network Load Balancer and EC2 `IConnectable` interface.

### Description of how you validated changes



### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 .../aws-elasticloadbalancingv2/README.md        | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/packages/aws-cdk-lib/aws-elasticloadbalancingv2/README.md b/packages/aws-cdk-lib/aws-elasticloadbalancingv2/README.md
index 9704a114eb53b..7809f6f97dcfd 100644
--- a/packages/aws-cdk-lib/aws-elasticloadbalancingv2/README.md
+++ b/packages/aws-cdk-lib/aws-elasticloadbalancingv2/README.md
@@ -422,6 +422,23 @@ const listener = lb.addListener('Listener', {
 });
 ```
 
+### Network Load Balancer and EC2 IConnectable interface
+Network Load Balancer implements EC2 `IConnectable` and exposes `connections` property. EC2 Connections allows manage the allowed network connections for constructs with Security Groups. This class makes it easy to allow network connections to and from security groups, and between security groups individually. One thing to keep in mind is that network load balancers do not have security groups, and no automatic security group configuration is done for you. You will have to configure the security groups of the target yourself to allow traffic by clients and/or load balancer instances, depending on your target types.
+
+```ts
+declare const vpc: ec2.Vpc;
+declare const sg1: ec2.ISecurityGroup;
+declare const sg2: ec2.ISecurityGroup;
+
+const lb = new elbv2.NetworkLoadBalancer(this, 'LB', {
+  vpc,
+  internetFacing: true,
+  securityGroups: [sg1],
+});
+lb.addSecurityGroup(sg2);
+lb.connections.allowFromAnyIpv4(ec2.Port.tcp(80));
+```
+
 ## Targets and Target Groups
 
 Application and Network Load Balancers organize load balancing targets in Target