ECS with ALB integration in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Architecture

intermediate

ECS Service and ALB Target Group Association

You have an ECS service running tasks behind an Application Load Balancer (ALB). Which configuration ensures that the ALB correctly routes traffic to the ECS tasks?

A Set the ALB listener to forward traffic to the ECS cluster ARN.

B Configure the ECS service to use the ALB target group by specifying the target group ARN in the service's load balancer settings.

C Manually add the EC2 instances running ECS tasks as targets in the ALB target group.

D Register the ECS service's task definition directly as a target in the ALB target group.

💡 Hint

Think about how ECS integrates with ALB to manage dynamic task IPs.

The ECS service must be configured with the ALB target group ARN so that ECS can automatically register and deregister task IPs with the ALB target group. This enables proper routing of traffic to running tasks.

❓ service_behavior

intermediate

Health Check Behavior in ECS with ALB

When using an ALB with ECS, what happens if a task fails the ALB health check?

A The ALB stops sending traffic to the task, but ECS does not replace the task automatically.

B The ECS service scales down the number of tasks to reduce load.

C The ALB redirects traffic to a default target group until the task recovers.

D The ECS service automatically stops and replaces the unhealthy task to maintain the desired count.

💡 Hint

Consider how ECS maintains service availability with unhealthy tasks.

If a task fails the ALB health check, ECS marks it unhealthy and replaces it to keep the desired number of healthy tasks running.

❓ security

advanced

Securing ECS Tasks Behind ALB

You want to ensure that only traffic from your ALB can reach your ECS tasks. Which security group configuration achieves this?

A Assign the same security group to both ALB and ECS tasks allowing all inbound traffic.

B Assign a security group to ECS tasks that allows inbound traffic from 0.0.0.0/0 on the task port.

C Assign a security group to ECS tasks that allows inbound traffic from the ALB's security group only.

D Assign a security group to ECS tasks that allows inbound traffic from the ECS cluster's security group.

💡 Hint

Think about how security groups reference each other to restrict traffic.

By allowing inbound traffic on ECS tasks only from the ALB's security group, you ensure that only the ALB can send traffic to the tasks, enhancing security.

❓ Configuration

advanced

Configuring ECS Service with ALB Listener Rules

You have multiple ECS services behind one ALB. How do you configure the ALB to route requests to the correct ECS service?

A Use ALB listener rules with path-based routing to forward requests to different target groups for each ECS service.

B Assign the same target group to all ECS services and use ECS task definitions to differentiate traffic.

C Create separate ALB listeners for each ECS service on different ports.

D Use DNS round-robin to distribute traffic evenly among ECS services.

💡 Hint

Consider how ALB can route traffic based on URL paths.

ALB listener rules can route traffic based on URL paths to different target groups, each associated with a different ECS service, enabling multiple services behind one ALB.

✅ Best Practice

expert

Optimizing ECS with ALB for High Availability

To maximize availability and fault tolerance for an ECS service behind an ALB, which setup is best?

A Deploy ECS tasks across multiple Availability Zones and enable ALB cross-zone load balancing.

B Deploy ECS tasks in a single Availability Zone and configure ALB with cross-zone load balancing disabled.

C Deploy ECS tasks in multiple regions and use a Network Load Balancer instead of ALB.

D Deploy ECS tasks in a single Availability Zone and use ALB with sticky sessions enabled.

💡 Hint

Think about spreading risk and balancing traffic evenly.

Deploying ECS tasks across multiple Availability Zones and enabling ALB cross-zone load balancing ensures traffic is evenly distributed and service remains available if one zone fails.

Practice

1. What is the main purpose of integrating an Application Load Balancer (ALB) with Amazon ECS?

easy

A. To distribute incoming web traffic evenly across multiple container tasks

B. To store container images securely

C. To monitor CPU usage of ECS tasks

D. To create virtual private clouds automatically

Solution

1. Step 1: Understand ALB role in ECS

   ALB is designed to balance incoming traffic to multiple targets, such as ECS tasks, to ensure reliability and scalability.

2. Step 2: Identify the correct purpose

   Among the options, only distributing web traffic evenly matches ALB's function in ECS.

3. Final Answer:

   To distribute incoming web traffic evenly across multiple container tasks -> Option A

4. Quick Check:

   ALB balances traffic = C [OK]

Hint: ALB balances traffic to containers, not stores or monitors [OK]

Common Mistakes:

• Confusing ALB with container image storage
• Thinking ALB monitors CPU usage
• Assuming ALB creates VPCs

2. Which ECS launch type and network mode combination is recommended for simple networking and security when using ALB?

easy

A. EC2 launch type with none network mode

B. EC2 launch type with bridge network mode

C. Fargate launch type with host network mode

D. Fargate launch type with awsvpc network mode

Solution

1. Step 1: Recall recommended ECS and network mode

   Fargate with awsvpc mode provides each task with its own network interface, simplifying networking and security.

2. Step 2: Match options to recommendation

   Only Fargate launch type with awsvpc network mode matches the recommended combination for ALB integration.

3. Final Answer:

   Fargate launch type with awsvpc network mode -> Option D

4. Quick Check:

   Fargate + awsvpc = A [OK]

Hint: Fargate + awsvpc = simple networking with ALB [OK]

Common Mistakes:

• Choosing EC2 launch type instead of Fargate
• Using bridge or host network modes with Fargate
• Selecting none network mode which disables networking

3. Given this ECS service configuration snippet, what will happen when the ALB receives HTTP requests?

{
  "loadBalancers": [{
    "targetGroupArn": "arn:aws:elasticloadbalancing:...",
    "containerName": "webapp",
    "containerPort": 80
  }],
  "launchType": "FARGATE",
  "networkConfiguration": {
    "awsvpcConfiguration": {
      "subnets": ["subnet-12345"],
      "assignPublicIp": "ENABLED"
    }
  }
}

medium

A. ALB forwards requests to the webapp container on port 80 in each task

B. ALB blocks all HTTP requests due to missing security group

C. ALB forwards requests to port 443 by default

D. ALB cannot route because containerPort is missing

Solution

1. Step 1: Analyze load balancer target settings

   The ALB targets the container named "webapp" on port 80, so it will forward HTTP requests there.

2. Step 2: Check network configuration

   Fargate with awsvpc and public IP enabled allows tasks to receive traffic from ALB.

3. Final Answer:

   ALB forwards requests to the webapp container on port 80 in each task -> Option A

4. Quick Check:

   ALB targets container port 80 = B [OK]

Hint: ALB forwards to specified containerPort, not default 443 [OK]

Common Mistakes:

• Assuming ALB blocks traffic without explicit security group mention
• Thinking ALB defaults to port 443
• Missing containerPort causes routing failure

4. You deployed an ECS service with ALB integration but the ALB shows no healthy targets. What is the most likely cause?

medium

A. The ECS cluster has no EC2 instances running

B. The ALB listener is missing a rule for HTTPS traffic

C. The ECS tasks are not registering with the target group due to incorrect container port mapping

D. The ALB is in a different AWS region than the ECS service

Solution

1. Step 1: Understand why ALB shows no healthy targets

   ALB health checks fail if ECS tasks do not register correctly, often due to wrong container port mapping.

2. Step 2: Evaluate other options

   Listener rules missing HTTPS won't cause no healthy targets; ECS Fargate doesn't need EC2 instances; ALB and ECS must be in same region, but this is less common cause.

3. Final Answer:

   The ECS tasks are not registering with the target group due to incorrect container port mapping -> Option C

4. Quick Check:

   Incorrect port mapping blocks target registration = A [OK]

Hint: Check container port matches target group port for healthy targets [OK]

Common Mistakes:

• Assuming missing HTTPS rule causes no healthy targets
• Thinking ECS Fargate needs EC2 instances
• Ignoring region mismatch issues

5. You want to deploy a highly available ECS service behind an ALB that automatically scales with traffic. Which combination of settings ensures this best practice?

hard

A. Use EC2 launch type with none mode, ALB with health checks disabled, and ECS service with fixed task count

B. Use Fargate launch type with awsvpc mode, ALB with target group health checks, and ECS service auto scaling

C. Use Fargate launch type with host mode, ALB with fixed target group size, and no ECS scaling

D. Use EC2 launch type with bridge mode, ALB without health checks, and manual ECS task scaling

Solution

1. Step 1: Identify best ECS launch and network mode for availability

   Fargate with awsvpc mode simplifies networking and security, ideal for high availability.

2. Step 2: Confirm ALB and ECS scaling features

   ALB target group health checks ensure traffic only goes to healthy tasks; ECS service auto scaling adjusts task count with traffic.

3. Step 3: Evaluate other options

   Other options lack health checks or auto scaling, reducing availability and scalability.

4. Final Answer:

   Use Fargate launch type with awsvpc mode, ALB with target group health checks, and ECS service auto scaling -> Option B

5. Quick Check:

   Fargate + awsvpc + ALB health checks + auto scaling = D [OK]

Hint: Combine Fargate, awsvpc, ALB health checks, and auto scaling [OK]

Common Mistakes:

• Skipping ALB health checks
• Using manual scaling instead of auto scaling
• Choosing EC2 with bridge or none network modes