End-to-end encryption with ECS and ALB

useruaXF 0
Viewed 39

I have three applications deployed in an ECS cluster with an EC2 instance.
Each application has its frontend and its backend.

  • App1 frontend serving port 80 backend serving port 3001
  • App2 frontend serving port 8080 backend serving port 3000
  • App1 frontend serving port 8880 backend serving port 8000

I am using a single task to deploy all the containers. In front of the ECS cluster I have an ALB with host-based rules so I can redirect the traffic to the appropriate container depending on the address the ALB receives (I have three target groups to target the appropriate port), i.e.

  • site1.example.com sent to the target group for port 80
  • site2.example.com sent to the target group for port 8080
  • site3.example.com sent to the target group for port 8880

Now I want to enable encryption in transit from the client to the final container. I tried to do this by requesting a public certificate and modify the listener to use https with this certificate, but this only encrypts the traffic from the client to the ALB.

I read some solutions involving Envoy with sidecar containers, but It seems a bit overcomplicated, also I considered to use Network Load Balancer, but I believe this will not allow me to do the host-based redirection, and I don't want to use addresses like example.com:8080 to reach a website.

Is it possible to achieve this in other ways?

Hope the question make sense.

Thanks in advance!

encryption amazon-ecs containers
1 Answers

You will need to add SSL certificates to your containers, and configure your containers to use them and listen for HTTPS traffic instead of HTTP traffic, and modify the ports in the target group accordingly.

The ALB will not verify the certificates, so the certificates you use on the containers can be self-signed certificates.

Mark B0
Related