2

A new api service we use requires that we give them a list of all the IP addresses our calls will be coming from; if we make an api call from any other IP address, the call will fail.

This question has been asked before here, but I'm wondering if in 2019 there is any simpler/easier/lower cost solution.

Our Setup

  • Elastic Beanstalk, which currently scales to anywhere from 5 - 50 ec2 instances for our web application based on traffic
  • An Application Load Balancer
  • Also have a worker tier, which would be available for use if that might be helpful
  • Typically these api calls would be coming from any of our web tier ec2 instances, as the calls will be based on a user interaction. We can of course set up something different, e.g. have the worker tier make the calls

Solutions I've Found

  • Give each ec2 instance an elastic (static) ip address. This is not a great solution for us, because as we hopefully continue to scale the number of ip addresses needed will continue to grow {ref}

  • Set up two NAT instances (one not being sufficient as it would be a single point of failure). I'm hoping there is something simpler and lower cost than this option. {ref} {ref}

  • Create new ec2 instances and put them behind a Network Load Balancer. Again, complex and costly. {ref}

Are there any new, easier, less costly solutions? I have never used AWS Lambda before; maybe it is be possible to run Lambda functions all from one IP address? I don't have many ideas beyond that at this point. Thanks for your time.

KayakinKoder
  • 3,243
  • 3
  • 23
  • 37

2 Answers2

4

A NAT is the best solution, and shouldn't cost you much more than a web-server.

The simplest way to use a NAT is the NAT Gateway. Pricing depends on region, but it's around $0.05/hour, which is a little more than the price of a t3.medium EC2 instance. You're also charged a per-GB rate for data, which can add up quickly. On the positive side, Amazon manages the infrastructure for you, including patches and high-availability.

A NAT Instance is an EC2 instance running a specially-configured AMI. You could probably get away with running this on a t3.micro instance, at $0.01 per hour, which is probably much less than any of your webservers. You will be responsible for applying patches and waking up in the middle of the night if anything goes wrong.

You can probably get away with a single NAT, of either type. You will pay for cross-AZ traffic by doing this ($0.01/GB), so it will be false economy if you move a lot of data across the NAT. It's a tossup on whether you'll get higher availability from two NATs, because you can only reference one at a time in your routing tables. So if one goes down you'll have to update the routing tables to point at the other, which will probably take as much time as bringing up a new instance.

You can't use a Lambda, because it needs to have a permanent IP address assignment and you can't control that with Lambda. You could write your own proxy server, running on EC2, but the costs for that are the same as a NAT Instance.

guest
  • 56
  • 1
  • Thanks. I'm not a networking guy; the docs say a NAT gateway "...prevents the internet from initiating a connection with those instances". We'll still be able to receive api call responses? – KayakinKoder Feb 08 '19 at 21:20
  • 1
    @KayakinKoder yes. A NAT Gateway prevents machines on the Internet from *initiating* connections inbound to machines behind the NAT. Responses will work as expected. Also note that NAT Gateways are virtual -- a service provided by the network infrastructure itself, not a machine -- so one per AZ is sufficient. The only known failure modes of a NAT Gateway are (1) failure to be initially created at all, or (2) significant infrastructure damage/loss/failure/isolation of an availability zone that impairs network connectivity overall. – Michael - sqlbot Feb 09 '19 at 01:11
0

Here is prescriptive guidance from AWS: https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/generate-a-static-outbound-ip-address-using-a-lambda-function-amazon-vpc-and-a-serverless-architecture.html

"This pattern describes how to generate a static outbound IP address in the Amazon Web Services (AWS) Cloud by using a serverless architecture..."

Essentially, you have an AWS Lambda function that uses an Elastic IP address as the outbound IP address. In the guidance, you will create "a Lambda function and a virtual private cloud (VPC) that routes outbound traffic through an internet gateway with a static IP address. To use the static IP address, you attach the Lambda function to the VPC and its subnets. "

enter image description here

Michael Walker
  • 61
  • 1
  • 5