EC2 accessed by an NLB via ALB

While it's possible to use an existing ALB and NLB in your architecture, there are some important considerations to keep in mind.

First, it's important to note that the typical architecture for combining NLB and ALB is to have the NLB in front of the ALB, not the other way around. This is because NLBs operate at the transport layer (Layer 4) and can handle TCP traffic, while ALBs operate at the application layer (Layer 7) and are designed for HTTP/HTTPS traffic.

In your case, if you have a properly working ALB with HTTPS, and you want to add an NLB in front of it, you could potentially do this. However, you cannot directly add the ALB as a target group to the NLB. Instead, you would need to:

1. Create a target group for your NLB that uses IP addresses as targets.
2. Add the private IP addresses of the ALB nodes to this target group.

Keep in mind that ALBs do not have static IP addresses, so you would need to update the NLB target group if the ALB's IP addresses change.

Also, when using this setup:

• The NLB should listen on TCP (not TLS) and forward traffic to the ALB.
• The ALB should be configured to use HTTPS listeners.
• Your EC2 instances should be registered as targets behind the ALB, not the NLB.

This configuration allows the NLB to handle the initial TCP connection and then pass the traffic to the ALB, which can then perform SSL termination, apply any necessary routing rules, and forward the requests to your EC2 instances.

However, it's worth noting that this setup adds complexity and an additional network hop. Unless you have a specific requirement for using both an NLB and ALB (such as needing static IP addresses provided by the NLB), it might be simpler and more efficient to use just the ALB for your HTTPS traffic to EC2 instances.

Always consider your specific use case and requirements when deciding on the most appropriate architecture.

Sources
NLB IP target for ALB | AWS re:Post
Use of ALBs route traffic to private services | AWS re:Post