0

So I have a flask web application. I need to have this be HTTPS only. So I'm pretty lost here:

 Application Load Balancer -> Target Group -> EC2 Instance (:443) -> ??? -> Flask

So originally I had the following in my http stack:

 nginx -> gunicorn -> Flask

That worked for http. And it makes sense how to set up a target group to point to the exposed port of nginx in http. You just provide the port. easy.

However where I am completely lost is when you add HTTPS into the equation. You have AWS provide you with the certificate itself through ACM (Aws certificate manager). However, very specifically AWS Certificate Manager does not allow the created certificates to be exported. So you cannot provide nginx with the certificate, but to use https (443) on nginx you have to provide the ssl_certificate.crt on the server block itself...

So from reading it seems like you don't need nginx... do I need gunicorn? Do I just run flask? If so how does it 'expose' port :443?

I am truly at a loss at how to connect Flask to the target group. Can any one point me to the correct directon? I've exhausted all googling options.

MS-87
  • 173
  • 1
  • 10

1 Answers1

2

Your confusion is in thinking you need SSL between the load balancer and the Flask application. You can terminate SSL at the load balancer. This will provide SSL between any clients like web browsers and your AWS infrastructure, and you will only have non-SSL traffic inside your virtual private network, between the load balancer and the EC2 instance.

Create the SSL certificate in AWS ACM, and attach it to a listener on the Application Load Balancer. Have both listeners in your load balancer (the port 80 listener without SSL, and the port 443 listener with SSL) forward to the target group. Have the target group connect to your EC2 instance over port 80, or 8080 or 5000 or whatever port you have Flask running on. I think Flask defaults to port 5000?

If you are under some sort of requirements for end-to-end encryption that requires you to setup SSL between the load balancer and the EC2 instance, like some regulatory requirements, then you would need to go back to using Nginx and either purchase an SSL certificate somewhere, or setup a free Let's Encrypt certificate, that you could use with Nginx.

Mark B
  • 183,023
  • 24
  • 297
  • 295
  • You are correct, that was my confusion. I did not realize you _could_ have SSL on only part of the chain. I will do it this way. Thank you very much – MS-87 Sep 13 '21 at 22:09