A company is planning to create a service that requires encryption in transit. The traffic must not be decrypted between the client and the backend of the service. The company will implement the service by using the gRPC protocol over TCP port 443. The service will scale up to thousands of simultaneous connections. The backend of the service will be hosted on an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with the Kubernetes Cluster Autoscaler and the Horizontal Pod Autoscaler configured. The company needs to use mutual TLS for two-way authentication between the client and the backend. Which solution will meet these requirements?
Show Answer & Explanation
Correct Answer: A. Install the AWS Load Balancer Controller for Kubernetes. Using that controller, Configure a Network Load Balancer with a TCP listener on port 443 to forward traffic to the IP addresses of the backend service Pods.
Network Load Balancer (NLB) with TCP listener on port 443 is the correct choice because the traffic must not be decrypted between client and backend (end-to-end encryption). NLB operates at Layer 4 and passes through encrypted gRPC/TCP traffic without decryption, allowing mutual TLS authentication to occur directly between client and backend pods. The AWS Load Balancer Controller enables the NLB to forward traffic directly to pod IP addresses using IP target mode. Option B (ALB with HTTPS listener) is incorrect because ALB terminates TLS connections, decrypting traffic at the load balancer level, which violates the requirement. Options C and D target the node group's Auto Scaling group rather than individual pods, which is less efficient and doesn't leverage the Kubernetes integration properly.