I'm testing an internet-facing Application Load Balancer attached to two subnets: one public subnet with a direct route to an Internet Gateway, and one private subnet whose outbound traffic goes through a NAT instance in the public subnet. Some target-group instances are located in the private subnet, but the console warns: "Targets are not within enabled Availability Zones. Some targets are not receiving traffic because they are in Zones that are not enabled for your load balancer." What is the recommended subnet and Availability Zone layout for this setup? Should the ALB be attached only to public subnets, and do I need a public subnet in every Availability Zone where targets are running?
2 Answers
An internet-facing ALB should generally be placed in public subnets, not private ones. The targets themselves can be private; they do not need public IP addresses. The important part is that the ALB has a subnet in every AZ containing targets that should receive traffic. For high availability, use at least two public subnets in separate AZs and matching private subnets for the application instances.
The warning usually means the ALB is enabled in different Availability Zones than some of its targets. A common layout is one public and one private subnet in each AZ—for example, public-A with private-A, and public-B with private-B. Put the internet-facing ALB in the public subnets, while the instances can remain in the private subnets. If your targets are in another AZ, add a public subnet in that AZ and attach it to the ALB, or move the targets into an enabled AZ. Cross-zone load balancing can help distribute traffic, but it doesn’t replace a sensible multi-AZ subnet layout.
That makes sense—the public and private subnets are currently in different AZs. I’ll create a matching public/private layout so the ALB is enabled in each AZ where the instances run.