I'm testing an internet-facing Application Load Balancer attached to two subnets: one public subnet with a direct route to an Internet Gateway, and one private subnet whose outbound traffic goes through a NAT instance in the public subnet. Some target-group instances are located in the private subnet, but the console warns: "Targets are not within enabled Availability Zones. Some targets are not receiving traffic because they are in Zones that are not enabled for your load balancer." What is the recommended subnet and Availability Zone layout for this setup? Should the ALB be attached only to public subnets, and do I need a public subnet in every Availability Zone where targets are running?
1 Answer
The warning usually means the ALB is enabled in different Availability Zones than some of its targets. A common layout is one public and one private subnet in each AZ—for example, public-A with private-A, and public-B with private-B. Put the internet-facing ALB in the public subnets, while the instances can remain in the private subnets. If your targets are in another AZ, add a public subnet in that AZ and attach it to the ALB, or move the targets into an enabled AZ. Cross-zone load balancing can help distribute traffic, but it doesn’t replace a sensible multi-AZ subnet layout.
That makes sense—the public and private subnets are currently in different AZs. I’ll create a matching public/private layout so the ALB is enabled in each AZ where the instances run.