AWS Application Load Balancer to EC2 Node over HTTPS not responding

Question

I'm attempting to create an Application Load Balancer on AWS EC2 that points to a Spring Boot application also running on EC2. All requests to the load balancer fail, timing out after 60 seconds. I'll refer to it as "lb-prod" below.

A domain has been registered with AWS, and a certificate for those domains issued correctly. The domain has A and AAAA records pointing to the "dualstack" value/route. That was the only option when using a record alias when routing to "Alias to Application and Classic Load Balancer."

Two availability zones (apparently this is required) were assigned as us-east-1b and us-east-1a. The target EC2 instance runs in us-east-1b.

The EC2 instance security group has TCP ports 443 (HTTPS) and 22 (SSH) open, and all outbound ranges open. The EC2 instance VPC is IPv4 in range 172.31.0.0/16.

The load balancer uses the default security group with all traffic open. It's on the same VPC in range 172.31.0.0/16.

The load balancer has an HTTPS listener on port 443. The aforementioned SSL certificate was assigned, and the rule defaults to the target group containing the EC2 instance on port 443 using HTTPS. Viewing that target group also shows the load balancer with the correct name. The target group health check returns successfully over HTTPS (protocol HTTP1, IPv4), and I see those calls in the EC2 instance logs. The host is also shown as healthy. The Load balancer is shown as "lb-prod." I've attempted both targets by IP (internal) and instance. Both fail.

The EC2 instance is using a generated certificate locally. However, I've attempted to only use HTTP on this node, with the same failed results. All requests to the public IP address for the EC2 instance succeed.

The load balancer monitoring shows no inbound requests. There are no logs being sent to S3 for debugging.

A ping to the registered domain returns the same IP address as the non-dualstack IP address. In other words, it returns the IP address shown in the DNS value on the load balancer, NOT the dualstack IP. However, direct requests to both domains fail.

I've used several articles, but nothing works. Here is a link to the AWS docs: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-application-load-balancer.html

Any help or ideas appreciated.

Answer 1

Apparently, it is required to add the security group for the EC2 instances to the load balancer along with the default security group. It was my misunderstanding that the default security group was "everything open."

After adding the security group (default name is usually something like 'launch-wizard-1'), everything works fine.