Domain Name for cert for Application LB

When using API Gateway with VPC PrivateLink to connect to an Application Load Balancer (ALB) that routes to EC2 instances, you have options regarding HTTPS and certificates.

Regarding your first question about using HTTPS with certificates:

• While traffic within your VPC is generally considered secure, using HTTPS between your ALB and backend instances adds an extra layer of security.
• If you're handling sensitive data, implementing HTTPS end-to-end (including between the ALB and EC2 instances) is a best practice.
• You can use HTTP between the ALB and EC2 if your security requirements allow it, but HTTPS provides better protection against potential threats within your VPC.

For your second question about certificates and domain names:

• You cannot assign a static or custom DNS name directly to an ALB when creating it. ALBs are assigned a default DNS name by AWS (like the one you have: internal-myapp-1-0-0-alb-1234567.ap-southeast-2.elb.amazonaws.com).
• If you want to use HTTPS, you would need to generate a certificate for the ALB's auto-generated DNS name or use a custom domain.
• For a custom domain approach, you would:

1. Create a custom domain name
2. Associate it with your ALB (typically using Route 53 with an alias record)
3. Request a certificate from AWS Certificate Manager (ACM) for your custom domain
4. Associate this certificate with your ALB

Using a custom domain gives you more flexibility and a cleaner, more memorable endpoint, but it does require additional configuration steps.
Sources
Assign predictable DNS Name or IP address to ALB | AWS re:Post
Create an ACM certificate - Research and Engineering Studio
How to use custom domain name with private API gateway | AWS re:Post