Achieving Fixed IP Addresses for AWS ALBs using Global Accelerator
This article details a common solution for providing fixed IP addresses to clients when using AWS Application Load Balancers (ALBs), which inherently have dynamic IPs. It explains how to integrate AWS Global Accelerator with an ALB to expose static Anycast IPs, addressing the architectural challenge of client-side IP whitelisting without sacrificing ALB features or high availability. The solution uses Global Accelerator as a static entry point that routes traffic to an internal ALB.
Read original on Dev.to #architectureAWS Application Load Balancers (ALBs) are powerful for managing HTTP/HTTPS traffic, offering features like path-based routing, host-based routing, and SSL termination. However, their IP addresses are dynamic, changing as AWS scales and maintains the service. This dynamic nature poses a significant challenge when external systems, often third-party integrations or partners, require a fixed set of IP addresses for firewall whitelisting.
The Challenge: Dynamic ALB IPs vs. Static Whitelists
Architecting systems that interact with external firewalls often necessitates providing stable, unchanging IP addresses. Relying on dynamically resolved ALB DNS records is brittle and can lead to outages when IP addresses change unexpectedly. The core problem is that ALBs expose a DNS name (`*.elb.amazonaws.com`) that resolves to a set of IPs managed by AWS, which are not guaranteed to be static.
The Solution: AWS Global Accelerator
AWS Global Accelerator provides a mechanism to assign static Anycast IP addresses as a fixed entry point for applications. These two static IPv4 addresses can be provided to external clients for whitelisting. Global Accelerator then routes traffic from these fixed IPs to your regional ALB endpoints, effectively abstracting the dynamic nature of the ALB's underlying IPs.
Key Benefit
Global Accelerator provides a consistent public entry point (fixed Anycast IPs) while allowing you to leverage all advanced features of your Application Load Balancer, such as request routing and health checks.
Implementation Steps for Fixed IPs
- Create an AWS Global Accelerator accelerator.
- Add a TCP listener (e.g., port 443) to the accelerator.
- Create an endpoint group in the same AWS Region as your ALB.
- Register your ALB as an endpoint within this group.
- Provide the two Global Accelerator IPs to clients for firewall whitelisting.
- Optionally, create a Route 53 alias record pointing your custom domain (e.g., `api.example.com`) to the Global Accelerator's DNS name.
Protecting the ALB from Direct Access
While Global Accelerator provides fixed IPs, an internet-facing ALB can still be accessed directly via its AWS-assigned DNS name. To enhance security and ensure all traffic passes through Global Accelerator, it is best practice to use an internal ALB as the Global Accelerator endpoint. Global Accelerator can connect to internal ALBs by creating Elastic Network Interfaces (ENIs) within your VPC, delivering traffic while preserving the original client IP via `X-Forwarded-For` headers.