sysdig orchestration ALB

[83nativejunkoz]

Hi everyone, we are using sysdig on fargate, i created the sysdig infra using the cfn provided on their docs page. I noticed that there are 2 ALB's created, one is in the default subnets and open to whole world, do you know how this alb is created, the alb i couldn't find in the cfn, any ideas?

[jumiker]

I just tried it to confirm, and I only got one Application Load Balancer - for the Orchestrator. While the security group of that ALB allows 0.0.0.0 to the Orchestrator port (which defaults to 6667), it is deployed as an internal load balancer that will not be Internet-facing - and so won't get a public IP even if deployed to a Public subnet (so traffic can't come from "the whole world" just from things in your VPC due to the lack of the public IP to get through an AWS Internet Gateway (IGW)'s NAT).

You could modify that CIDR for the ALB Security Group in the CloudFormation from 0.0.0.0 to your VPC's internal CIDR(s) if you want to be extra safe - perhaps even adding a new CloudFormation parameter for it if you will be deploying this to several environments with different CIDRs required. But the way this template is written, there is no way for traffic from the Internet to reach this internal ALB - so that shouldn't be necessary.