Internal ALB in a VPC with no public subnets

2
votes

Just a couple conceptual questions about internal ALBs.

  1. For example, a VPC is created with two private subnets in two AZs, and there is no public subnets or NAT Gateway or Internet Gateway. Is it possible to have an internal application load balancer that's going to talk to Fargate containers hosted inside the private subnets? The VPC endpoints are created for the Fargate container in order to talk to CloudWatch, DynamoDB, S3, etc. I'm wondering, without a public subnet/NAT Gateway, how can the request get routed to the internal application load balancer?

  2. On AWS::ElasticLoadBalancingV2::LoadBalancer, for the attribute Subnets, the documentation says provide the IDs of the public subnets. I'm sure the IDs for the private subnets should work here too. Why is the documentation confusing this point here?

Thank you very much.

1
amazon-ecsamazon-elbvpcaws-fargate

1 Answers

0
votes

For this purpose, you use only subnets not enough, you need to use security group too. Follow the diagram below:

enter image description here

You can find your answer here