MikeTheCanuck
commented
6 years ago Minimizing infrastructure
If we believe the reddit thread that AWS has patently refused to implement the most common layer-7 redirect behaviour, that everyone in the world needs, in their layer-4 load balancer, then we're left to find the lightest-weight, lowest overhead web server configuration to manage this.
Here's one option which is attractive because it handles multiple domains and routes with a single web server. This would demand that we:
- carefully refactor all the HTTP listener rules out of their respective container/ECS-service targets
- group all HTTP listener rules for all domains to one new container/ECS-service target
- while still leaving all the HTTPS listener rules for all containers as they're currently configured today
While I'm sure there's a way to walk that intricate tightrope, boy howdy does that sound painfully brittle.
martypdx
fstorr
Goals
Need for redirect
There are many industry-wide efforts to drive as much of the world's traffic to HTTPS (TLS-encrypted) channels and minimize the amount of traffic over HTTP (non-encrypted). Google will be marking all HTTP pages "insecure" as of this year.
It would be preferable (especially as it's free, in an AWS world) to leverage HTTPS listeners - no questions there.
Given that all of Hack Oregon's infrastructure to date has been built on HTTP listeners (front end and APIs), there is a lot of legacy code that is hard-coded to send requests over HTTP.
So we will need to allow for incoming HTTP requests and redirect those requests to our HTTPS listeners.
Preserve routes and params
Further, I have noticed in many implementations of redirects that routes and query parameters can get dropped in the redirect, breaking the underlying application behaviour:
Minimize extra infrastructure
Ideally it would be less overhead, and fewer points of failure, if the redirects were performed at the ALB layer (or some other "hands-free" AWS piece). However, most documents and articles I'm finding in my research focus on implementing the redirecting listener as a web server module that you own yourself. Having to account for, configure, manage and support another dozen web servers just for the purpose of sending traffic from HTTP to HTTPS seems like an awful burden, and given how common this need is, I can't accept that Amazon hasn't found a way to relieve this burden themselves.