在 AWS 上使用 Application Load Balancer 在哪里处理微服务的授权和路由？

Question

I currently have an ALB that forwards all http/s requests to a target group. Inside the target group I have 3 EC2 instances each running the same NodeJS application.

If I want to break up my application into microservices with a "gateway service" that handles authorization of all incoming client requests and performs routing to the other microservices, how can I achieve this using ALB?

My initial thought is to implement the following:

Inte.net -> ALB -> Target group with gateway microservices (auth happens here) -> ALB -> Target group with other microservices

Is this kind of architecture possible / recommended?

Answer 1

One solution is to:

• use private AWS API gateway,
• create VPC interface endpoint linked to it
• use IP address as a target group and
• pass traffic through the gateway to micro services

Authorization can be done in the gateway by using Authorizers (Cognito or Lambda)

See https://aws.amazon.com/premiumsupport/knowledge-center/invoke-private-api-gateway/ for details.