Deploying and using AWS ALB — Application Load balancers

This document covers the high level overview of how to deploy and use AWS application load balancer.

A good read on load balancing can be found here

Image credits — AWS Official Docs

Demo use case:

• Applications running on private subnets need to be load balanced across multiple availability zone using an application LB, should be accessible from the internet.

Architecture designed:

Architecture diagram — high level

Components

• EC2 Machines are deployed in private subnets across multiple DB
• EC2 Machine deployed in public subnet — used as a jump host to administer EC2s on the private subnet
• NAT gateway deployed for enabling internet access to the EC2 machines on private subnet (Downloading needed packages) — can be removed once machines are fully configured.
• Internet gateway — gateway to the internet — attached to the VPC
• ALB — for load balancing the webservice (End point accessible to the public)

Steps:

Explains how the above setup can be achieved with a new VPC

1. Create a new VPC of any name (your choice) under the desired region, ensure to give proper CIDR range, eg : 10.10.0.0/16
2. Create needed subnets

• A public subnet for keeping the jump host and NAT gateway
• A private subnet in AZ1 (eg us-east-1a) for running one webserver instance
• A private subnet in AZ2(eg us-east-1b) for running another instance for webserver
• A public subnet for the LB node (should match with the AZ for the web instance1)
• A public subnet for the LB Node (should match with the AZ for the web instance2)

subnets needed

3. Create route table — for attaching to resources in public and private subnets

Route table for Private subnets (Default route to NAT GW):

Private route table routes

Route table for Public subnets(Default route to IGW):

Public route table routes

VPC resource map:

VPC resource map

4. Create security group rules and attach with EC2 Instances (Default NACL kept)

• For the EC2 machine acting as Jump host — Allow port 22 access (Inbound) from all (0.0.0.0./0) or provide your public IP, also either keep the default outbound rule or allow port 22 access to the EC2 machines in private subnets
• For the EC2 machine in the Private subnets — Allow port 22 access (Inbound) from the jump host, also allow port 80/443 access (inbound), also keep the Outbound access to 80/443 for downloading the packages
• For LB, Allow 80/443 access (Inbound)

For the demo purpose, created a single security group and attached with all the resources:

Inbound:

generic inbound SGs rules

Outbound:

generic outbound SGs rules

5. Create EC2 instances in the subnets defined with the security groups needed for it

6. Install Nginx on the webserver instance and if needed modify the /usr/share/nginx/html/index.html with custom messages (will help in final validation for load balancing.)

7. Create target groups with the webserver instances

target group configuration

8. Deploy Application LB with the needed listeners that points to the created target group

ALB config

With the DNS name, validate the application reachability:

[embed]