How to connect to an internet-facing Application Load Balancer using its internal IP addresses

Question

How can I connect to an internet-facing Application Load Balancer using its internal IP addresses?

**Situation:**
- Multi-Account Setup using a centralized Network Account
- Within the Network Account, there is an internet-facing Application Load Balancer used for our IdP / PingFederate
- Applications hosted in AWS should connect to IdP / Application Load Balancer using its internal IP addresses

**Issue:**
- I am not able find a way on how to resolve the internal IP addresses of the internet-facing Application Load Balancer using a comfortable approach

**What I tested:**
1) Utilize Route53 "Default .2 Resolver" -> Issue: It resolved only to the Public IPs of the ALB
2) Created Private Hosted Zone with my IdP's URL, and create an A Record Alias to my ALB -> Issue: Again, it resolved only to the Public IPs of the ALB
3) Created Private Hosted Zone with my IdP's URL, and create an A Record the internal IPs of the ALB's ENIs -> Issue: Internal IP addresses of an ALB may change, hence this is a setup where I need additional coding (e.g. running a Lambda every few minutes to update my PHZ entries)

Looking for any input that may help.

Tushar_J · Accepted Answer

You can create an internal NLB and configure the ALB as the target, NLB would give you static IPs:

https://docs.aws.amazon.com/elasticloadbalancing/latest/network/application-load-balancer-target.html

How to connect to an internet-facing Application Load Balancer using its internal IP addresses

Relevant content