Redirect http to https on Beanstalk's ALB without support of https on the instance

Question

I have the following beanstalk environment: https(443) -> ALB -> http(80) to instance. ALB listener accept only HTTPS request and authenticate with SSL certificate and then process to default port 80.

Everything works fine but I wonder if is it also possible to redirect HTTP port 80 requests back to ALB HTTPS listener without the need to support HTTPS on the instance? When I tried to create redirect process it failed since it tried health-check on port 443 and the instance doesn't support it.

P.S. Is it a security issue if authentication done only in ALB and it communicate instances on port 80? (Instance security group accept requests only from ALB)

Answer 1

The redirection from port HTTP to HTTPS is best set using EC2 console, not EB console. For that you have to go to EC2 console-> Load Balancers.

Then you can modify the existing rule on HTTP:80 listener from Forward to Redirect as shown below:

The above change should not affect any of your health checks.

Is it a security issue if authentication done only in ALB and it communicate instances on port 80?

Yes. This is how it is most commonly done. The HTTP traffic between ALB and your instances traverses only AWS network, not the internet. So its safe from public eyes. But obviously, you can still setup HTTPS between ALB and the instances, but this requires extra work and puts more stress on your instances as they now have to handle SSL encryption and decryption as well.