How do I access a private Application Load Balancer over the internet?

Short description

To make a private Application Load Balancer reachable from the internet, take one of the following actions to put a public entry point in front of it:

• Use a public Network Load Balancer with the Application Load Balancer as a target.
• Use AWS Global Accelerator with the Application Load Balancer as an endpoint.
• Use Amazon API Gateway with a virtual private cloud (VPC) link.

Resolution

Use a public Network Load Balancer with the Application Load Balancer as a target

To combine Layer 4 and Layer 7 capabilities in a single path, register the Application Load Balancer as a target of the Network Load Balancer to support static IP addresses through Elastic IP addresses. However, there is an added cost for the Network Load Balancer, and you have overhead to manage two load balancers. To review pricing, see Elastic Load Balancing pricing.

Before it sends the request to the backend targets, the internal Application Load Balancer appends the private IP address of the Network Load Balancer to the X-Forwarded-For header. If the client requests already have an X-Forwarded-For header, then the backend targets see both the client IP address and the private IP address of the Network Load Balancer. Otherwise, the backend targets see only the private IP address of the Network Load Balancer. To track client IP addresses, you can also use Amazon Virtual Private Cloud (Amazon VPC) Flow Logs.

Complete the following steps:

1. Create a public Network Load Balancer in your public subnets with an internet scheme.
2. Create a target group. For Choose the target type, choose Application Load Balancer.
3. Register your private Application Load Balancer as the target in the target group.
   Note: AWS resolves the private IP addresses of the Application Load Balancer, and then routes traffic to them.
4. Create a listener on the Network Load Balancer. Add a TCP or TLS listener, such as one on port 443, to forward to the target group.
   Note: Make sure that the Application Load Balancer has a listener with a port and protocol that matches the health check. Also, make sure that the health check path returns an HTTP 200 response.
5. Update the security groups for the private Application Load Balancer. On the listener port, allow inbound traffic from the private IP addresses or subnet CIDR range of the Network Load Balancer.

The Network Load Balancer forwards incoming internet traffic to the private Application Load Balancer. The Application Load Balancer then routes the traffic to your backend targets.

To use AWS CLI, see How do I register an Application Load Balancer behind a Network Load Balancer?

For even traffic distribution, turn on cross-zone load balancing on the Network Load Balancer.

Use Global Accelerator with the Application Load Balancer as an endpoint

Important: The security group of the private Application Load Balancer must allow traffic from Global Accelerator. Use the Global Accelerator IP address ranges, or turn on client IP address preservation and allow the client CIDR ranges.

If you use Global Accelerator with the Application Load Balancer as an endpoint, then the two static anycast IP addresses serve as a single fixed entry point. Global Accelerator routes traffic over the AWS global network to the private Application Load Balancer. It supports and includes AWS Shield Standard protection. This approach also offers less granular traffic control than the Network Load Balancer approach. To review pricing, see AWS Global Accelerator pricing.

It's a best practice to use a standard accelerator for this configuration. Custom routing accelerators support only VPC subnet endpoints that contain Amazon EC2 instances and can't target an Application Load Balancer.

To use a standard accelerator, complete the following steps:

1. Create a standard accelerator. The accelerator provides two static anycast IPv4 addresses. Set the name and the IPv4 address type.
2. Add a listener with the TCP protocol and port 443.
3. Add an endpoint group for your Region, and then set the health check port to 443 and the health check protocol to TCP.
4. Add your private Application Load Balancer as an endpoint in the endpoint group. Make sure that you set the weight.

Use API Gateway with a VPC link

API Gateway forwards requests through the VPC link to the private Application Load Balancer. API Gateway with a VPC link adds authentication, throttling, rate limiting, and API key management. This approach best fits API workloads rather than general web applications. The data size limit for HTTP APIs is 10 MB, and the 30-second integration timeout for API Gateway doesn't suit long-running requests.

The approach uses pay-per-request pricing with no infrastructure to manage. HTTP APIs are more cost-effective than REST APIs for proxy-use cases. To review pricing, see Amazon API Gateway pricing.

Complete the following steps:

1. Create a VPC link that connects API Gateway to your VPC. Set the name, and then select the subnets where the private Application Load Balancer resides.
2. Create an HTTP API, and then set the name.
3. Create a private integration. Set the integration target to the Amazon Resource Name of the Application Load Balancer or Network Load Balancer. Then, select the VPC link that you created.
4. Create a route with the method set to ANY and the path set to /proxy+} and then attach the private integration.
5. Deploy the API to a stage such as prod.
   Example endpoint URL:

   https://api-id.execute-api.region.amazonaws.com/prod/

   Note: Replace api-id with your API ID and region with your Region.