I have this flow:
user => Cloudfront with TLS => ALB with TLS => ECS
I encrypted connection between Cloudfront and ALB.
- Cloudfront has domain MAIN.DOMAIN.NET + TLS cert configured.
- ALB has also domain WEB.DOMAIN.NET + TLS cert (it seems that for ALB HTTPS listener one also needs TLS cert with valid domain name, that's why I added domain also for ALB).
- there is S3 Cloudfront origin for static files, let's say FILES.DOMAIN.NET.
I want Cloudfront in front of ALB, and everything seems to work well. But do I really need custom domain for ALB or did I miss something? It seems overly complex to me (it gets harder to use Cloudformation with my current domain provider).