ALB and HTTPS for Containers
An Application Load Balancer routes HTTPS traffic to healthy tasks and terminates TLS.
An Application Load Balancer (ALB) is the front door for a containerized service. It accepts HTTPS on port 443, terminates TLS with an ACM certificate, and forwards requests to healthy tasks.
Key concepts
- Listener — what the ALB listens on (443 HTTPS), plus the certificate.
- Target group — the pool of tasks receiving traffic, with a health check path.
- Health checks — the ALB polls each task (e.g.
GET /healthz) and only routes to those returning 200.
Because the ALB knows which tasks are healthy, it enables rolling and blue-green deploys with no dropped requests.
Example
# Create an HTTPS listener that forwards to the app target group
aws elbv2 create-listener \
--load-balancer-arn arn:aws:elasticloadbalancing:...:loadbalancer/app/myapp/abc \
--protocol HTTPS --port 443 \
--certificates CertificateArn=arn:aws:acm:us-east-1:...:certificate/xyz \
--default-actions Type=forward,TargetGroupArn=arn:aws:...:targetgroup/myapp-tg/123When to use it
- A team puts an ALB in front of ECS Fargate tasks to terminate HTTPS, distribute load, and run health checks without touching the containers.
- An ops engineer configures an ALB listener rule to route /api/* requests to the API service and /* to the frontend service on the same domain.
- A company uses ALB sticky sessions to ensure a stateful legacy app always routes a user's requests to the same container instance.
More examples
Create ALB with HTTPS listener
Creates an internet-facing ALB and attaches an HTTPS listener using an ACM certificate, forwarding to a target group.
ALB_ARN=$(aws elbv2 create-load-balancer \
--name myapp-alb \
--subnets subnet-aaa subnet-bbb \
--security-groups sg-alb \
--query 'LoadBalancers[0].LoadBalancerArn' \
--output text)
aws elbv2 create-listener \
--load-balancer-arn $ALB_ARN \
--protocol HTTPS --port 443 \
--certificates CertificateArn=arn:aws:acm:us-east-1:123456789012:certificate/abc \
--default-actions Type=forward,TargetGroupArn=$TG_ARNCreate target group for ECS tasks
Creates a target group that expects Fargate task IPs on port 3000 and health-checks the /health endpoint.
aws elbv2 create-target-group \
--name myapp-tg \
--protocol HTTP \
--port 3000 \
--vpc-id vpc-0abc123 \
--target-type ip \
--health-check-path /health \
--health-check-interval-seconds 30Register Fargate service with ALB
Creates an ECS service linked to the ALB target group so the load balancer automatically routes to healthy tasks.
aws ecs create-service \
--cluster prod \
--service-name myapp \
--task-definition myapp:1 \
--desired-count 2 \
--launch-type FARGATE \
--load-balancers "targetGroupArn=$TG_ARN,containerName=myapp,containerPort=3000" \
--network-configuration 'awsvpcConfiguration={subnets=[subnet-aaa],securityGroups=[sg-tasks],assignPublicIp=DISABLED}'
Discussion