I have an ecs service that runs a fargate container with django server in it, this is the host mapping of the container
{
"name": "django-port",
"containerPort": 443,
"hostPort": 443,
"protocol": "tcp",
"appProtocol": "http2"
}
I auto assigned a public IP to the container, and allowed access in the security group from my IP, and when I connect through the public IP to port 443 I have access through the server.
I also attached an Application Load Balancer to the service, with an HTTPS listener on port 443 that forwards it to the following target group
And I see that the task of the service is registered to the target group but is unhealthy, and according to the monitoring tab it looks like it doesn't reach the service since I see no response data in any of the graphs.
And when I try to reach my server via the domain I registered and attached it's certificate to the ALB listener I get timeout. Any help would be appreciated!
EDIT: The SSL certificate is added to the ALB listener
And the rules in the security group I added to handle the traffic are:
Inbound IPv4 HTTPS TCP 443 0.0.0.0/0
Outbound IPv4 All traffic All All 0.0.0.0/0
You have incorrectly configured your container/task to listen on port 443
(the default HTTPS port) while serving HTTP traffic instead of HTTPS traffic. You have then configured the target group to connect to the container/task on port 443 with the HTTPS protocol.
Now the load balancer/target group is trying to create a secure HTTPS connection to your task/container, but your container doesn't have an SSL certificate installed on it, and doesn't support the HTTPS protocol, so the connection is failing.
You need to configure your container to listen on some other port, like the default HTTP port 80
, and configure the target group to connect to the ECS task over that port, with the HTTP protocol.
You also need two security groups, one for the ECS task, and one for the load balancer. The ECS task's security group should accept inbound connections on the port the container is listening on, like port 80
, while the load balancer's security group should accept inbound connections on the port the load balancer is listening on 443
.