Admin user actions (ECS WebSockets / CJIS)
Purpose
On CJIS deployments, live features such as Playground, Agents, and NL2SQL do not use the default API Gateway WebSocket path. Instead they connect through ECS-backed WebSocket endpoints (wss://) behind a dedicated Application Load Balancer (ALB).
Complete the following required post-deploy / enablement actions before users rely on Playground, Agents, or NL2SQL on CJIS.
User Actions
1. Certificate & Domain
ACM certificate and Custom Domain need to be provided.
| What | What it is | Where it is used |
|---|---|---|
| Custom Domain | A hostname (for example, ws.example.com) | Used as the address in WebSocket URLs. Stored as playgroundwsurl, agentswsurl, and nl2sqlwsurl. The UI opens connections to this hostname. |
| ACM certificate | An SSL/TLS certificate from AWS Certificate Manager for that same hostname | Attached to the WebSocket load balancer so browser connections stay secure (wss:// / HTTPS). |
In short: the custom domain is the name users connect to; the certificate proves that name is trusted.
2. DNS Records
A DNS record needs to be created for the Custom Domain in the Hosted Zone so that resolution happens. The record name should be the Custom Domain provided by the user, and the record value should be set to the WebSocketAlbDnsName found in the WebSocket stack's Outputs.
3. Security Group
The ALB security group's inbound rules need to be edited to allow the required client access, with the following configuration:
| Setting | Value |
|---|---|
| Type | HTTPS |
| Protocol | TCP |
| Port range | 443 |
| Source | IPv4, set to the approved IP address(es) |
Verify
After these steps, confirm that the following endpoints match the SSM values (playgroundwsurl, agentswsurl, nl2sqlwsurl):
wss://<custom-domain>/ws/playgroundwss://<custom-domain>/ws/agentswss://<custom-domain>/ws/nl2sql
Once certificate, DNS, and security group access are in place and these URLs resolve correctly, browsers can open the CJIS WebSocket sessions used by Playground, Agents, and NL2SQL. If a connection still fails, recheck that the custom domain certificate is attached, DNS points to 'WebSocketAlbDnsName', and the ALB security group allows the client's IP on HTTPS 443.
Under a load of 100 concurrent users over 10 minutes:
- Non-CJIS WebSocket sessions averaged about 45 seconds latency.
- CJIS WebSocket sessions averaged 67.5 seconds latency, with no connections dropped.