Skip to content

Instantly share code, notes, and snippets.

@AugustoCalaca

AugustoCalaca/aws_fargate_docker_application_load_balancer_without_public_ip.md

Forked from jonashaag/aws_fargate_docker_application_load_balancer_without_public_ip.md
Created December 28, 2021 21:24
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save AugustoCalaca/1ac16de7180aef5f472df80183e9a1e3 to your computer and use it in GitHub Desktop.
Save AugustoCalaca/1ac16de7180aef5f472df80183e9a1e3 to your computer and use it in GitHub Desktop.
Download ZIP
AWS Fargate Docker Application Load Balancer Howto (without public IP)
Raw
aws_fargate_docker_application_load_balancer_without_public_ip.md

AWS Fargate Docker Simple Deployment Setup with SSL termination

How to:

  • create a Docker-based AWS Fargate/ECS deployment
  • without the Docker containers having a public IP
  • with an Application Load Balancer as reverse proxy / SSL termination proxy sitting in front of the containers

For Fargate/ECS to be able to access your Docker images hosted on ECR (or somewhere else) you'll have to allow outbound internet access to the Fargate subnets. Here's how you do it.

  1. Create a Fargate Cluster with a new VPC with 2 (or more) subnets.
  2. Make the 2 subnets created in step 1 private, add 2 new public-facing subnets and bridge them with NAT:
    • Create 2 new public-facing subnets in your VPC in the AZ of the subnets auto-created in step 1. For example, if in step 1 2 subnets 10.0.0.0/24 (us-east-1a) and 10.0.1.0/24 (us-east-1b) were created, create 2 new subnets 10.0.2.0/24 (us-east-1a) and 10.0.3.0/24 (us-east-1b).
    • Create a NAT gateway in each of the new public-facing subnets (new EIP for each gateway).
    • Create a new route table for each of the new subnets and add two entries to each table: 10.0.0.0/16 -> local and 0.0.0.0/0 -> igw-xxx (the internet gateway auto-created in step 1).
    • Modify the route tables of each of the subnets auto-created in step 1 as follows: change the target of the 0.0.0.0/0 route to the nat-xxx NAT gateway of the subnet's AZ. In the example above, point
      • the 10.0.0.0/24 subnet's 0.0.0.0/0 route to the NAT gateway in subnet 10.0.2.0/24
      • the 10.0.1.0/24 subnet's 0.0.0.0/0 route to the NAT gateway in subnet 10.0.3.0/24.
    • You should now have
      • 2 new public-facing subnets routing 0.0.0.0/0 to an internet gateway
      • 2 private subnets routing 0.0.0.0/0 to a NAT gateway in the same AZ.
  3. Create an Application Load Balancer with the 2 new public-facing subnets selected in the "Availability Zones" section.
  4. Create ECR repository and upload your image:
    • Go to ECS, Repositories, Create Repository.
    • Upload your image and remember its tag.
  5. Create Fargate Task Definition(s) for your task(s):
    • Select Fargate type.
    • Select "ecsTaskExecutionRole" as Task Role.
    • Use "awsvpc" networking mode.
    • Press "Add container".
      • Put the URL of your new ECR repository plus the image tag.
      • Leave the "Healthcheck" fields empty unless you know what you're doing. Health checks will be done by the load balancer and will be configured in the next step.
  6. Create a Fargate Service:
    • Select Fargate type.
    • Choose your VPC created in step 1.
    • Select the 2 private subnets created in step 1.
    • Disable "Auto-assign public IP".
    • Choose "Application Load Balancer"
      • Select your load balancer created in step 3.
      • Add your container(s).
      • Choose health check options. Note that these are HTTP-based and different from the container health check options (not) used in step 5.
    • Service discovery is not required for this setup.
  7. Done!

Related material

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment