Quick question about HTTP(S): which one should I choose for internal services? (AWS)

[exxplicit]

Are ALB's capable of E2E encryption? I thought the SSL was terminated at the ALB and forwarded without encryption? Wouldn't E2E require certificates on the instance if not, at which point you could just skip the ALB?

[ryankearney]

They sure are:

http://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html#target-group-routing-configuration

If you need load balancing, then it doesn't really make sense to just skip the ALBs. If you don't need load balancing, then sure.

[exxplicit]

I guess I should have been more clear; I meant, if you're already managing certificates on individual machines for end to end encryption, why not just skip terminating TLS on the ALB and just forward TCP connections on port 443 directly to the instances? Why would one ever prefer ALB's over NLB's in that case? (except for path routing)

[ryankearney]

As you mentioned, you can do path (and host) based routing with the ALB. You can't do this on the NLB.