Amazon AWS Static IP & ELB Load Balancing Alternatives

amazon ec2amazon-web-servicesload balancing

I am currently using Amazon AWS to launch a blogging service which offers two different ways to display content to the users

Using their own subdomain : blog.mywebsite.com
Using their own domain : mywebsite.com

For version (1) I am able to use CNAMES which is fine. For version (2) I run into an issue where If I would have a customer point their mywebsite.com A Record to my Public IP 24.x.x.x I run into an issue where Amazon by default does not allow Public IPs to be pointed to loadbalancers.

Has anyone found a work around for this? It's crucial that we have individuals changing their A records to the specific IP of the software.

I have considered Apache style load balancing software etc, It just concerns me as it puts a single point of failure for this application.

Best Answer

Unfortunately the RFC for DNS does not allow CNAMEs for domain roots. There are a few alternatives, whereby you could set up an nginx cluster to do the domain handling for you, or build your own load balancing solution. I know that Route53 (Amazon's DNS service) will allow for forwarding the domain root to an ELB, but getting your customers to use route53 for their dns is prohibitive. Unfortunately at this time there isn't an elegant pure amazon solution for this, but it is a common request, and I know that Amazon is aware of it, and possibly considering a solution for it.

Related Solutions

Python CGI on Amazon AWS EC2 micro-instance — a how-to!

(Strange post, so hopefully this won't be as strange a reply).

On the subject of security flaws: it is considered general bad practice to store cgi-bin scripts within the document root of the web server. Even the W3C eludes to it under "Are compiled languages such as C safer ..." in their World Wide Web Security FAQ:

Consider the following scenario. For convenience's sake, you've decided to identify CGI scripts to the server using the .cgi extension. Later on, you need to make a small change to an interpreted CGI script. You open it up with the Emacs text editor and modify the script. Unfortunately the edit leaves a backup copy of the script source code lying around in the document tree. Although the remote user can't obtain the source code by fetching the script itself, he can now obtain the backup copy by blindly requesting the URL:
    http://your-site/a/path/your_script.cgi~
(This is another good reason to limit CGI scripts to cgi-bin and to make sure that cgi-bin is separate from the document root.)

This is not as significant a threat as the ability to write a file within the document root. However, an attacker could obtain the source code of the cgi, devise a directed attack against it, and use it as a stepping stone into the server.

To mitigate this, you can add the following lines to the lighttpd.conf (or some variation therein) to direct cgi-bin to a directory separate from the /var/www/lighttpd document root.

$HTTP["url"] =~ "/cgi-bin/" { cgi.assign = ( "" => "" ) }
alias.url = ( "/cgi-bin/" => "/usr/lib/cgi-bin/" )

This requires both the cgi and alias modules for lighttpd.

ELB Alternatives for AWS when transferring large amount of data

If www.example.com is being load balanced to server1.example.com and server2.example.com, have your one-time link explicitly link to server1/2.example.com (or the current instance's AWS CNAME, if your instances change frequently enough that your DNS isn't necessarily up-to-date).

Best Answer

Related Solutions

Python CGI on Amazon AWS EC2 micro-instance — a how-to!

ELB Alternatives for AWS when transferring large amount of data

Related Topic