HTTP to HTTPS
Architecture

AWS Alias records are a Route 53 extension. Unlike CNAMEs: (1) Alias records are FREE — no per-query charge, (2) they can be used at the zone apex (root domain like punedevs.in — CNAME cannot), (3) they resolve at the Route 53 level without an extra DNS hop, and (4) they automatically track the ALB IP as it changes.

A Hosted Zone in Route 53 is a container for DNS records for a domain. When created, you get 4 NS (Name Server) records and 1 SOA (Start of Authority) record automatically. You update your domain registrar's nameservers to point to Route 53's NS records to delegate authority.

Route 53 supports multiple routing strategies: Simple (basic single target), Weighted (A/B split by percentage), Latency-based (routes to lowest-latency region), Failover (active-passive with health checks), Geolocation (by user's country/continent), Geoproximity (by distance with bias), Multi-value (returns multiple IPs).

The ALB Listener on port 80 has a default rule that redirects all traffic to HTTPS with status 301 (Permanent). This is performed at the load balancer level — no application code changes needed. Browsers cache 301 redirects, so repeat visitors skip the redirect entirely after the first visit.

TLS is decrypted ("terminated") at the ALB. Traffic between ALB and EC2 instances travels as plain HTTP inside the private VPC network. This offloads CPU-intensive TLS handshake processing from application servers. For end-to-end encryption (compliance scenarios), configure HTTPS on the target group as well.

A Target Group holds the registered EC2 instances. ALB only routes requests to targets that pass health checks. The ALB periodically sends requests to a configured path (e.g. /health) and expects a 200 OK response. Failing targets are automatically deregistered and traffic redistributes to remaining healthy instances.

ALB (Layer 7) — HTTP/HTTPS, path & host-based routing, WebSockets, gRPC. Best for web apps. NLB (Layer 4) — TCP/UDP, ultra-low latency (<1ms), static IP, best for real-time apps. CLB (Classic) — legacy, do not use for new deployments. For this HTTPS web application, ALB is the correct choice.

ACM provisions, stores, and renews SSL/TLS X.509 certificates. Private keys are stored securely in AWS KMS — you never see or handle them. The certificate proves to browsers that the server is the legitimate owner of the domain. ACM integrates directly with ALB, CloudFront, and API Gateway.

When you request a certificate, ACM generates a unique CNAME record. You add it to your hosted zone (Route 53 can do this automatically). ACM queries for this record to prove domain ownership. Once validated, the certificate issues within minutes and stays valid as long as the CNAME record exists — enabling automatic renewals forever.

A wildcard certificate (*.punedevs.in) covers all subdomains — devops, api, www, staging, etc. — with a single certificate. Combine with a Subject Alternative Name (SAN) for the apex domain to cover everything. Wildcard certs require DNS validation (email validation not supported).

1. ClientHello — Browser sends supported TLS versions, cipher suites, and a random number. 2. ServerHello — ALB picks TLS version, cipher suite, sends ACM certificate. 3. Certificate verification — Browser validates cert against trusted CA roots. 4. Key exchange — ECDHE generates shared secret. 5. Session established — Both sides derive symmetric encryption keys. 6. Encrypted channel open — Application data flows encrypted. Total: ~1 RTT for TLS 1.3.

After ALB terminates TLS, it forwards a plain HTTP request to the EC2 target. The ALB automatically injects forwarding headers so your application knows the original connection was HTTPS. Use X-Forwarded-Proto in your app to enforce HTTPS-only logic (e.g. secure cookie flags).

EC2 instances should NOT be publicly accessible. Configure the EC2 Security Group to only allow inbound traffic from the ALB's Security Group ID — not from 0.0.0.0/0. This ensures all traffic flows through the ALB (with TLS termination, WAF, etc.) and EC2 instances cannot be reached directly from the internet.

Round Robin (default) — each new request goes to the next instance in sequence. Even distribution. Least Outstanding Requests — routes to the instance with fewest active connections; best for varying response times. Sticky Sessions — uses ALB-generated cookies to bind a user session to a specific instance (needed for stateful apps).