EC2 Instance Name/IP in ALB/NLB Access Logs

Question

I have 1 network load balancer (tls traffic) tied to one AWS EKS Cluster and 1 application load balancer tied to a target group of single EC2 instance. I have enabled access logs for both the load balancer using provided AWS documentations. When I inspect the access logs, I did not find any EC2 instance name/public IP to which the traffic is routing to. I got a target IP/port information which does not seems to be the public ip address of the EC2 instance. This I need from an observability standpoint to monitor the webserver traffic to a EC2 instance. Can anyone please help if there are other alternatives or any configurations I am missing ? Thanks in advance.

Answer

The ALB is going to use the private IP address of the instances in the target group, not the public IP. The public IPs are managed at the Internet Gateway that does the public-to-private IP NATing.

Best practice for most architectures has only the ALB in a public subnet with public IPs and the instances sitting in a private subnet without public IPs. If the instances need to request services from public endpoints, we use a NAT gateway to proxy these requests.

Answer

Hi Santosh,
When traffic arrives at your ALB, it gets forwarded to your target group, which is the EC2 instance.
As your ALB and EC2 instance are in the same VPC, the traffic will be sent to the private IP of your EC2.
If it was to use the public IP, the traffic from ALB would need to the leave the VPC, go to the internet, and then come back in. This would add latency to connection, as well as occur data egress costs.
So from an observability point of view, your logs are correct that they are showing the traffic with the private IPs.

Does this answer your question.

EC2 Instance Name/IP in ALB/NLB Access Logs

Relevant content