Networking Services: VPC, EIP, and ELB
VPC building blocks
A VPC defines an IP address range and contains subnets, route tables, security groups, and network ACLs. Security groups are stateful: return traffic for an allowed connection is automatically permitted. Network ACLs are stateless, so both inbound and outbound rules must be defined. VPC peering connects VPCs without traversing the public internet.
EIP and ELB
An EIP is a public IP address that can be bound to an ECS, ELB, or NAT gateway. Bandwidth can be dedicated or shared. ELB distributes traffic across backend server groups. A listener defines the frontend protocol and port; a backend server group defines targets and health checks. Dedicated ELB supports more granular performance and cross-AZ deployment.
Worked example
A public web application uses an ELB listener on HTTPS 443 with a backend server group containing two ECS instances in different AZs. The health check uses HTTP GET /health on port 8080, interval 5 seconds, timeout 3 seconds, and unhealthy threshold 3. If one ECS stops responding, three consecutive failed checks mark it unhealthy and traffic goes to the remaining instance. Reasoning: the health check port must match the application port, not the listener port. Cross-AZ backends keep the service available if one AZ fails.
Traps
Mixing stateful security groups with stateless ACL behavior; binding an EIP directly to backend ECS when the ELB should be the public entry point; and setting a health check port that differs from the application listener.