Search code examples
amazon-web-servicesamazon-ec2amazon-route53amazon-elb

Correct Configuration for Route 53 -> ALB HTTPS -> Target Group

Background:

  • 2 domains with Route53
  • 1 ALB
  • 1 Target group with 2 EC2

Goal: www.domain123.com always goes -> https://www.domain123.com

If a user types in domain123.com (without www) it should also go to https://www.domain123.com

  1. First question, is this correct / appropriate DNS configuration?

Current set up - Route53:

  • domain123.com A record -> LoadBalancer
  • domain123.com NS
  • domain123.com SOA
  1. Second question, do I need a CNAME here? I have seen mixed videos of people doing this and not doing this.

Application load balancer set up - Listeners:

  • HTTPS Port 443 -> Forward to Target Group
  • Default ACM (SSL) certificate
  1. Third question, do I need another listener on Port 80?

Target Group -

  • 2 EC2 instances listening on Port 80
  1. Fourth question, I want to host a couple sites. Does the ServerName and ServerAlias need to contain the www?

Conf file - <VirtualHost *:80> ServerAdmin [email protected] DocumentRoot "/var/www/html/domain123.com" ServerName domain123.com #ServerAlias domain123.com ErrorLog "logs/domain123.com-error_log" CustomLog "logs/domain123.com-access_log" common

Thanks in advance.

Solution

  • For your first question as you're using Route 53 its better to use an Alias record (via the A record type), this will resolve your hostname directly to the IP addresses of he load balancer. Ensure you have a record for each domain that needs to resolve to the load balancer.

    For your second question, you don't need to use a CNAME you can use an Alias record to resolve either directly to the load balancer or another Route 53 record that you have access to.

    For your third question you don't need a listener on port 80, but you must if you want to do a HTTP to HTTPS redirect. As its target you can actually add a redirect action to have it redirect to HTTPS, therefor

    For your fourth question if the hostname is not matched in another Vhost the first VirtualHost will serve the traffic.

    If you want to always go to www.example.com you should do the following in your ALB.

    • For the HTTP listener add a redirect rule for the default action that will redirect to the HTTPS first of www.example.com with the path appended.
    • For the HTTPS listener add a host header based rule that will forward traffic to your target group if the domain is www.example.com, then for the default actions have it redirect to the www.example.com domain as it is not on it.

    Take a look at these links: