Questions tagged [amazon-alb]

Amazon Web Services supports three types of Load Balancers. An Application Load Balancer (ALB) functions at the application layer, the seventh layer of the Open Systems Interconnection (OSI) model.

Filter by
Sorted by
Tagged with
0 votes
0 answers
76 views

AWS ALB inbound requests/traffic and denial of wallet attacks

Scenario: I have an AWS ALB protected by AWS WAF with lots of AWS Managed WAF Rules, rate limiting rules, etc. I'm having a hard time in understanding why, even requests blocked by WAF, are impacting ...
1 vote
2 answers
877 views

terraform: Configuring load-balancer to use dynamic port of ECS task/service in AWS

This is sort-of a general question for how dynamic port assignments are supposed to work, though my specific context is trying to figure-out if there is a natural way for a target-group to know the ...
2 votes
1 answer
472 views

AWS ALB health checks of Windows Server 2022 on a HTTP/1 target group works but not with HTTP/2

I have set up an AWS application load balancer with a target group specified to be HTTP/1. The target group contains a single Windows Server 2022 instance running IIS. The health check functionality ...
0 votes
0 answers
20 views

Is there a way to require PKCE for ALB Authetnication?

We're using Okta OIDC to authenticate users to AWS ALB. I've got the basic version working. Is there a way to get it to require Authorization Code with PKCE to improve security? ALB Docs PKCE Docs
2 votes
2 answers
6k views

Nginx container health-check for AWS-ALB

I need to have a health-check path for ALB setup that points to a server which has docker container Nginx. I do not have access inside the EC2 server to add a file there. I can just add something in ...
0 votes
0 answers
131 views

AWS ALB gives 504 timeout when vpc cni network policies applied

I've got argocd deployed on EKS, with ingress running on top of AWS Load Balancer Controller. Alb controller is deployed in kube-system. Argo is deployed in argocd namespace with internal alb created ...
2 votes
2 answers
11k views

Achieving mTLS with AWS ALB

If I have an ALB in my infrastructure with ECS target groups downstream, will SSL/TLS always be terminated at the ALB? If so, are my only options ELB/NLB to preserve the SSL/TLS context?
3 votes
1 answer
5k views

AWS ALB Connection Draining not Closing Connections after Deregistration Delay

I have three instances configured as targets in an ALB. Connection draining is disabled (deregistration delay set to 0 seconds). Sticky sessions are enabled for 5 minutes. I get stuck to one web ...
4 votes
2 answers
8k views

AWS Application Load Balancer (ALB) in single az

We have an environment setup in AWS and would like to have an ALB with targets in only one AZ and that only appears on IP address in the same AZ. This is required because of some routing rules that we ...
0 votes
0 answers
48 views

ALB: Should load-balance health-checks retry on failure?

We have some AWS ECS-based Fargate-hosted tasks/services running behind many ALBs. We seem to frequently get not-meaningful alerts from our own monitoring in our health-checks. It happens every twenty ...
0 votes
0 answers
70 views

Every so often AWS target-groups become unhealthy and ornery

Every so often, I find that a service deployment refuses to complete because target-groups get into an unhealthy state even though the port-assignments are fine and the tasks appear to be fine. Every ...
0 votes
0 answers
101 views

AWS - Setup OIDC authentication in ALB with AWS Beanstalk

I have to setup my application in elastic beanstalk with High availability. My architecture involves a php application running in beanstalk in private subnet with ALB (public subnet) which is also ...
1 vote
2 answers
4k views

AWS ALB for TCP socket connections on a custom port number?

I have an application load balancer (ALB) and a number of web servers behind it. Apart from HTTP and HTTPS, the web servers also serve long-lasting TCP socket connections on port 52345. When a client ...
0 votes
1 answer
65 views

Trying to run Security Onion on AWS behind an ALB (nginx behind ALB)

I've got a wildcard certificate for internal services. I'd like to run Security Onion behind an ALB so I can get valid SSL with a single certificate stored in certificate manager. (Storing it there is ...
0 votes
0 answers
763 views

Set httpOnly and secure flag for AWS ALB cookies

How can I set these flags to true for AWSALBTG & AWSALBTGCORS cookies?
1 vote
1 answer
287 views

AWS Application Load Balancer: how many IPv4 vs IPv6 network interfaces?

Because AWS has started to charge for public IPv4 addresses, I'm looking into how many public IPv4 addresses my Application Load Balancers are using. Right now, they are listening on IPv4 only, and it'...
0 votes
1 answer
142 views

AWS ALB Healthchecks Against ECS Services Periodically Failure For No Discernable Reason

We completely host a constellation of services in AWS (no external dependencies as far as these services go). We periodically receive healthcheck failures (502 as public services try to contact the ...
0 votes
2 answers
1k views

AWS EKS Ingress Timeout On Any Non-Root Path

We have configured an Ingress resource on our EKS cluster with rewrites from /.* on the load balancer to the matching URI upstream. If we visit staging.my-domain.com/, we see a successful health-check ...
0 votes
1 answer
368 views

AWS ALB - Redirect to DNS accessible with Transit Gateway

I have two VPCs: Inbound VPC with CIDR 10.0.0.0/16 (2 public subnets) Private VPC with CIDR 10.1.0.0/16 (Private endpoints) Both are connected with a Transit Gateway and I can resolve the DNS and ...
2 votes
5 answers
7k views

Easier way how to put AWS ALB behind Cloudfront with TLS?

I have this flow: user => Cloudfront with TLS => ALB with TLS => ECS I encrypted connection between Cloudfront and ALB. Cloudfront has domain MAIN.DOMAIN.NET + TLS cert configured. ALB has ...
1 vote
0 answers
623 views

AWS Sticky session cookie not working

I'm using an application load balancer with the target group of two instances. In the target group, I have enabled application based cookie. However whenever I test the load balancer, it keeps ...
2 votes
1 answer
958 views

Are there any benefits in using HTTPS between a load balancer and EC2 targets?

I've spent some time refactoring a load-balanced web application in AWS in order to make it end-to-end HTTPS, CloudFront->ALB->EC2. This was mostly just for fun, to see if I could do it. Having ...
0 votes
0 answers
616 views

Getting 504 response timeouts via AWS ALB, but not directly

Our production environment contains 2 ALBs: a public facing ALB and a private one. Both of these ALBs support HTTP/2. Now I have a target group which supports HTTP/1.1 containing an ECS service. The ...
0 votes
1 answer
2k views

502 bad gateway - aws application load balancer, ecs

I'm having a simple app that I've been experimenting with to learn aws. I first created a http version of a docker image pushed to ecr, ecs using it to create services, and tasks, application load ...
0 votes
1 answer
316 views

How to connect cloudfront and alb?

I am trying to connect to ec2 through ALB through Cloudfront. Currently, the ALB already has one listener associated with cloudfront. So I set a listener with a different port as the origin and set ...
0 votes
1 answer
250 views

How to set request timeouts at every network hop

I'm trying to wrap my head around network timeouts and how they should be set for each hop of a given request. For simplicity, I'm not looking at a breakdown of connect vs. read vs. write timeouts and ...
0 votes
1 answer
1k views

AWS ALB and Cloudfront routing 502

Slight AWS newbie here. I have just taken over a new application in AWS that has an ALB (routes traffic to ECS). The ALB has an SSL certificate and some default DNS records in Route53. I have created ...
0 votes
0 answers
35 views

Restricting one site under Wordpress as Private in AWS ALB

I have configured multiple sites on WordPress and it is connected with internet-faced ALB under AWS. Is it possible to restrict one site as private on ALB? Remaining sites needs an public access. ...
0 votes
1 answer
129 views

How to use ALB Ingress without rewriting every helm chart?

I am trying to use ALB ingress with default helm charts, but struggle to solve simple problems with headers. In Kubernetes ingress-nginx it's easy to add annotations to add headers (CORS), but with ...
1 vote
1 answer
98 views

AWS EC2 not showing a request for IP Issue

My AWS web servers are not showing a request for example '42.26.32.120' after running some athena queries We are unable to identify the cause of the issue, as the IPs is not in any of the access logs ...
2 votes
2 answers
2k views

403 when using Terraform to attach Lambda Function to Target Group w/ ALB

I'm able to create Instances, Target Groups, and ALBs just fine with Terraform, but am getting stuck when trying to use Lambda Functions. It looks like the Lambda function gets created OK along with ...
0 votes
1 answer
736 views

AWS Application Load Balancer: Re-routing requests to non-approved paths

I have a use case where I would like all requests to start with a prefix like: https://WHATEVER/pfx For example https://WHATEVER/pfx/a and https://WHATEVER/pfx/b/c/d But I wish to prevent https://...
0 votes
1 answer
2k views

Remote Desktop Services Gateway behind AWS ALB connectivity issues

I have set up a Remote Desktop Services Gateway behind an AWS ALB. The AWS ALB does the SSL offloading and talks to the RDS Gateway Server via HTTP (port 80). The configuration works and I can RDP ...
0 votes
1 answer
4k views

Secure websocket connection to server running on EC2 fails

I have a node.js websocket server running on an EC2 instance on port 8080. Normal websocket connections (ws://) work fine but when I'm trying to make a secure connection (wss://), the websocket ...
1 vote
1 answer
2k views

Istio : HTTPS Traffic converted to HTTP with port set as 443

Bug description We have setup an istio over on eks cluster & a java app is hosted in it. The pod has been created along with service with type ClusterIP We have created Virtual Service, Gateway &...
1 vote
1 answer
3k views

application load balancer fails to upload large file

I have a bit of a problem. I have a php larvel application that sits on a ec2 linux instance behind an application load balancer. When I try to upload a large file the process fails with no error ...
3 votes
1 answer
2k views

Using ALB to target PHP-FPM ECS containers

I'd love to know if this is actually posible but I'm sure I've seen it demonstrated by one of our old AWS TAMs. I am serving PHP-FPM containers (port 9000) out of ECS hosting a PHP application. I am ...
1 vote
1 answer
618 views

Keycloak w/ EKS + ALB (401 after auth)

I’m currently trying to get Keycloak to run in EKS behind ALB and for the life of me, I can’t get it to work. I get the redirect to a login screen and after I log in - I instantly get presented with ...
2 votes
2 answers
7k views

Restricting access to a specific domain on AWS

Our current setup is ALB -> Target Group -> EC2 instances At the moment it's possible to access the EC2 servers behind the load balancer using the IP address of the ALB, the DNS Name (e.g. ...
1 vote
0 answers
115 views

How to reduce the time it takes a request to pass from a ALB to the actual Fargate Server?

I have a webhook endpoint where our service provider send a payload which I have to respond to within 2 seconds. I've been getting way too many timeout errors from the service provider, meaning I wasn'...
0 votes
0 answers
393 views

In AWS how can I route outbound EC2 traffic through different Internet Gateways depending on the payload?

I have a weird scenario where I need to route certain outbound traffic from an app hosted on EC2 through different regional IP addresses. Long story short we have 2 clients with APIs that our app ...
0 votes
1 answer
826 views

Can you prevent routing traffic to an AWS ALB if the host is an IP address and not a domain name?

I'm running an ALB on AWS with multiple SSL certificates. The domain name is dynamically handled via the application on EC2. Currently, the ALB will route requests to the IP address of the ALB to the ...
0 votes
0 answers
336 views

ALB instead of Cloudfront in front of single server web app

AWS Recommends adding cloudfront in front of single server applications for security and performance see https://aws.amazon.com/blogs/networking-and-content-delivery/dynamic-whole-site-delivery-with-...
0 votes
1 answer
328 views

Direct Traffic from a Pulbic ALB to an Internal ALB for EKS

So I have an EKS cluster sitting in a dedicated VPC (EKS-VPC) In my Main VPC I have a public-facing ALB that I want it to somehow direct traffic to services running in EKS. More specifically I want ...
0 votes
0 answers
532 views

SQS is not working for multiple ECS (fargate) instances

I am using an application load balancer, under this ALB, a target group is provided. In this target group, two fargate ECS instances are running. These two instances use the same PHP docker image. ...
0 votes
0 answers
1k views

How to set multiple listener rules to load balancer in AWS?

I have set multiple listeners and rules for an internet-facing ALB as below The 80 port only redirect to 443. On 443, I set two kinds of different rules with different target groups. If I access /* ...
0 votes
1 answer
270 views

How to design a frontend service in AWS?

In AWS, we deployed a backend service - API in the internal ALB. For frontend(Web UI), it call the API and also needs to be accessed from internal enterprise network. It should be bind to Route53. We ...
0 votes
1 answer
2k views

Cloudfront 502 error with ALB origin in different region

I have a CloudFront which has one of its origins as an application load balancer, this load balancer is available in a different region from the CloudFront which is only available in N.Virginia and is ...
4 votes
1 answer
1k views

Is there a CloudWatch metric that corresponds to ALB data transfer usage/cost?

I have an Application Load Balancer whose data transfer cost I want to monitor. In Cost Explorer, I can filter on usage type "DataTransfer-Out-Bytes", and see how many GB of data it is ...
2 votes
1 answer
36 views

Managing AWS EC2 and RDS autoscalling configuraiton

A client of ours generally can get away with running just the one EC2 and also has an Aurora serverless MySQL 5.7 database running, however there are times when their load spikes up significantly. e.g....