What's the target group port for, when using Application Load Balancer + EC2 Container Service

Question

I'm trying to setup an ALB which listens on port 443, load balancing to ECS Docker containers on random ports, lets say I have 2 container instances of the same task definition, listening on port 30000 and 30001.

When I try to create a target group in the AWS EC2 Management console, there's a "port" input field with 1-65535 range. What number should I put there?

And when I try to create a new service in the AWS EC2 Container Service console, together with a new target group to connect to a existing ALB, there's no input field for a target group "port". After it's created, navigating to the EC2 console, the new target group has port "80". Do I have to listen on port 80? But the health check happens against the "traffic port", which is the container port, 30000 and 30001, so what's the point?

Solution

Turns out, when combined with ECS, the target group's port doesn't mean anything. You don't need to listen on that port.

Comments

[sethu]

Damn. I spent hours trying to trace this down. I am sure they needed that port in order for the load balancer to get started up. And then we dont care about it. They should make it optional.

[Shawn]

I want to back up @sethu. I'm using Terraform to orchestrate ECS including target group. You definitely still have to specify port (e.g. 80) and even protocol for target group. It's misleading, however, because with ALB's dynamic host port, the instances (targets) in target group aren't using the port specified (e.g. 80) at all. They are instead using port like 32769 or ports within the ephemeral port range.

[Shawn]

Also agree they should make the port optional (and more documentation). However, @sethu mentioned that specifying a port is still needed for the ALB to "get started up" - that's actually interesting, and I'd like to know more about it. For now it seems to me that specifying a 80 on target group is like magic. It works, but I have no idea why. I don't know in what case should we set target group port to 80, and in what case to other values like 443, because with ALB dynamic host port, that number doesn't make sense at all.

[enablor]

when using dynamic ports, the health check should be set for "traffic port" which ensures the dynamic port is used.

[Kid_Learning_C]

this drives me crazy