HTTPS and PUSH streaming

Based on your requirements for both HTTPS support and PUSH actions, there are indeed multiple ways to approach this situation. Let's explore the options you've mentioned and provide some additional insights:

1. Single NLB with multiple listeners: This approach is viable and can work well. By using a Network Load Balancer (NLB) with three listeners (TLS:443, TCP:61613, and TCP:61614), you can support both the HTTPS traffic for Android access and the STOMP protocol for PUSH actions. In this scenario, the EC2 instances would need to handle SSL/TLS decryption. This method provides flexibility but puts more responsibility on your EC2 instances for SSL handling.

2. Combination of ALB and NLB: Using an Application Load Balancer (ALB) for HTTPS traffic and an NLB for STOMP is also a good solution. The ALB can handle SSL offloading for your HTTPS traffic, reducing the load on your EC2 instances. The NLB can then manage the STOMP traffic on ports 61613 and 61614. This approach leverages the strengths of both load balancer types.

Additional information:

1. Another option to consider: You could use a single ALB with multiple listeners. ALBs support both HTTPS and TCP listeners. You could configure an HTTPS listener on port 443 for Android access, and TCP listeners on ports 61613 and 61614 for STOMP. This approach would allow you to use a single load balancer while still benefiting from SSL offloading for HTTPS traffic. However, keep in mind that ALBs operate at the application layer, which might introduce slightly more latency compared to an NLB for your STOMP traffic.

2. Setting EC2 to handle SSL/TLS: If you choose to have your EC2 instances handle SSL/TLS decryption, you'll need to install and configure the appropriate SSL certificates on your instances. This typically involves:

• Installing a web server like Apache or Nginx
• Configuring the web server to use HTTPS
• Installing your SSL certificate and private key on the instance
• Configuring your application to use HTTPS

While this can be done through the EC2 dashboard by connecting to your instance and performing these steps manually, it's often more efficient to use automation tools like AWS Systems Manager or user data scripts to handle this configuration.

3. Configuring a domain to access two Load Balancers: To have a domain access two different load balancers simultaneously, you can use DNS routing. Here's how you might approach this:

• Create two subdomains, e.g., "https.yourdomain.com" and "stomp.yourdomain.com"
• Point "https.yourdomain.com" to your ALB's DNS name using a CNAME record
• Point "stomp.yourdomain.com" to your NLB's DNS name using a CNAME record

This way, HTTPS traffic can be directed to the ALB, while STOMP traffic goes to the NLB. Your application would need to be configured to use the appropriate subdomain for each type of traffic.

Remember, when using load balancers, especially with SSL/TLS, it's crucial to properly configure security groups and ensure that your certificates are up-to-date and properly managed. AWS Certificate Manager can be a helpful tool for managing SSL/TLS certificates when using AWS load balancers.
Sources
Use of ALBs route traffic to private services | AWS re:Post
PERF05-BP04 Leverage load-balancing and encryption offloading - AWS Well-Architected Framework (2023-04-10)
Configuring a shared Application Load Balancer - AWS Elastic Beanstalk
Cognito authentication on ALB | AWS re:Post

Hi,

Given the description of your use case, the optimal solution seems to be "Application Load Balancer-type Target Group for Network Load Balancer"

See all details at https://aws.amazon.com/blogs/networking-and-content-delivery/application-load-balancer-type-target-group-for-network-load-balancer/

The synthetic architecture is:

It solves both your DNS and TLS/SSL questions as the Targets described in schema above can be same machines.

Best

Didier

From the definition perspective Network Load Balancer (NLB) operates at layer 4 of the OSI model and supports TCP protocol . Application Load Balancer (ALB) functions at layer 7 (application layer) and supports HTTP and HTTPS protocols . Coming to your requirements ALB can handle HTTPS traffic and perform SSL/TLS termination, routing decrypted traffic to EC2 instances. NLB can handle TCP traffic and supports static IP addresses, making it suitable for SMTP/Winsock PUSH actions. Both ALB and BLB supports, Multiple ports on the same instance, WebSockets, IP addresses as targets, Load balancer deletion protection.

You can also alternatively solve the problem using Route 53 Weighted Routing or subdomain approach. subdomain approach. api.yourdomain.com -> ALB (HTTPS traffic) mqtt.yourdomain.com -> NLB (STOMP traffic)