Question

我正在尝试使用API网关的VPC链接将流量路由到HTTPS上的内部API。但是，VPC链接迫使我将API的负载均衡器从“应用程序”更改为“网络”。

我了解网络负载平衡器位于第4层，因此不会了解HTTPS。

我习惯于使用第7层应用程序负载平衡器。因此，我不确定如何在terraform中配置或确实使用网络负载平衡器。

下面是我在Terraform中配置网络负载平衡器的尝试。健康检查失败，我不确定自己在做什么错。

resource "aws_ecs_service" “app” {
  name = "${var.env}-${var.subenv}-${var.appname}"
  cluster = "${aws_ecs_cluster.cluster.id}"
  task_definition = "${aws_ecs_task_definition.app.arn}"
  desired_count = "${var.desired_app_count}"
  deployment_minimum_healthy_percent = 50
  deployment_maximum_percent = 200
  iam_role = "arn:aws:iam::${var.account}:role/ecsServiceRole"

  load_balancer {
    target_group_arn = "${aws_lb_target_group.app-lb-tg.arn}"
    container_name = "${var.env}-${var.subenv}-${var.appname}"
    container_port = 9000
  }
  depends_on = [
    "aws_lb.app-lb"
  ]
}

resource "aws_lb" “app-lb" {
  name               = "${var.env}-${var.subenv}-${var.appname}"
  internal           = false
  load_balancer_type = "network"
  subnets = "${var.subnet_ids}"
  idle_timeout = 600

  tags {
    Owner = ""
    Env = "${var.env}"
  }
}

resource "aws_lb_listener" “app-lb-listener" {
  load_balancer_arn = "${aws_lb.app-lb.arn}"
  port = 443
  protocol = "TCP"

  default_action {
    type = "forward"
    target_group_arn = "${aws_lb_target_group.app-lb-tg.arn}"
  }
}

resource "aws_lb_target_group" “app-lb-tg" {
  name = "${var.env}-${var.subenv}-${var.appname}"
  port = 443
  stickiness = []

  health_check {
    path = "/actuator/health"
  }

  protocol = "TCP"
  vpc_id = "${var.vpc_id}"
}

作为参考，这是我先前尝试切换到网络负载平衡器之前配置应用程序负载平衡器的方式：

resource "aws_ecs_service" "app" {
  name = "${var.env}-${var.subenv}-${var.appname}"
  cluster = "${aws_ecs_cluster.cluster.id}"
  task_definition = "${aws_ecs_task_definition.app.arn}"
  desired_count = "${var.desired_app_count}"
  deployment_minimum_healthy_percent = 50
  deployment_maximum_percent = 200
  iam_role = "arn:aws:iam::${var.account}:role/ecsServiceRole"

  load_balancer {
    target_group_arn = "${aws_lb_target_group.app-alb-tg.arn}"
    container_name = "${var.env}-${var.subenv}-${var.appname}"
    container_port = 9000
  }
  depends_on = [
    "aws_alb.app-alb"]
}

resource "aws_alb" "app-alb" {
  name = "${var.env}-${var.subenv}-${var.appname}"
  subnets = "${var.subnet_ids}"
  security_groups = [
    "${var.vpc_default_sg}",
    "${aws_security_group.app_internal.id}"]
  internal = false
  idle_timeout = 600
  tags {
    Owner = ""
    Env = "${var.env}"
  }
}

resource "aws_lb_listener" "app-alb-listener" {
  load_balancer_arn = "${aws_alb.app-alb.arn}"
  port = "443"
  protocol = "HTTPS"
  ssl_policy = "ELBSecurityPolicy-2015-05"
  certificate_arn = "${var.certificate_arn}"

  default_action {
    type = "forward"
    target_group_arn = "${aws_lb_target_group.app-alb-tg.arn}"
  }
}

resource "aws_lb_target_group" "app-alb-tg" {
  name = "${var.env}-${var.subenv}-${var.appname}"
  port = 80
  health_check {
    path = "/actuator/health"
  }
  protocol = "HTTP"
  vpc_id = "${var.vpc_id}"   
}

Answer 1

流经它的网络负载平衡器automatically performs passive health checks on non UDP traffic，因此如果足够，则可以删除活动的运行状况检查配置。

如果要启用活动的运行状况检查，则可以使用TCP运行状况检查（默认设置）（仅检查端口是否打开），也可以指定HTTP / HTTPS协议并指定路径。理想情况下，当您尝试为运行状况检查指定路径但未将协议设置为HTTP或HTTPS时，AWS API会出错，但是显然现在不是这种情况。

使用Terraform时，看起来会像这样：

resource "aws_lb_target_group" "app-alb-tg" {
  name     = "${var.env}-${var.subenv}-${var.appname}"
  port     = 443
  protocol = "TCP"
  vpc_id   = "${var.vpc_id}"

  health_check {
    path     = "/actuator/health"
    protocol = "HTTPS"
  }
}

请记住，从网络负载平衡器的角度来看，主动运行状况检查将检查目标端口是否打开（不仅仅是源流量）。这意味着您的目标将需要允许NLB所在的子网以及源流量所源自的安全组或CIDR范围等的流量。

如何配置AWS网络负载均衡器以通过Terraform路由HTTPS通信？

1 个答案: