QnA on blog.212clab

How a Stateless Service (ECS) Accesses a Private DB

Sat, 02 May 2026 00:00:00 +0000

One-liner

Add the ECS task’s Security Group as an inbound source in the RDS Security Group. Reference the SG itself — not an IP address.

Why You Can’t Use IPs

ECS Fargate assigns a new IP every time a task starts:

Task A: 10.0.1.23 → terminates
Task B: 10.0.2.87 → new task (different IP)
Task C: 10.0.1.45 → scale-out (yet another IP)

Because tasks scale in and out with auto-scaling, registering IPs in a Security Group is impractical.

iptables vs Security Group

Sat, 02 May 2026 00:00:00 +0000

One-liner

iptables is an OS kernel-level firewall; Security Group is an AWS VPC-level virtual firewall. iptables runs inside the host; SG runs outside the host (at the hypervisor).

Where Each Operates

[Internet]
 ↓
[AWS VPC]
 ↓
[Security Group] ← Hypervisor (ENI) level — filters traffic before it reaches EC2
 ↓
[EC2 instance]
 ↓
[iptables] ← OS kernel (netfilter) level — filters traffic inside EC2
 ↓
[Application]

SG filters traffic before it ever reaches the EC2 instance. iptables filters inside EC2 at the kernel level.

NLB vs ALB

Sun, 22 Mar 2026 00:00:00 +0000

One-liner

NLB is an L4 (TCP/UDP) load balancer; ALB is an L7 (HTTP/HTTPS) load balancer. NLB forwards packets as-is, while ALB parses HTTP requests before routing them.

How Each Layer Works

NLB (L4):
 Client → [NLB: forward TCP packet] → Server
 - Does not inspect packet contents
 - Routes by IP + Port only

ALB (L7):
 Client → [ALB: parse HTTP request] → Server
 - Inspects Host header, URL path, HTTP method
 - Makes routing decisions based on request content

Key Differences

	NLB	ALB
OSI layer	L4 (TCP/UDP)	L7 (HTTP/HTTPS)
Routing basis	IP + Port	Host, Path, Header, Method
Latency	~100µs (ultra-low)	~1ms
Static IP	Yes (1 per AZ)	No (DNS-based)
Throughput	Millions of requests/sec	Tens of thousands of requests/sec
Protocols	TCP, UDP, TLS	HTTP, HTTPS, gRPC, WebSocket

Routing Capabilities

NLB:
 - Port-based routing only
 - :443 → Target Group A
 - :8080 → Target Group B

ALB:
 - api.example.com/users → User service
 - api.example.com/orders → Order service
 - admin.example.com/* → Admin service
 - Header X-Version: v2 → V2 service

With ALB, a single load balancer can route to multiple services by Host or Path. With NLB, you’d have to split by port or deploy separate NLBs.