2

The architectural diagram shown below is taken from an AWS blog titled Task Networking in AWS Fargate. The blog was posted in January 2018.

Architecture

The description that comes with the image states that:

This configuration allows your tasks in Fargate to be safely isolated from the rest of the internet. They can still initiate network communication with external resources via the NAT gateway, and still receive traffic from the public via the Application Load Balancer that is in the public subnet.

One problem that I have while trying to recreate the architecture is that the same IP address (which I assume is an Elastic IP) is used for both the NAT Gateway and the Application Load Balancer (ALB). I am not able to create an Elastic IP that is usable by both the NAT Gateway and the ALB. Is the diagram flawed, or am I missing something?

krismath
  • 125
  • 6

1 Answers1

3

The diagram is fine. The important thing to understand here is the nature of the ALB, which does by itself NAT.

That consequences that the NAT gateway in the diagram is is only used for outbound connections initiated from the fargate task to the internet. All inbound connections through the ALB will be responded through the ALB, as the ALB sets its own IP as the source address in the TCP header before forwarding the packet to the fargate task.

Therefore it is not required to have the same IP on the ALB and the NAT gateway, which is anyways a requirement that cannot be met.

hargut
  • 3,848
  • 6
  • 10
  • 1
    The ALB does not actually do NAT. It's a reverse proxy. The net effect from an extremely high-level perspective resembles NAT, but that isn't what is truly happening. There is not a 1:1 relationship between front-side and back-side connections on ALB. – Michael - sqlbot Jul 06 '19 at 13:24
  • Yes, that's true. The ALB acts on HTTP based connections, so it is in fact a reverse proxy with routing features. From TCP connection flow perspective it can be simplified, for this specific question, to be understood as NAT device. But the ALB does much more than a simple TCP NAT. – hargut Jul 06 '19 at 14:13