如何配置 AWS 网络负载均衡器以使用 Terraform 路由 HTTPS 流量？

Question

我正在尝试使用 API Gateway 的 VPC 链接将流量路由到 HTTPS 上的内部 API。 但是，VPC 链接迫使我将 API 的负载均衡器从“应用程序”更改为“网络”。

我了解网络负载平衡器位于第 4 层，因此不了解 HTTPS。

我习惯使用第 7 层应用负载均衡器。因此，我不确定应该如何在 terraform 中配置或确实使用网络负载均衡器。

以下是我在 Terraform 中配置网络负载均衡器的尝试。 健康检查失败，我不确定我做错了什么。

resource "aws_ecs_service" “app” {
  name = "${var.env}-${var.subenv}-${var.appname}"
  cluster = "${aws_ecs_cluster.cluster.id}"
  task_definition = "${aws_ecs_task_definition.app.arn}"
  desired_count = "${var.desired_app_count}"
  deployment_minimum_healthy_percent = 50
  deployment_maximum_percent = 200
  iam_role = "arn:aws:iam::${var.account}:role/ecsServiceRole"

  load_balancer {
    target_group_arn = "${aws_lb_target_group.app-lb-tg.arn}"
    container_name = "${var.env}-${var.subenv}-${var.appname}"
    container_port = 9000
  }
  depends_on = [
    "aws_lb.app-lb"
  ]
}

resource "aws_lb" “app-lb" {
  name               = "${var.env}-${var.subenv}-${var.appname}"
  internal           = false
  load_balancer_type = "network"
  subnets = "${var.subnet_ids}"
  idle_timeout = 600

  tags {
    Owner = ""
    Env = "${var.env}"
  }
}

resource "aws_lb_listener" “app-lb-listener" {
  load_balancer_arn = "${aws_lb.app-lb.arn}"
  port = 443
  protocol = "TCP"

  default_action {
    type = "forward"
    target_group_arn = "${aws_lb_target_group.app-lb-tg.arn}"
  }
}

resource "aws_lb_target_group" “app-lb-tg" {
  name = "${var.env}-${var.subenv}-${var.appname}"
  port = 443
  stickiness = []

  health_check {
    path = "/actuator/health"
  }

  protocol = "TCP"
  vpc_id = "${var.vpc_id}"
}

作为参考，这是我之前在尝试切换到网络负载平衡器之前配置应用程序负载平衡器的方式：

resource "aws_ecs_service" "app" {
  name = "${var.env}-${var.subenv}-${var.appname}"
  cluster = "${aws_ecs_cluster.cluster.id}"
  task_definition = "${aws_ecs_task_definition.app.arn}"
  desired_count = "${var.desired_app_count}"
  deployment_minimum_healthy_percent = 50
  deployment_maximum_percent = 200
  iam_role = "arn:aws:iam::${var.account}:role/ecsServiceRole"

  load_balancer {
    target_group_arn = "${aws_lb_target_group.app-alb-tg.arn}"
    container_name = "${var.env}-${var.subenv}-${var.appname}"
    container_port = 9000
  }
  depends_on = [
    "aws_alb.app-alb"]
}

resource "aws_alb" "app-alb" {
  name = "${var.env}-${var.subenv}-${var.appname}"
  subnets = "${var.subnet_ids}"
  security_groups = [
    "${var.vpc_default_sg}",
    "${aws_security_group.app_internal.id}"]
  internal = false
  idle_timeout = 600
  tags {
    Owner = ""
    Env = "${var.env}"
  }
}

resource "aws_lb_listener" "app-alb-listener" {
  load_balancer_arn = "${aws_alb.app-alb.arn}"
  port = "443"
  protocol = "HTTPS"
  ssl_policy = "ELBSecurityPolicy-2015-05"
  certificate_arn = "${var.certificate_arn}"

  default_action {
    type = "forward"
    target_group_arn = "${aws_lb_target_group.app-alb-tg.arn}"
  }
}

resource "aws_lb_target_group" "app-alb-tg" {
  name = "${var.env}-${var.subenv}-${var.appname}"
  port = 80
  health_check {
    path = "/actuator/health"
  }
  protocol = "HTTP"
  vpc_id = "${var.vpc_id}"   
}

Answer 1

一个流经它的网络负载平衡器automatically performs passive health checks on non UDP traffic，所以如果这足够了，那么您可以删除活动的运行状况检查配置。

如果您想启用主动健康检查，那么您可以使用 TCP 健康检查（默认），它只会检查端口是否打开，或者您可以指定 HTTP/HTTPS 协议并指定路径。理想情况下，当您尝试为健康检查指定路径但未将协议设置为 HTTP 或 HTTPS 时，AWS API 会出错，但现在显然不是这样。

使用 Terraform，这看起来像这样：

resource "aws_lb_target_group" "app-alb-tg" {
  name     = "${var.env}-${var.subenv}-${var.appname}"
  port     = 443
  protocol = "TCP"
  vpc_id   = "${var.vpc_id}"

  health_check {
    path     = "/actuator/health"
    protocol = "HTTPS"
  }
}

请记住，主动运行状况检查将从网络负载平衡器的角度（不仅仅是源流量）检查目标上的端口是否打开。这意味着您的目标将需要允许来自您的 NLB 所在的子网以及您的源流量源自的安全组或 CIDR 范围等的流量。