Load Balancer Integration

Front your service with an Application Load Balancer and a target group.

To serve web traffic, attach your service to an Application Load Balancer (ALB). ECS registers each task's IP in a target group and removes unhealthy ones automatically.

The load balancer sends traffic to a target group; ECS registers and deregisters task IPs as it scales.

How requests flow

A client hits the ALB listener (for example port 443).
A rule forwards to a target group.
The target group load-balances across registered task IPs.

Example

aws ecs create-service \
  --cluster prod --service-name web --task-definition web:3 \
  --desired-count 3 --launch-type FARGATE \
  --load-balancers 'targetGroupArn=arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-tg/abc,containerName=web,containerPort=80' \
  --network-configuration 'awsvpcConfiguration={subnets=[subnet-a,subnet-b],securityGroups=[sg-web]}'

When to use it

A team fronts its ECS service with an ALB so HTTPS is terminated at the load balancer and containers only handle plain HTTP internally.
An ops engineer creates a listener rule on the ALB to route /api/* requests to the API ECS service and /static/* to a separate CDN origin.
A developer configures path-based routing on one ALB to serve five different ECS microservices without needing a separate load balancer for each.

More examples

Create ALB Target Group for ECS

Creates an IP-based target group (required for awsvpc tasks) pointing to port 8080 with a /health health check path.

aws elbv2 create-target-group \
  --name api-tg \
  --protocol HTTP \
  --port 8080 \
  --vpc-id vpc-0abc12345 \
  --target-type ip \
  --health-check-path /health \
  --health-check-interval-seconds 30

Attach Target Group to ECS Service

Creates an ECS service that automatically registers each task's ENI IP with the ALB target group as tasks start and deregisters them when they stop.

aws ecs create-service \
  --cluster prod \
  --service-name api \
  --task-definition api:4 \
  --desired-count 3 \
  --launch-type FARGATE \
  --load-balancers \
    'targetGroupArn=arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/api-tg/abc,containerName=api,containerPort=8080' \
  --network-configuration \
    'awsvpcConfiguration={subnets=[subnet-a,subnet-b],securityGroups=[sg-tasks],assignPublicIp=DISABLED}'

Add HTTPS Listener with SSL Cert

Adds an HTTPS listener on port 443 using a TLS 1.3 security policy and an ACM certificate, forwarding traffic to the ECS target group.

aws elbv2 create-listener \
  --load-balancer-arn arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/prod-alb/abc \
  --protocol HTTPS \
  --port 443 \
  --ssl-policy ELBSecurityPolicy-TLS13-1-2-2021-06 \
  --certificates CertificateArn=arn:aws:acm:us-east-1:123456789012:certificate/xyz \
  --default-actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/api-tg/abc

Discussion

Be the first to comment on this lesson.