External partners connect to allowlisted fixed IP addresses over TCP port 8443.
The backend application must terminate TLS and receive the client source IP. Distribute connections across multiple Availability Zones with high throughput.
Which architecture is most appropriate?
Use a Network Load Balancer with Availability Zone-specific static IPs and a TCP listener so TLS passes through to the targets.
Detailed explanation
CloudFront is for HTTP(S) content delivery and cannot accept arbitrary TCP 8443 connections or provide the required partner allowlist entry point.
CloudFront is for HTTP(S) content delivery and cannot accept arbitrary TCP 8443 connections or provide the required partner allowlist entry point.
Gateway Load Balancer is for inserting and scaling network virtual appliances, not for general application TCP load balancing with a fixed public entry point.
Gateway Load Balancer is for inserting and scaling network virtual appliances, not for general application TCP load balancing with a fixed public entry point.
NLB distributes TCP connections at high performance and can provide static or Elastic IPs per Availability Zone. A TCP listener passes TLS to the targets and preserves the source IP.
NLB distributes TCP connections at high performance and can provide static or Elastic IPs per Availability Zone. A TCP listener passes TLS to the targets and preserves the source IP.
ALB is for Layer 7 HTTP/HTTPS routing and does not meet arbitrary TCP TLS pass-through and fixed-IP requirements.
ALB is for Layer 7 HTTP/HTTPS routing and does not meet arbitrary TCP TLS pass-through and fixed-IP requirements.
Check official documentation
Compare the following points with the official documentation.
Elastic Load BalancingのNLBにおける静的IP、TCPリスナー、接続元IP保持の公式説明を確認する。
Official references
What to confirm
取引先は許可済みのNLBアドレスへ接続し、TLS終端とアプリケーション処理はバックエンドで行われる。
Key points
- Network Load Balancer
- TCP listener
- Static IP and TLS pass-through
Notes
- Environment:
- Confirm current behavior in the official SAA-C03 guide and AWS service documentation.
Foundation review
Layer 4 versus Layer 7
TCP ports and connection forwarding are Layer 4 concerns; URL paths and HTTP headers are Layer 7 concerns.
IP and TLS responsibilities
Design the allowlisted entry address, load-balancer termination mode, and backend encryption handling as separate decisions.