Moving from NLB to ALB w/o downtime

Answer (1):

In AWS ECS, traffic from network interfaces to ECS tasks is routed through a Network Load Balancer (NLB) and target groups. The NLB is configured with target groups that are associated with listeners. These target groups use IP addresses as the target type. The network interfaces attached to ECS container instances have private IP addresses and are associated with specific ECS tasks. When traffic hits the NLB, it is forwarded to the target group, which routes the traffic to the correct target (network interface) based on its IP address. ECS then uses the IP address to identify the corresponding ECS task and processes the traffic accordingly.

Answer (2):

Having records in a public Route53 hosted zone that point to a private Application Load Balancer (ALB) may seem counterintuitive, but it can be a valid configuration depending on your network setup. When a client outside your network queries the public DNS record, it resolves to the private IP address of the ALB. For this to work, the client needs to be on the same network as the ALB or have a network path that allows it to reach the ALB. This could be achieved through a VPN connection, Direct Connect, or some other networking setup. If the client cannot reach the private ALB, it will indeed time out.