AWS Load Balancer, Static IP's and SSL termination on the server (not load balancer)

2
votes

The Goal: Assign Elastic/static IP's to Load Balancer (LB) to serve EC2 Instances that process DNS (port 53), HTTPS (port 443), HTTP (port 80).

Static IP's are needed to correctly configure DNS records (namely A Records). TLS termination on the backend/server is needed to serve an unlimited & ever changing amount of SSL Certificate's, hence avoiding Amazon Certificate Manager (ACM) as it has limits.

A Classic Load Balancer would allow custom security rules and permit SSL termination on the EC2 Instances. The problem being that Static IP's cannot be assigned to a Classic LB, only to individual instances within it, which doesn't balance the load.

To have static IP’s assigned we could use an Application Load balancer (ALB) with Global Accelerator or a Network Load balancer (NLB); but they both force TLS termination and prevent the instances from serving SSL certs.

Am I missing a slice? I don't even want to eat the cake, I want to share it around. Does anyone have a solution?

1
amazon-web-servicessslamazon-ec2amazon-elb

1 Answers

3
votes

Use the Network Load Balancer. It would be configured the following way:

  • DNS - Either UDP or TCP listener depending on how its used.
  • HTTP - A TCP Listener
  • HTTPS - A TCP Listener

Yes the Network load balancer does support a TLS listener for SSL termination, but you can use the TCP Listener to have the servers become responsible for SSL termination.

You would attach a static IP address for each availability zone for your Network Load Balancer.