如何配置 AWS 网络负载均衡器以使用 Terraform 路由 HTTPS 流量?

Question

我正在尝试使用 API 网关的 VPC 链接将流量路由到 HTTPS 上的内部 API。 但是，VPC 链接迫使我将 API 的负载均衡器从"应用程序"更改为"网络"。

我知道网络负载均衡器位于第 4 层，因此不会知道 HTTPS。

我习惯于使用第 7 层应用程序负载均衡器。因此，我不确定我应该如何在 terraform 中配置或使用网络负载均衡器。

以下是我在 Terraform 中配置网络负载均衡器的尝试。 运行状况检查失败，我不确定我做错了什么。

resource "aws_ecs_service" “app” {
name = "${var.env}-${var.subenv}-${var.appname}"
cluster = "${aws_ecs_cluster.cluster.id}"
task_definition = "${aws_ecs_task_definition.app.arn}"
desired_count = "${var.desired_app_count}"
deployment_minimum_healthy_percent = 50
deployment_maximum_percent = 200
iam_role = "arn:aws:iam::${var.account}:role/ecsServiceRole"
load_balancer {
target_group_arn = "${aws_lb_target_group.app-lb-tg.arn}"
container_name = "${var.env}-${var.subenv}-${var.appname}"
container_port = 9000
}
depends_on = [
"aws_lb.app-lb"
]
}
resource "aws_lb" “app-lb" {
name               = "${var.env}-${var.subenv}-${var.appname}"
internal           = false
load_balancer_type = "network"
subnets = "${var.subnet_ids}"
idle_timeout = 600
tags {
Owner = ""
Env = "${var.env}"
}
}
resource "aws_lb_listener" “app-lb-listener" {
load_balancer_arn = "${aws_lb.app-lb.arn}"
port = 443
protocol = "TCP"
default_action {
type = "forward"
target_group_arn = "${aws_lb_target_group.app-lb-tg.arn}"
}
}
resource "aws_lb_target_group" “app-lb-tg" {
name = "${var.env}-${var.subenv}-${var.appname}"
port = 443
stickiness = []
health_check {
path = "/actuator/health"
}
protocol = "TCP"
vpc_id = "${var.vpc_id}"
}

作为参考，以下是我之前在尝试切换到网络负载均衡器之前配置应用程序负载均衡器的方式：

resource "aws_ecs_service" "app" {
name = "${var.env}-${var.subenv}-${var.appname}"
cluster = "${aws_ecs_cluster.cluster.id}"
task_definition = "${aws_ecs_task_definition.app.arn}"
desired_count = "${var.desired_app_count}"
deployment_minimum_healthy_percent = 50
deployment_maximum_percent = 200
iam_role = "arn:aws:iam::${var.account}:role/ecsServiceRole"
load_balancer {
target_group_arn = "${aws_lb_target_group.app-alb-tg.arn}"
container_name = "${var.env}-${var.subenv}-${var.appname}"
container_port = 9000
}
depends_on = [
"aws_alb.app-alb"]
}
resource "aws_alb" "app-alb" {
name = "${var.env}-${var.subenv}-${var.appname}"
subnets = "${var.subnet_ids}"
security_groups = [
"${var.vpc_default_sg}",
"${aws_security_group.app_internal.id}"]
internal = false
idle_timeout = 600
tags {
Owner = ""
Env = "${var.env}"
}
}
resource "aws_lb_listener" "app-alb-listener" {
load_balancer_arn = "${aws_alb.app-alb.arn}"
port = "443"
protocol = "HTTPS"
ssl_policy = "ELBSecurityPolicy-2015-05"
certificate_arn = "${var.certificate_arn}"
default_action {
type = "forward"
target_group_arn = "${aws_lb_target_group.app-alb-tg.arn}"
}
}
resource "aws_lb_target_group" "app-alb-tg" {
name = "${var.env}-${var.subenv}-${var.appname}"
port = 80
health_check {
path = "/actuator/health"
}
protocol = "HTTP"
vpc_id = "${var.vpc_id}"   
}

Answer 1

网络负载均衡器会自动对流经它的非 UDP 流量执行被动运行状况检查，因此如果这足够了，您只需删除主动运行状况检查配置即可。

如果要启用主动运行状况检查，则可以使用 TCP 运行状况检查(默认(，它只会检查端口是否已打开，也可以指定 HTTP/HTTPS 协议并指定路径。理想情况下，当您尝试指定运行状况检查的路径但不将协议设置为 HTTP 或 HTTPS 时，AWS API 会出错，但显然现在情况并非如此。

使用Terraform，这看起来像这样：

resource "aws_lb_target_group" "app-alb-tg" {
name     = "${var.env}-${var.subenv}-${var.appname}"
port     = 443
protocol = "TCP"
vpc_id   = "${var.vpc_id}"
health_check {
path     = "/actuator/health"
protocol = "HTTPS"
}
}

请记住，主动运行状况检查将从网络负载均衡器的角度检查端口是否在目标上打开(而不仅仅是源流量(。 这意味着您的目标需要允许来自 NLB 所在的子网以及源流量源自的安全组或 CIDR 范围等的流量。