I'm testing an internet-facing Application Load Balancer attached to two subnets: one public subnet with a direct route to an Internet Gateway, and one private subnet whose outbound traffic goes through a NAT instance in the public subnet. Some target instances are located in the private subnet, but the load balancer reports: "Targets are not within enabled Availability Zones."
What is the recommended subnet and Availability Zone layout for this setup? Should I create matching public and private subnets in the same Availability Zones, attach the ALB to additional public subnets, or enable cross-zone load balancing? Also, should an internet-facing ALB be placed only in public subnets?
2 Answers
The warning usually means the ALB isn’t enabled in the Availability Zone where some of its targets reside. A common layout is to create a public and private subnet in each AZ—for example, public and private subnets in AZ A, plus another matching pair in AZ B. Then attach the internet-facing ALB to the public subnets in each AZ. The targets can remain in the private subnets; they don’t need to be publicly reachable as long as the ALB can reach them through the VPC.
An internet-facing ALB should generally use public subnets, ideally one per Availability Zone. The instances behind it can stay in private subnets. If targets are spread across additional AZs, either add a public subnet from each of those AZs to the ALB or move the targets so they align with the enabled zones. Cross-zone load balancing can distribute requests across enabled zones, but it’s not a substitute for a sensible multi-AZ subnet design.
My private and public subnets are currently in different AZs. I’ll create a private subnet that matches the public subnet’s AZ. Once the ALB is enabled in the relevant public subnets, should that clear the warning?