AWS ALB

ALB 用来做:
    HTTP / HTTPS ingress
    TLS termination
    host-based routing
    path-based routing
    header / method / query based routing
    weighted target group routing
    ECS / EC2 / IP target traffic distribution
    Cognito / OIDC authentication at edge of app
    AWS WAF association

ALB 不适合:
    non-HTTP TCP/UDP workload
    static IP requirement without Global Accelerator
    ultra-low-latency L4 forwarding
    client IP preservation without X-Forwarded-* handling

public app:
    Route 53 / CloudFront / Global Accelerator
        -> internet-facing ALB
        -> private target group
        -> ECS / EC2 / IP targets

internal app:
    internal ALB
        -> private target group
        -> service targets

security:
    TLS on listener
    WAF on ALB
    SG only allows required inbound
    target SG only allows ALB SG
    access logs enabled
    alarms for 5xx, latency, unhealthy targets

client request
    -> listener
        -> listener rule priority match
            -> optional authenticate action
            -> forward / redirect / fixed-response action
                -> target group
                    -> healthy target

Route 53
    -> public ALB
        listener 80:
            redirect to 443
        listener 443:
            ACM certificate
            WAF attached
            access logs enabled
            forward to target group
        target group:
            ECS Fargate / EC2 / IP targets in private subnets

internal ALB
    listener 443:
        private ACM certificate or public ACM cert for internal domain
        forward to internal target groups
    security group:
        inbound only from trusted VPC CIDR / service SG
        outbound only to target SG

aws elbv2 create-load-balancer --name prod-public-alb --type application --scheme internet-facing --subnets subnet-public-a subnet-public-b --security-groups sg-alb --region ap-east-1

aws elbv2 create-target-group --name prod-order-api --protocol HTTP --port 8080 --vpc-id vpc-xxxxxxxx --target-type ip --health-check-protocol HTTP --health-check-path /health/ready --health-check-interval-seconds 15 --healthy-threshold-count 2 --unhealthy-threshold-count 3 --matcher HttpCode=200 --region ap-east-1

aws elbv2 create-listener --load-balancer-arn arn:aws:elasticloadbalancing:ap-east-1:111122223333:loadbalancer/app/prod-public-alb/abc123 --protocol HTTPS --port 443 --certificates CertificateArn=arn:aws:acm:ap-east-1:111122223333:certificate/example --ssl-policy ELBSecurityPolicy-TLS13-1-2-2021-06 --default-actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:ap-east-1:111122223333:targetgroup/prod-order-api/def456 --region ap-east-1

aws elbv2 create-listener --load-balancer-arn arn:aws:elasticloadbalancing:ap-east-1:111122223333:loadbalancer/app/prod-public-alb/abc123 --protocol HTTP --port 80 --default-actions '[
    {
      "Type": "redirect",
      "RedirectConfig": {
        "Protocol": "HTTPS",
        "Port": "443",
        "StatusCode": "HTTP_301"
      }
    }
  ]' --region ap-east-1

aws elbv2 modify-load-balancer-attributes --load-balancer-arn arn:aws:elasticloadbalancing:ap-east-1:111122223333:loadbalancer/app/prod-public-alb/abc123 --attributes Key=access_logs.s3.enabled,Value=true Key=access_logs.s3.bucket,Value=company-prod-alb-logs Key=access_logs.s3.prefix,Value=prod-public-alb --region ap-east-1

good readiness endpoint:
    returns 200 only when app can serve real traffic
    checks critical dependencies lightly
    fast response, usually < 100ms
    no authentication
    no external expensive query

bad readiness endpoint:
    always returns 200
    uses full business transaction
    depends on third-party API
    checks a slow report query

listener:
    HTTP listener redirects to HTTPS
    HTTPS listener uses modern TLS policy
    ACM certificate managed
    default action does not expose unintended backend

target group:
    health check path is readiness endpoint
    deregistration delay matches graceful shutdown
    slow start enabled when app needs warmup
    target type matches platform, ECS Fargate usually ip

security:
    WAF web ACL associated
    ALB access logs enabled
    target security group allows inbound only from ALB security group
    app validates X-Forwarded-Proto / Host only when needed
    auth rules protect admin/internal paths if ALB auth is used

monitoring:
    no healthy target alarm
    target 5xx rate alarm
    ALB 5xx alarm
    p95 latency alarm
    target response time dashboard
    access log query ready for incident

operations:
    listener/rule/target group config is IaC or CLI reproducible
    rollback path documented
    DNS cutover procedure documented
    quota and LCU usage reviewed