AWS internal ALB gets no traffic from API Gateway - amazon-web-services

Question

I have a question regarding AWS API Gateway which forwards traffic to an internal facing ALB. This is configured with terraform:
resource "aws_lb" "foo-load-balancer" {
name = "foo-dev"
load_balancer_type = "application"
internal = true
subnets = local.private_subnet_ids
security_groups = [aws_security_group.lb_security_group.id]
}
resource "aws_security_group" "lb_security_group" {
name = "${local.name}-lb-security-group"
vpc_id = local.vpc_id
ingress {
from_port = 8080
to_port = 8383
protocol = "tcp"
cidr_blocks = local.private_subnet_cidrs
}
ingress {
from_port = 5432
to_port = 5432
protocol = "tcp"
cidr_blocks = local.private_subnet_cidrs
}
ingress {
from_port = 80
to_port = 80
protocol = "tcp"
cidr_blocks = local.private_subnet_cidrs
}
egress {
from_port = 0
# Allowing any incoming port
to_port = 0
# Allowing any outgoing port
protocol = "-1"
# Allowing any outgoing protocol
cidr_blocks = [
"0.0.0.0/0"]
# Allowing traffic out to all IP addresses
}
tags = local.tags
}
resource "aws_apigatewayv2_vpc_link" "alb-vpc-link" {
name = local.name
security_group_ids = [
aws_security_group.lb_security_group.id]
subnet_ids = local.private_subnet_ids
tags = local.tags
}
resource "aws_apigatewayv2_api" "foo" {
name = "${local.name}-foo"
protocol_type = "HTTP"
}
resource "aws_apigatewayv2_integration" "foo" {
api_id = aws_apigatewayv2_api.foo.id
integration_type = "HTTP_PROXY"
integration_method = "ANY"
connection_type = "VPC_LINK"
connection_id = aws_apigatewayv2_vpc_link.alb-vpc-link.id
integration_uri = module.foo-backend-service.aws_lb_listener.arn
depends_on = [
module.foo-backend-service]
}
resource "aws_apigatewayv2_route" "foo" {
api_id = aws_apigatewayv2_api.foo.id
route_key = "ANY /{proxy+}"
target = "integrations/${aws_apigatewayv2_integration.foo.id}"
}
resource "aws_apigatewayv2_deployment" "foo" {
api_id = aws_apigatewayv2_api.foo.id
depends_on = [
aws_apigatewayv2_route.foo]
}
resource "aws_apigatewayv2_stage" "foo" {
name = "$default"
deployment_id = aws_apigatewayv2_deployment.foo.id
api_id = aws_apigatewayv2_api.foo.id
}
resource "aws_apigatewayv2_domain_name" "foo" {
domain_name = aws_acm_certificate.foo.domain_name
domain_name_configuration {
certificate_arn = aws_acm_certificate.foo.arn
endpoint_type = "REGIONAL"
security_policy = "TLS_1_2"
}
depends_on = [
aws_acm_certificate_validation.foo]
}
resource "aws_apigatewayv2_api_mapping" "foo" {
api_id = aws_apigatewayv2_api.foo.id
domain_name = aws_apigatewayv2_domain_name.foo.id
stage = aws_apigatewayv2_stage.foo.id
}
resource "aws_ecs_task_definition" "foo-service-task" {
family = "${var.application_name}-${var.name}-service-task"
container_definitions = jsonencode(
[
{
name: "${var.application_name}-${var.name}-service-task",
image: var.image,
essential: true,
portMappings: [
{
containerPort: 8282,
hostPort: var.port
}
],
memory: var.memory,
cpu: var.cpu,
environment: var.environment,
logConfiguration: {
logDriver: "awslogs",
options: {
awslogs-group: var.cloudwatch_group,
awslogs-region: var.aws_region,
awslogs-stream-prefix: var.name
}
}
}
])
network_mode = "awsvpc"
tags = merge(var.tags, {
service = var.name
})
depends_on = [var.depends_on_relation]
}
resource "aws_ecs_service" "foo-service" {
name = "${var.application_name}-${var.name}"
cluster = data.aws_ecs_cluster.ecs.id
task_definition = aws_ecs_task_definition.foo-service-task.arn
desired_count = var.desired_count
load_balancer {
target_group_arn = aws_lb_target_group.target-group.arn
container_name = aws_ecs_task_definition.foo-service-task.family
container_port = 8282
}
network_configuration {
subnets = var.subnet_ids
security_groups = [aws_security_group.securitygroup.id]
}
depends_on = [aws_lb_listener.listener]
}
resource "aws_security_group" "securitygroup" {
name = "${var.application_name}-${var.name}"
vpc_id = var.vpc_id
ingress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = local.subnet_cidrs
}
egress {
from_port = 0
# Allowing any incoming port
to_port = 0
# Allowing any outgoing port
protocol = "-1"
# Allowing any outgoing protocol
cidr_blocks = [
"0.0.0.0/0"]
# Allowing traffic out to all IP addresses
}
tags = merge(var.tags, {
service = var.name
})
}
resource "aws_lb_target_group" "target-group" {
name = "${local.stage}-${var.name}"
port = var.port
protocol = var.protocol
target_type = "ip"
vpc_id = var.vpc_id
health_check {
enabled = var.health_check_enabled
matcher = var.protocol == "TCP" ? null : "200,301,302"
path = var.health_check_protocol == "TCP" ? null : var.health_check_path
port = var.health_check_port
protocol = var.health_check_protocol
interval = var.health_check_interval
timeout = var.protocol == "TCP" ? null : var.health_check_timeout
healthy_threshold = var.health_check_healthy_threshold
unhealthy_threshold = var.health_check_unhealthy_threshold
}
slow_start = var.protocol == "TCP" ? null : var.health_check_slow_start
tags = merge(var.tags, {
service = var.name
})
depends_on = [
data.aws_lb.loadbalancer]
}
resource "aws_lb_listener" "listener" {
load_balancer_arn = data.aws_lb.loadbalancer.arn
port = var.port
protocol = var.protocol
default_action {
type = "forward"
target_group_arn = aws_lb_target_group.target-group.arn
}
depends_on = [
aws_lb_target_group.target-group]
}
resource "aws_route53_record" "foo" {
name = aws_apigatewayv2_domain_name.foo.domain_name
type = "A"
zone_id = data.aws_route53_zone.hosted_zone.zone_id
alias {
name = aws_apigatewayv2_domain_name.foo.domain_name_configuration[0].target_domain_name
zone_id = aws_apigatewayv2_domain_name.foo.domain_name_configuration[0].hosted_zone_id
evaluate_target_health = false
}
}
resource "aws_acm_certificate" "foo" {
domain_name = local.application_domain
validation_method = "DNS"
}
resource "aws_route53_record" "foo_acm" {
for_each = {
for dvo in aws_acm_certificate.foo.domain_validation_options : dvo.domain_name => {
name = dvo.resource_record_name
record = dvo.resource_record_value
type = dvo.resource_record_type
zone_id = data.aws_route53_zone.hosted_zone.zone_id
}
}
allow_overwrite = true
name = each.value.name
records = [each.value.record]
ttl = 60
type = each.value.type
zone_id = each.value.zone_id
}
resource "aws_acm_certificate_validation" "foo" {
certificate_arn = aws_acm_certificate.foo.arn
validation_record_fqdns = [for record in aws_route53_record.foo_acm : record.fqdn]
}
resource "aws_route53_record" "application_load_balancer" {
name = "alb.${local.application_domain}"
type = "CNAME"
zone_id = data.aws_route53_zone.hosted_zone.zone_id
ttl = "60"
records = [aws_lb.foo-load-balancer.dns_name]
}
The Service/Task, which I am starting is a simple Spring-Boot app ("Greeting-Controller") with an enabled health-check. The service is up and running and healthy.
The problem is the ALB doesn't recognize any traffic (I can't see any requests at the ALB in the AWS console) and when I try to access to the registered Route53 DNS I get the "Service unavailable" JSON.
Any ideas what to change?