Option 1.
Make your ALB's default target group an empty target group, with no instances. This is a valid configuration.
100% of the requests sent to that target group will always fail, so those requests will be greeted with 503 Service Unavailable
.
Then add a second target group, the "real" one, with the instances attached, and configure the balancer to send only requests matching the desired Host
to that group.
https://serverfault.com/a/868017/153161 is similar, but the opposite of this case, where the default group handles most requests, but the dummy/blackhole target group handles the requests you want to block, resulting in the same behavior -- the blocked requests are never sent to the instances.
Option 2.
Amazon Web Application Firewall (WAF) can also do this, by creating a string matching rule for comparison against the incoming request's Host
header. WAF integrates with ALB.
This setup would probably mean an increased cost, since you would have to pay for WAF ($0.60 per million web requests, not currently available in all regions)... but if you are already using WAF on this ALB for other purposes (rate limiting, XSS, SQL, string matching, etc.), the cost of an additional rule would be neglible or zero, depending on the current configuration.
There's a misconception that your traffic goes "through" WAF, which it doesn't. ALB clones the first few KB from each request and sends a packet to WAF requesting a verdict on whether to allow the request or not. If it passes, the request is allowed, and WAF is not in the traffic loop. If it fails, ALB returns a 403
. If ALB fails to get an answer from WAF at all (e.g. due to a systemic failure) the request is always allowed, which prevents WAF from being a point of failure.
Option 3. (h/t @ceejayoz)
Configure your web servers' virtual hosting behavior with default configuration to return an error response when an unexpected/unknown Host
header in an incoming request. Your server should not respond favorably to such requests, as a matter of best practices.
These options are in no particular order.