Skip to content

Instantly share code, notes, and snippets.

@jeffmylife

jeffmylife/aws_fargate_docker_application_load_balancer_without_public_ip.md

Forked from jonashaag/aws_fargate_docker_application_load_balancer_without_public_ip.md
Last active September 25, 2020 19:22
Show Gist options
  • Save jeffmylife/a12176c46f797f5c6956f55501275f16 to your computer and use it in GitHub Desktop.
Save jeffmylife/a12176c46f797f5c6956f55501275f16 to your computer and use it in GitHub Desktop.
Download ZIP
AWS Fargate Docker Application Load Balancer How to (without public IP)
Raw
aws_fargate_docker_application_load_balancer_without_public_ip.md

AWS Fargate Docker Simple Deployment Setup with SSL termination

How to:

  • create a Docker-based AWS Fargate/ECS deployment
  • without the Docker containers having a public IP
  • with an Application Load Balancer as reverse proxy / SSL termination proxy sitting in front of the containers

For Fargate/ECS to be able to access your Docker images hosted on ECR (or somewhere else) you'll have to allow outbound internet access to the Fargate subnets. Here's how you do it.

  1. Create a Fargate Cluster with a new VPC with 2 (or more) subnets.

    • Go to ECS -> Clusters -> Create Cluster
    • Select Networking Only (Fargate) -> Create new VPC with 2 subnets at 10.0.0.0/24 & 10.0.1.0/24

  2. Make the 2 subnets created in step 1 private, add 2 new public-facing subnets and bridge them with NAT:

    • Go to VPC -> Subnets -> Create Subnet
    • Create 2 new public-facing subnets in your VPC in the AZ of the subnets auto-created in step 1. For example, if in step 1 2 subnets 10.0.0.0/24 (us-east-1a) and 10.0.1.0/24 (us-east-1b) were created, create 2 new subnets 10.0.2.0/24 (us-east-1a) and 10.0.3.0/24 (us-east-1b).
    • (optional) Name the subnets something like: private-sub-01 (10.0.0.0/24), private-sub-02 (10.0.1.0/24), public-sub-01 (10.0.2.0/24), & public-sub-02 (10.0.3.0/24)
    • Create a NAT gateway for each of the new public-facing subnets (Allocate new Elastic IP for each gateway).
    • Create a new route table for each of the public subnets and add two entries to each table: 10.0.0.0/16 -> local and 0.0.0.0/0 -> igw-xxx (the internet gateway auto-created in step 1).
    • Modify the route tables of each of the subnets auto-created in step 1 as follows: change the target of the 0.0.0.0/0 route to the nat-xxx NAT gateway of the subnet's AZ. In the example above, point.
    • You should now have
      • the private 10.0.0.0/24 subnet's 0.0.0.0/0 route to the NAT gateway in subnet 10.0.2.0/24
      • the private 10.0.1.0/24 subnet's 0.0.0.0/0 route to the NAT gateway in subnet 10.0.3.0/24
      • the public 10.0.2.0/24 subnet's 0.0.0.0/0 route to the Internet gateway from before
      • the public 10.0.2.0/24 subnet's 0.0.0.0/0 route to the Internet gateway from before

  3. Create an Application Load Balancer with the 2 public-facing subnets selected in the "Availability Zones" section.

  4. Create ECR repository and upload your image:

    • Go to ECS, Repositories, Create Repository.
    • Upload your image and remember its tag.

  5. Create Fargate Task Definition(s) for your task(s):

    • Select Fargate type.
    • Select "ecsTaskExecutionRole" as Task Role.
    • Use "awsvpc" networking mode.
    • Press "Add container".
      • Put the URL of your new ECR repository plus the image tag.
      • Leave the "Healthcheck" fields empty unless you know what you're doing. Health checks will be done by the load balancer and will be configured in the next step.

  6. Create a Fargate Service:

    • Select Fargate type.
    • Choose your VPC created in step 1.
    • Select the 2 private subnets created in step 1.
    • Disable "Auto-assign public IP".
    • Choose "Application Load Balancer"
      • Select your load balancer created in step 3.
      • Add your container(s).
      • Choose health check options. Note that these are HTTP-based and different from the container health check options (not) used in step 5.
    • Service discovery is not required for this setup.

  7. When the container is deployed, depending your networking, you can access your deployed service via EC2 -> Networking Interfaces. 2 of the interfaces will be associated with the ALB, where the other 2 are associated to the NAT gateway. The ALB interfaces should have a public IP open. Visit http://<YOUR_IP>:<YOUR_APP_PORT>/ to see the service. If it's timing out, be sure to check the security group inbound rules associated with that Network Interface as you may be blocked.

Related material

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment