How should the solutions architect reconfigure the architecture to resolve this issue?
Replace the ALB with a Network Load Balancer. Configure a NAT gateway in a public subnet to allow internet traffic.
Move the EC2 instances to public subnets. Add a rule to the EC2 instances’ security groups to allow outbound traffic to 0.0 0 0/0.
Update the route tables for the EC2 instances’ subnets to send 0.0.0 0/0 traffic through the Internet gateway route. Add a rule to the EC2 instances’ security groups to allow outbound traffic to 0 0.0.0/0.
Create public subnets in each Availability Zone. Associate the public subnets with the ALB. Update the route tables for the public subnets with a route to the private subnets.
Explanations:
Replacing the ALB with a Network Load Balancer does not inherently solve the problem of private EC2 instances not receiving traffic, as the core issue lies in the instances being in private subnets without a direct route to the internet. A NAT gateway is used for outbound traffic from private subnets but does not facilitate inbound traffic from the internet.
Moving EC2 instances to public subnets would allow them to receive internet traffic, but it is not necessary or recommended as a best practice. Public subnets expose EC2 instances directly to the internet, which could increase security risks. The primary issue is not the location of the instances, but rather the configuration of the load balancer and routing.
Updating the route tables to send traffic to an Internet Gateway does not resolve the issue as the EC2 instances remain in private subnets. These instances cannot have public IP addresses and are not directly reachable from the internet. The security group rule for outbound traffic is not relevant to incoming traffic, which is the core issue here.
Creating public subnets for the ALB allows it to handle incoming internet traffic, which can then be routed to the private subnets where the EC2 instances reside. This configuration aligns with best practices by keeping the instances private while allowing the ALB to serve as an intermediary, handling external requests and passing them to the private instances.
If I’m not mistaken, the answer is:
Create public subnets in each Availability Zone. Associate the public subnets with the ALB. Update the route tables for the public subnets with a route to the private subnets.