Access Private applications on AWS Fargate using Amazon API Gateway PrivateLink

Customers would like to run container-based applications in a private subnet inside a virtual private cloud (VPC), where there is no direct connectivity from the outside world to these applications. This is a very secure way of running applications which do not want to be directly exposed to the internet.
This video shows how API Gateway can be used to expose an application running on Fargate in a private subnet in a VPC using API Gateway private integration through AWS PrivateLink. With the API Gateway private integration, you can enable access to HTTP and HTTPS resources in a VPC without detailed knowledge of private network configurations or technology-specific appliances.
reference: aws.amazon.com/blogs/compute/...

[@sarthakjoshi3797]

To the point, great walkthrough!

[@sakerson27]

Very concise. Thank you!

[@raaviblog105]

You're welcome!

[@calebsecor2183]

Thank you! I was having trouble getting private Fargate tasks running.

[@raaviblog105]

Glad I could help!

[@user-mx6qr3bg2l]

Hi, thanks for the tutorial - is there a reason you use an NLB as opposed to an ALB here - can we use an ALB if we want gRPC support for example?

[@leamon9024]

Thanks! Very useful.

[@raaviblog105]

Glad to hear that!

[@leeliz4488]

3:06 task definition 4:17 target group

[@vrk4052]

Hi Ravi, thanks for your tutorial. Does the load balancer have to be a Network Load Balancer or can it be an Application Load Balancer that supports gRPC?

[@raaviblog105]

haven't tried with ALB ....may be it will work.

[@vrk4052]

@@raaviblog105 Thanks for your reply sir. If I may ask what is the reason you choose an NLB here over an ALB?

[@yogithakakarla1716]

We can directly access nlb right why do we need api gateway

[@vishalgupta8986]

Why the target group health check is http. When the request comes at tcp, how does http works.

[@raaviblog105]

The messages are received at 8080 and sent to container at port 8080 using TCP. The health check from NLB to container is done using HTTP because it checks the container and application is up at port 8080. You can do TCP health check as well but TCP checks at network layer and can show status up even if the application within container is down (crashed or not started correctly). HTTP check is more reliable. Haven't tested this theory.

[@flywithme29thheven]

@8:17

[@kashinathborker2151]

can you do it for aws eks managed nodes?

[@raaviblog105]

I haven't tried that but I believe it should be possible. give me more details about the scenario you are trying.

[@kalina1795]

'Promosm' 🤪