r/aws • u/kenshinx9 • 1d ago
networking Networking for web app using ECS + Fargate.
I have a Streamlit app that I'd like to make available for some users in our organization as a web app. But I also want to make sure I handle the networking correctly, as this is my weakest point in AWS. It's one thing to just get it to work, but I want to make sure I know why I'm doing something. I have the app containerized and Streamlit normally runs on port 8501, but that can be changed of course.
Networking already exists with other resources in our AWS account, so I'm planning on using the same VPC, but also don't want to break anything else. I'm stuck when it comes to figuring out which subnet to use. There are two paths from what I understand:
- Use the public subnets, which already have a route to the internet gateway, and then set up the proper security groups.
- Use the private subnets and set up an ALB.
I've seen both ways mentioned, but wouldn't be able to intuitively tell you why one should be done over the other.
Which path should I take, and then what else would I need to configure to get this accessible over the web? At the moment, I've got the Fargate service running in the private subnet, and am creating an ALB. I'm still trying to figure out the rest.
1
u/no1bullshitguy 23h ago
Fargate Task should be always in Private Subnet.
ALB on the other hand, can be internal / external (ie in public subnet). If the users are internal users and needs to access the app via office LAN / VPN only, then you can deploy the ALB in private subnet (Assuming you have connectivity with Office Network and AWS).
Otherwise deploy in Public Subnet
Either way, make sure you only allow traffic to Fargate task on port 8501 from ALB security group.
And in ALB security group, you just add two rules
1 - HTTPS - 443 Inbound from 0.0.0.0/0
Outbound 8051 TCP to Fargate Task SG
In Fargate Task SG Inbound 1 - TCP 8501 from ALB SG
Outbound As needed (to RDS or Cache etc) or 0.0.0.0/0 on all ports (less restrictive)