DEV Community: Naoki

↔️Forward Proxy vs. Reverse Proxy: Roles, Benefits, and Diagrams

Naoki — Mon, 28 Sep 2026 06:33:55 +0000

Forward Proxy vs. Reverse Proxy: Roles, Benefits, and Diagrams

When learning about web systems and networks, you may come across two terms:

Forward proxy
Reverse proxy

Both act as a proxy, meaning they handle communication on behalf of something else. The key difference is whose behalf they act on.

A forward proxy acts on behalf of the client.
A reverse proxy acts on behalf of the server.

The overall flow looks like this:

Client
  ↓
Forward proxy
  ↓
Internet
  ↓
Reverse proxy
  ↓
Web server

The forward proxy sits near the client and handles outgoing requests. The reverse proxy sits near the server and handles incoming requests.

Forward proxy

A forward proxy accesses websites on behalf of a client.

Without one:

Company PC
  ↓
Internet
  ↓
Website

With one:

Company PC
  ↓
Forward proxy
  ↓
Internet
  ↓
Website

The PC sends its request to the forward proxy, which then contacts the website. This is why a forward proxy is often described as an exit point for client traffic.

Benefits of a forward proxy

Access control: It can allow or block requests to particular websites.
Logging: It can record who accessed which site and when.
Centralized control: A company can manage outgoing web traffic in one place.
Client IP protection: The destination can see the proxy’s IP address instead of the client’s IP address, depending on the configuration.
Caching: It may serve previously retrieved content without fetching it again.

For example:

Client
10.0.0.10
  ↓
Forward proxy
203.0.113.10
  ↓
Website

In this configuration, the website sees the proxy as the connection source. A forward proxy does not guarantee anonymity, however. Configuration and HTTP headers may still reveal client information.

Reverse proxy

A reverse proxy receives requests on behalf of a web server or another backend service.

Without one:

User
  ↓
Web server

With one:

User
  ↓
Internet
  ↓
Reverse proxy
  ↓
Web server

Users connect to the reverse proxy, which forwards their requests to the backend. This is why a reverse proxy is often described as an entry point for a web system.

Benefits of a reverse proxy

Load balancing: It can distribute requests across multiple servers.
Backend isolation: Backend servers can be kept from direct public access.
TLS termination: It can handle HTTPS connections before forwarding requests to backends.
Routing: It can choose a backend based on the hostname or URL path.
Security controls: Depending on the product and configuration, it can help control unwanted traffic.
Caching: It may answer requests from its cache and reduce traffic to the backend.

For example, a reverse proxy can distribute requests like this:

              Reverse proxy
              ↙     ↓     ↘
        Server A  Server B  Server C

It can also route requests by path:

example.com/api/*
  ↓
API server

example.com/images/*
  ↓
Image server

A reverse proxy alone does not prevent every type of attack. A web system may also use a WAF and other security controls.

How they compare

Question	Forward proxy	Reverse proxy
Whose behalf does it act on?	The client	The server
Where is it placed?	Near the client	Near the backend
Which traffic does it mainly handle?	Outgoing requests	Incoming requests
Common uses	Access control and logging	Load balancing and routing
What can it hide from direct access?	The client	The backend
Example	A company web proxy	nginx or an application load balancer

nginx as a reverse proxy

nginx can receive requests and forward them to an application:

Internet
  ↓
nginx
  ↓
Application

It can also distribute requests across multiple applications:

        nginx
       ↙     ↘
Application A  Application B

In these examples, nginx acts as a reverse proxy.

The similar role of an AWS ALB

In AWS, an Application Load Balancer (ALB) can perform several roles associated with a reverse proxy.

For example:

Internet
  ↓
ALB
  ↓
Target group
  ↓
EC2 instances

With Amazon ECS, the flow may be:

Internet
  ↓
ALB
  ↓
Target group
  ↓
ECS tasks

An ALB supports features such as load balancing, TLS termination, path-based routing, host-based routing, and health checks.

ALB and nginx are different products. nginx is software that can serve as a web server or reverse proxy, while ALB is an AWS-managed load balancer. Some of their roles overlap.

Both can appear in the same request path

A company user accessing a web service may pass through both types of proxy:

Company PC
  ↓
Forward proxy
  ↓
Internet
  ↓
Reverse proxy or ALB
  ↓
Web server

They handle different parts of the same request. The forward proxy acts for the client as traffic leaves the company network. The reverse proxy acts for the server as traffic enters the web system.

In short:

Forward proxy
= The client’s representative
= An exit point

Reverse proxy
= The server’s representative
= An entry point

🚧Where Would I Start If Asked to Find and Fix Problems in a Company's AWS Environment?

Naoki — Mon, 28 Sep 2026 06:15:43 +0000

Where Would I Start If Asked to Find and Fix Problems in a Company's AWS Environment?

First, identify the production environment and the services running in it.

Then check how each service is configured. Address problems that could cause outages or expose data first.

Identify the Production Environment

Check the accounts in AWS Organizations.

Do not rely on account names alone. Compare tags, active resources, and internal documentation to identify the production accounts and Regions.

Record:

Production AWS accounts
Regions in use
Main services running in each account
The person responsible for each service

The image below is an example of the AWS Organizations account list. It is an AWS sample screenshot, not a capture of your company's environment.

Image source: AWS Cloud Operations Blog

List the Production Services

In the production accounts, check resources such as Route 53, CloudFront, ALB, ECS, EC2, and RDS.

For each customer-facing website or API, record its domain, related AWS resources, and the impact of an outage.

Service:
Member website

Domain:
example.com

Main resources:
CloudFront, ALB, ECS, Aurora

Impact of an outage:
Users cannot log in or make purchases

This list helps you decide what to investigate first.

Start with a service whose failure would have a significant impact.

Check the Resources Used by a Service

For the selected service, find out where a user's request goes and which resources the application needs.

Route 53
  ↓
CloudFront
  ↓
ALB
  ↓
ECS
  ↓
Aurora

Confirm each connection in the AWS settings:

Route 53: Where the DNS record points
CloudFront: Which origin the behavior uses
ALB: Which target group the listener rule selects
ECS: Which service, task definition, and tasks run the application
Aurora: Which database the application connects to

For example, the following AWS sample screenshot shows an ALB listener rule forwarding traffic to target groups. It does not show the service described in this article.

Image source: AWS Networking & Content Delivery Blog

After checking these settings, you know which AWS resources are needed to run the service.

Check for Problems

Once you understand the service, review its settings and logs.

CloudWatch: Are there alarms for failures, and do notifications reach someone?
RDS or Aurora: Are backups being taken?
S3: How are important files protected?
Security groups: Is access allowed from more sources than necessary?
IAM: Does the application role have excessive permissions?
CloudTrail: Can you investigate recent changes?

The image below is an AWS sample of CloudWatch alarm notification settings. In your own environment, check the actual alarm and its notification destination.

Image source: AWS Cloud Operations Blog

For example, Aurora backups may be enabled, but there may be no record that anyone has successfully restored one. Record that as an issue to investigate.

If the database contains important data, restore a backup into a separate environment and check whether you can read it. This verifies that the data can be recovered without changing the production database.

Fix the Problems You Find

For each problem, record the affected service, the evidence, the proposed change, and how you will verify it.

Affected service:
Member website

Setting checked:
Security group for the ECS tasks

Problem:
The application port is open to a broad range of sources

Required traffic:
Traffic from the ALB to the ECS tasks

Proposed change:
Allow traffic from the ALB security group

Verification:
Confirm that users can log in and make purchases
through the ALB

Before changing a setting, check which current connections depend on it.

After the change, test the main application functions and check CloudWatch Logs for errors.

Move to the Next Service

Once you have investigated and addressed the selected service's problems, return to the list and choose the next service.

Identify the production environment
        ↓
List the production services
        ↓
Check the resources used by a high-impact service
        ↓
Find problems in its settings and logs
        ↓
Fix the problems and verify the results
        ↓
Move to the next service

Following this order makes it easier to explain what you are checking and why each setting matters.

⚙️Exploring AWS VPC Features From Network Architecture to Connectivity Troubleshooting

Naoki — Mon, 28 Sep 2026 05:38:11 +0000

Exploring AWS VPC Features｜From Network Architecture to Connectivity Troubleshooting

When you open the AWS VPC console, you see many items: VPCs, subnets, route tables, NAT gateways, security groups, and more.

Knowing what each item is called does not necessarily make it clear how they work together.

This article walks through the main VPC features in an order you can follow when examining an existing network.

VPC and IP addresses
        ↓
Subnets and routes
        ↓
Connections to other networks
        ↓
Traffic controls
        ↓
Logs and path analysis

The screenshots in this article are examples from an official AWS blog. What you see in your own console will depend on your Region and resources.

Check the Region and VPC First

Open the AWS VPC console and check the selected Region in the upper-right corner.

VPCs and subnets are managed by Region. If you cannot find the VPC you are looking for, check the Region first.

From Your VPCs in the left navigation, select a VPC and review:

VPC ID
IPv4 CIDR
Whether an IPv6 CIDR is assigned
DNS resolution
DNS hostnames
Associated DHCP option set

The CIDR defines an IP address range available to the VPC. For example, you can divide a VPC range such as 10.0.0.0/16 into smaller ranges for subnets.

Image source: AWS News Blog: VPC resource map

Use the Resource Map to See the Overall Layout

After selecting a VPC, open the Resource map tab.

It shows relationships among subnets, route tables, internet gateways, NAT gateways, and other supported resources.

Check:

How many subnets are in the VPC?
Which route table is associated with each subnet?
Is there a route to an internet gateway?
Is there a route to a NAT gateway?
Is there a gateway VPC endpoint?

You can select a resource in the map to open its details.

The resource map does not display every type of VPC resource. Check security groups, VPC peering connections, transit gateways, and other resources in their respective console pages.

Explore the VPC Creation Screen

To create a VPC, choose Create VPC.

Selecting VPC and more lets you configure a VPC along with subnets and other network resources. Before creating anything, use the preview to check what will be created.

Image source: AWS News Blog: VPC creation screen

The main choices include:

VPC CIDR
Availability Zones
Number of public and private subnets
NAT gateway placement
Whether to create an Amazon S3 gateway endpoint

Some resources, including NAT gateways, incur charges after creation. Review the preview before choosing Create VPC.

Check the Subnets

In Subnets, you can see how the VPC’s IP address range is divided.

Select a subnet and check:

Subnet ID
VPC ID
Availability Zone
IPv4 CIDR
Available IP address count
Auto-assign public IP setting
Associated route table

A subnet belongs to one Availability Zone. If you want to place an application across multiple zones, you need subnets in those zones.

A subnet is not public simply because its name contains public. Check whether its route table has a route to an internet gateway.

Image source: AWS News Blog: Availability Zone and subnet configuration

Check the Route Tables

In Route tables, you can see where traffic is sent based on its destination.

For example:

Destination	Target	Meaning
`10.0.0.0/16`	`local`	Traffic within the VPC
`0.0.0.0/0`	`igw-...`	Traffic sent to an internet gateway
`0.0.0.0/0`	`nat-...`	Traffic sent to a NAT gateway

Check both the routes and the subnets associated with the route table.

If a subnet has no explicit route table association, it uses the VPC’s main route table.

Image source: AWS News Blog: Route table relationships

When troubleshooting, check two separate questions: “Does the route exist?” and “Does this route table apply to the subnet I am investigating?”

Check Internet Gateways and NAT Gateways

In Internet gateways, check whether the internet gateway is attached to the intended VPC.

Attaching an internet gateway alone does not give an EC2 instance internet access. Its route table, public IP address, security group, and other settings also matter.

In NAT gateways, check the gateway used to handle outbound connections initiated from private subnets.

Review:

NAT gateway status
Public or private connectivity type
Zonal or regional availability mode
Subnet, if applicable
Elastic IP address, if applicable
Routes from private subnets to the NAT gateway

In a setup using a public NAT gateway, the private subnet’s default route points to the NAT gateway.

Private subnet → NAT gateway
Public subnet  → Internet gateway

Image source: AWS News Blog: VPC resource map after creation

Check Security Groups and Network ACLs

Security groups and network ACLs are two ways to control traffic.

Item	Security group	Network ACL
Applies to	Network interfaces used by resources such as EC2 instances	Subnets
Rules	Allow rules	Allow and deny rules
Return traffic	Stateful	Stateless

For example, if an ALB must reach an application on EC2, the EC2 security group can allow the application port from the ALB’s security group.

In Security groups, check both inbound and outbound rules.

In Network ACLs, check the associated subnets and both inbound and outbound rules. Because network ACLs are stateless, you also need to account for return traffic.

Check VPC Endpoints

In Endpoints, you can review private connections from the VPC to supported services and resources.

Common types include:

Gateway endpoints: Used with services such as Amazon S3 and DynamoDB
Interface endpoints: Provide private connectivity to supported services
Other endpoint types: Used according to the destination and connection requirements

For example, an EC2 instance in a private subnet does not always need to use a NAT gateway to access Amazon S3. An S3 gateway endpoint is another option.

When reviewing an endpoint, check its service name, VPC, and applicable route tables, subnets, or security groups. The relevant settings depend on the endpoint type.

Check Connections to Other VPCs and On-Premises Networks

A VPC may also communicate with networks other than the internet.

Feature	Common use
VPC peering	Connect two VPCs
Transit Gateway	Connect multiple VPCs and networks through a central hub
Site-to-Site VPN	Connect a remote network over a VPN
Direct Connect	Connect using a dedicated network connection

If your environment uses one of these options, check more than whether the connection exists. Review the route tables on both sides as well.

Also check whether the IP address ranges overlap between networks you intend to connect.

Check DNS and IP Address Management

A connection can fail even when the network route is correct if the instance cannot resolve a DNS name.

Start with the VPC’s DNS resolution and DNS hostnames settings. If your organization uses its own DNS servers, also check the DHCP option set and relevant Route 53 Resolver configuration.

For IP address planning across multiple VPCs, review VPC IP Address Manager (IPAM).

IPAM helps plan, allocate, and monitor CIDR ranges. If you expect to connect multiple environments, checking for overlapping ranges before creating VPCs can prevent problems later.

Use VPC Flow Logs to Inspect Traffic Records

You can check Flow Logs from a VPC, subnet, or network interface.

VPC Flow Logs capture information about IP traffic to and from network interfaces.

When investigating a connection problem, examine:

Whether the traffic appears in the logs
Source and destination IP addresses
Port numbers
Records showing accepted or rejected traffic

Flow Logs alone may not explain every failure. Compare them with application logs, routes, and security group rules.

Use Reachability Analyzer to Investigate a Path

Reachability Analyzer examines whether your network configuration permits a path from a specified source to a destination.

For example, if an EC2 instance cannot reach an RDS database, you can specify the source, destination, and destination port.

If the destination is unreachable, the analysis can help identify the configuration that blocks the path. This is a configuration analysis tool; it does not send application traffic or guarantee that the application works.

Use Network Access Analyzer to Find Unintended Paths

Reachability Analyzer checks a path you specify. Network Access Analyzer searches for paths that match your chosen conditions.

For example, you can investigate whether an unintended path from an external network to your resources exists.

It can also help you review network access after changing your VPC configuration.

Where Should You Start?

Choose a starting point based on what you need to investigate.

Question	Start here
What does the overall VPC look like?	Your VPCs → Resource map
What IP ranges are in use?	Your VPCs, Subnets, IPAM
Is a subnet public or private?	Subnets → Route table
How does internet access work?	Route tables, Internet gateways, NAT gateways
Which traffic is allowed?	Security groups, Network ACLs
How does the VPC access AWS services privately?	Endpoints
How does it connect to other networks?	Peering connections, Transit gateways, VPN
Why is DNS resolution failing?	VPC DNS settings, DHCP option sets, Route 53 Resolver
What traffic was recorded?	Flow Logs
Where is a network path blocked?	Reachability Analyzer, Network Access Analyzer

Summary

When examining a VPC, start with the resource map to understand how its main components are connected.

Then follow the traffic path:

Which VPC?
    ↓
Which subnet?
    ↓
Which route table?
    ↓
Where does the route lead?
    ↓
Do the security group and network ACL allow the traffic?
    ↓
What do the logs and analysis tools show?

VPC has more detailed settings and connection options than a single article can cover. Start with the main features involved in the traffic path, then investigate individual features as needed.

References

📈📲Getting Started with Google AppSheet and Data Studio Build a Data Entry App and a Report

Naoki — Mon, 28 Sep 2026 05:31:13 +0000

Getting Started with Google AppSheet and Data Studio｜Build a Data Entry App and a Report

If you manage data in Google Sheets, you may want an easier way to enter records and a clearer way to see the results.

In this article, we will use equipment purchase records to create a data entry app with AppSheet and a report with Data Studio.

Enter purchase records in AppSheet
                ↓
Store them in Google Sheets
                ↓
Analyze them in Data Studio

Data Studio was previously called Looker Studio. You may still see the Looker Studio name in older articles and screenshots.

What We Will Build

In AppSheet, we will create a purchase list, an entry form, and a button that marks an item as purchased.

In Data Studio, we will create a chart showing the total purchase amount by category.

Tool	Role
Google Sheets	Stores purchase records
AppSheet	Adds and edits records
Data Studio	Summarizes and visualizes records

Prepare a Google Sheet

Create a spreadsheet with these columns:

ID	Purchase date	Item	Category	Amount	Status
A001	2026/09/01	Notebook	Stationery	300	Purchased
A002	2026/09/02	Mouse	Computer accessories	2500	Not purchased
A003	2026/09/03	Pen	Stationery	200	Purchased

Put the column names in the first row and the records in the rows below.

The ID column identifies each record. Do not reuse the same ID for different rows. Enter purchase dates as dates and amounts as numbers.

Create an AppSheet App

Create → App → Start with existing data

Choose Google Sheets as the data source and select the spreadsheet you prepared.

After the app is created, check Data, App, and Actions in the editor’s left navigation.

Image source: AppSheet Help: Explore the app editor

Check the Columns in Data

Data is where you configure the tables and columns used by the app.

Open the purchase records table and check:

ID: Set as the Key, with a unique value in every row
Purchase date: Recognized as a Date
Item: Recognized as Text
Category: Recognized as Text or a selectable Enum
Amount: Recognized as a numeric value
Status: Recognized as Text or a selectable Enum

If AppSheet assigns the wrong type to a column, change its Type.

Image source: AppSheet Help: Columns

This image is an example from the official documentation. In your own app, check the ID and Amount columns in the purchase records table.

Check the List and Form in Views

To configure the screens that people use, open Views under App in the editor.

Check these screens:

A list of purchase records
A form for adding a purchase record
A detail screen that opens when a record is selected

For the list, a Table view displays the records in rows. In the form, check that users can enter the item, category, amount, and other necessary details.

Image source: AppSheet Help: Improvements in the app editor

After configuring the screens, add a record in the preview. Changes made in the preview are saved to the connected spreadsheet, so use test data first.

Create a “Mark as Purchased” Action

An Action defines what happens when a user presses a button.

We will create a button that changes Status to Purchased.

Actions → + → Create a new action

Configure it as follows:

Setting	Value
For a record of this table	Purchase records table
Action name	Mark as Purchased
Do this	Set the values of some columns in this row
Column to change	`Status`
Value to set	`Purchased`

If needed, add a condition so the button appears only for records whose status is Not purchased.

Image source: AppSheet Help: Actions

The image shows an official Action example, not this purchase records app. After creating your Action, press the button in the preview and check that Status also changes in the spreadsheet.

Create a Data Studio Report

Next, open Data Studio and create a report.

Choose Google Sheets as the data source, then select the spreadsheet used by the AppSheet app.

Create a report in Data Studio
               ↓
Choose Google Sheets
               ↓
Select the purchase records sheet
               ↓
Add it to the report

Check that Purchase date is recognized as a date and Amount as a numeric field.

You can also create a Data Studio report from the Google Sheet’s Extensions menu.

Chart the Purchase Amount by Category

Add a bar chart to the report and configure these fields:

Field	Value
Dimension	`Category`
Metric	Sum of `Amount`
Filter	Records where `Status` is `Purchased`

With the sample data above, the result we expect is:

Category	Purchased amount
Stationery	500

The mouse is marked Not purchased, so its amount is excluded.

The following image is an official example of charts created in Data Studio. It uses different data from our purchase records, but shows what a finished chart can look like.

Image source: Google Cloud documentation: Bar chart and column chart reference

If you publish this article as a record of your own work, replace this example with a screenshot of the purchase amount chart you created.

Check the Complete Data Flow

Finally, use both AppSheet and Data Studio to check that everything works:

Add a purchase record in AppSheet
Confirm that a new row appears in Google Sheets
Use the AppSheet Action to change its status to Purchased
Check the report in Data Studio

If the change does not appear immediately in Data Studio, refresh the report data. If you add a new column to the spreadsheet, refresh the fields in the Data Studio data source as well.

Summary

AppSheet provides a screen for entering and updating records. Data Studio provides a report for analyzing them.

AppSheet
Enter and update records
          ↓
Google Sheets
Store the data
          ↓
Data Studio
Summarize and visualize it

Showing the Data, Views, and Actions settings in AppSheet alongside the finished Data Studio report helps readers see how the settings lead to the final result.

References

🍊How to Set Up an AWS NAT Gateway Give EC2 Instances in a Private Subnet Internet Access

Naoki — Mon, 28 Sep 2026 05:18:05 +0000

How to Set Up an AWS NAT Gateway｜Give EC2 Instances in a Private Subnet Internet Access

An EC2 instance in a private subnet may need to download OS updates or access an external API.

This article explains how to use a public NAT gateway so an EC2 instance in a private subnet can initiate connections to the internet.

The traffic will follow this path:

EC2 instance in a private subnet
              ↓
       Public NAT gateway
              ↓
       Internet gateway
              ↓
           Internet

Creating a NAT gateway alone is not enough. You also need to check the route tables associated with both the public and private subnets.

Resources Used in This Guide

This setup uses:

A VPC
A public subnet
A private subnet
An internet gateway attached to the VPC
A public NAT gateway
An Elastic IP address for the NAT gateway
An EC2 instance in the private subnet for testing

If you already have a VPC and subnets, check their routes first. A subnet’s name may contain “public” or “private,” but its route table determines where its traffic goes.

Check the Public Subnet

In the AWS console, open:

VPC → Subnets → Target subnet ID → Route table

In the route list, find the row whose Destination is 0.0.0.0/0.

Destination    Target
0.0.0.0/0      igw-...

If the Target is igw-..., the subnet has a route to an internet gateway.

Here is an example of the route table in the console:

In this screenshot, 172.31.0.0/16 → local represents traffic within the VPC, while 0.0.0.0/0 → igw-... is the route for internet-bound traffic.

An EC2 instance in this subnet would also need a public IP address, among other settings, to communicate directly with the internet. For now, we are checking whether this subnet is suitable for the NAT gateway.

Check the Private Subnet

Next, check the route table associated with the private subnet where the EC2 instance runs.

VPC → Subnets → Target subnet ID → Route table

For this setup, do not give the private subnet a direct 0.0.0.0/0 → igw-... route.

After configuring the NAT gateway, its route for internet-bound traffic will look like this:

Destination    Target
0.0.0.0/0      nat-...

This route does not need to exist before you create the NAT gateway.

Create a Public NAT Gateway

In the AWS console, open:

VPC → NAT gateways → Create NAT gateway

For this guide, choose a zonal public NAT gateway.

Setting	Selection
Availability mode	Zonal
Subnet	The public subnet you checked
Connectivity type	Public
Elastic IP	Select an existing Elastic IP or allocate a new one

Review the settings and create the NAT gateway.

Immediately after creation, its status is Pending. Wait until it becomes Available before configuring the route.

Select the public subnet that has a route to the internet gateway. Do not select the private subnet containing the EC2 instance.

Route the Private Subnet Through the NAT Gateway

After creating the NAT gateway, edit the route table associated with the private subnet.

VPC → Subnets → Target private subnet → Route table

Open the displayed route table ID, then choose Actions → Edit routes.

Set the route for internet-bound traffic as follows:

Destination    Target
0.0.0.0/0      Your NAT gateway (nat-...)

Before editing, check:

If a 0.0.0.0/0 route already exists, where does it currently point?
Is this route table associated with the private subnet you intend to change?

Changing an existing route can affect traffic that uses it. Editing a different route table will not change the intended subnet’s traffic path.

Recheck the Public Subnet Route

The public subnet containing the NAT gateway needs a route to the internet gateway.

Destination    Target
0.0.0.0/0      igw-...

The default routes should point to different targets:

Subnet	Target for `0.0.0.0/0`
Private subnet	NAT gateway (`nat-...`)
Public subnet	Internet gateway (`igw-...`)

This creates a path for connections initiated in the private subnet to reach the internet through the NAT gateway.

Test Connectivity from the EC2 Instance

Connect to the EC2 instance in the private subnet and try an HTTPS request:

curl -I https://example.com

If you receive a response, the instance can reach that external site.

If the request fails, check:

Is the NAT gateway’s status Available?
Does the private subnet’s 0.0.0.0/0 route point to the NAT gateway you created?
Does the NAT gateway’s public subnet have a 0.0.0.0/0 route to the internet gateway?
Does the EC2 instance’s security group allow the required outbound traffic?
Are network ACLs blocking the traffic?
Can the instance resolve DNS names?

A NAT gateway does not allow new connections from the internet to reach an EC2 instance in the private subnet.

Cost and Architecture Considerations

NAT gateways incur charges based on factors such as running time and the amount of data processed. If you create one for testing, delete it when you no longer need it.

The zonal NAT gateway in this guide belongs to a single Availability Zone. For a setup spanning multiple Availability Zones, consider placing a NAT gateway in each zone and routing each private subnet through a NAT gateway in the same zone.

A regional NAT gateway is another option. It does not require placement in a public subnet, and its setup differs from the steps in this guide.

Summary

To let an EC2 instance in a private subnet initiate internet connections through a public NAT gateway:

Find a public subnet with a route to an internet gateway
Create a public NAT gateway in that subnet
Point the private subnet’s 0.0.0.0/0 route to the NAT gateway
Test outbound connectivity from the EC2 instance

Pay particular attention to the route tables for both subnets. Even if the NAT gateway is Available, the EC2 instance will not use it unless the private subnet’s route points to it.

References

🚧What Is a Private IP Address? How to Identify One and Handle IP Conflicts

Naoki — Mon, 28 Sep 2026 05:09:13 +0000

What Is a Private IP Address? How to Identify One and Handle IP Conflicts

An IP address is like an address for a device on a network.

When you check the network settings on a computer or smartphone, you might see an address like this:

192.168.1.10

This is a private IP address. Let’s look at where private IP addresses are used, how to identify them, and what happens when addresses overlap.

What Is a Private IP Address?

A private IP address is used within a network, such as a home or company network.

For example, devices on the same home network might have these addresses:

Computer     192.168.1.10
Smartphone   192.168.1.11
Printer      192.168.1.12

Private IP addresses are not routed directly across the public internet. This means different homes or companies can use the same private IP addresses.

How to Identify a Private IP Address

Private IPv4 addresses fall within these defined ranges:

Range	Example
`10.0.0.0`–`10.255.255.255`	`10.1.2.3`
`172.16.0.0`–`172.31.255.255`	`172.20.1.10`
`192.168.0.0`–`192.168.255.255`	`192.168.1.10`

To remember them, focus on how the addresses begin:

10
172.16 through 172.31
192.168

Be careful with addresses beginning with 172. For example, 172.20.1.10 is private, but 172.32.1.10 is outside the private range.

How Is a Public IP Address Different?

A public IP address is used to identify a destination on the internet.

Type	Where it is mainly used	Can the internet reach it directly?
Private IP	Home or company networks	Generally no
Public IP	The internet	Depends on the connection and network settings

There is no simple rule such as “all addresses beginning with this number are public.” Some addresses outside the private ranges are reserved for other purposes, so an address is not necessarily public just because it is not private.

On a typical home network, devices receive private IP addresses and connect to the internet through a router.

Why Can Multiple Devices Appear to Have the Same IP Address?

Devices within a home or company network have different private IP addresses.

However, a website on the internet may see several of those devices as connecting from the same public IP address.

This happens because a router uses a mechanism called NAT to translate their network traffic.

Computer     192.168.1.10 ─┐
Smartphone   192.168.1.11 ─┼→ Router → Internet
Printer      192.168.1.12 ─┘

Therefore, the same public IP address appearing in access logs does not necessarily mean the requests came from the same device or person.

What Happens When IP Addresses Conflict?

Different homes or companies can use the same private IP address without a problem.

But if devices on the same network are assigned the same IP address, their connections may become unreliable.

Common symptoms include:

No internet connection
Unable to access an internal system
Intermittent connectivity
An IP address conflict warning

Usually, a router or another DHCP server assigns IP addresses automatically. If a device has a manually configured address, check whether another device is using it.

What to Check When There Is a Problem

If a device has a network problem, check:

The device’s IP address
Whether it falls within a private IP range
Whether another device has the same address
Whether the address is assigned automatically or configured manually

You can also try reconnecting to Wi-Fi or restarting the device. If the problem continues, give your network administrator the IP address you found and the time the problem occurred.

If the device shows an address beginning with 169.254, it may have been unable to obtain an address from DHCP.

How to Check Your IP Address

On Windows, run this command in Command Prompt:

ipconfig

On macOS, open System Settings and follow this path:

Network → Connected Wi-Fi → Details

On Linux, run this command in a terminal:

ip address

Summary

Private IP addresses are used within networks such as homes and offices.
You can identify them by checking whether they fall within the defined ranges.
Different networks can use the same private IP addresses.
Duplicate addresses on the same network can cause connection problems.
Requests from the same public IP address do not necessarily come from the same device.

When checking an IP address, consider both what kind of address it is and which network is using it.

🍊Amazon ECS vs. EC2: What’s the Difference, and Which Should You Choose?

Naoki — Mon, 28 Sep 2026 05:01:39 +0000

🍊Amazon ECS vs. EC2: What’s the Difference, and Which Should You Choose?

When running an application on AWS, Amazon EC2 and Amazon ECS often come up as options.

In simple terms:

EC2 = A service that provides virtual servers

ECS = A service for managing and running containers

However, ECS can also use EC2 as the environment where its containers run. So this is not simply a question of which service is better.

How Are ECS and EC2 Different?

Here is a comparison of EC2 and ECS with Fargate:

Item	EC2	ECS + Fargate
Main role	Provides virtual servers	Manages and runs containers
Server management	Required	Generally handled by AWS
OS management	Required	Handled by AWS
Flexibility	High	More limited than EC2
Operational work	Generally higher	Generally lower
Cost	Offers various ways to optimize costs	Can cost more because AWS manages the underlying servers
Common use cases	Fine-grained control, special requirements, existing systems	Web apps, APIs, batch jobs

What Is EC2?

Amazon EC2 (Elastic Compute Cloud) is a service for creating virtual servers on AWS.

AWS
 ↓
EC2
 ↓
OS
 ↓
Application

EC2 gives you control over the server, including its OS and middleware.

That control also means you need to manage the server itself, including OS updates and security maintenance.

What Is ECS?

Amazon ECS (Elastic Container Service) is a service for managing and running containers.

ECS
 ↓
Task
 ↓
Container

ECS helps manage where containers run, when they start and stop, and how they scale.

ECS does not provide the underlying server on its own. Your containers still need an environment in which to run.

ECS Can Run Tasks on EC2 or Fargate

Two common ways to run ECS tasks are Amazon EC2 and AWS Fargate.

        ECS
       /   \
     EC2   Fargate
      ↓       ↓
    Task     Task
      ↓       ↓
 Container Container

ECS + EC2

You provision EC2 instances and run ECS tasks on them.

You need to manage the instances, but you have more control over choices such as instance types and the OS.

ECS + Fargate

AWS manages the underlying servers that run your containers.

Because you do not need to manage EC2 instances yourself, Fargate can reduce operational work.

ECS + Fargate Is Often Convenient for New Services

For a new web application, API, or batch job, ECS with Fargate is often a good option to consider.

AWS manages the underlying servers, which can reduce work related to:

OS maintenance
EC2 instance management
Server capacity management

If you have no special requirements, you can start by checking whether Fargate meets your needs.

When Is EC2 a Good Fit?

EC2 can be a better fit when you need to:

Move an existing system with few changes
Control the OS in detail
Run specialized software
Configure settings at the instance level
Run an application that is difficult to containerize
Optimize infrastructure costs in detail

EC2 requires you to manage more of the environment, but it also gives you more flexibility.

Is EC2 Cheaper?

If you compare compute charges alone, EC2 can be cheaper in some cases.

For example, EC2 offers opportunities to consolidate workloads onto instances and use pricing options suited to long-term usage.

With Fargate, AWS manages the underlying servers. As a result, a comparable CPU and memory configuration can sometimes cost more.

However, the total cost also includes operational work, such as the engineering time needed to manage servers.

EC2
Potentially lower infrastructure charges
+
Server management work

Fargate
Potentially higher infrastructure charges
+
Less server management work

It is useful to compare both AWS charges and operational costs.

Should You Choose EC2 If You Have Infrastructure Engineers?

If your team can design and operate EC2 effectively, it can be a strong option.

EC2’s advantages may be especially useful when you have:

Engineers who can operate EC2
+
A need to optimize infrastructure costs
+
A need for fine-grained control

Even then, having experienced infrastructure engineers does not mean you must choose EC2.

If Fargate frees up their time for other development work, reducing operational work may be valuable.

Can You Move an Existing System to ECS?

Many web applications, APIs, and batch jobs can be containerized and moved to ECS.

Application on EC2
        ↓
Containerize the application
        ↓
ECS
        ↓
Fargate / EC2

However, containerization can be more difficult if the system depends heavily on:

The host OS
Specialized middleware
Local disks
Special network configurations

So the decision is not always “EC2 for existing systems, ECS for new systems.” It depends on the application’s requirements.

When Were EC2 and ECS Introduced?

Amazon EC2 became available in 2006 and has been part of AWS since its early days.

Amazon ECS was announced in 2014 and became generally available in 2015.

EC2 provides virtual servers. ECS was introduced to help manage containerized applications.

Which Should You Choose?

A simple way to think about the choice is:

Want less server management
        ↓
ECS + Fargate


Need cost optimization and fine-grained control
+
Have a team that can manage EC2
        ↓
ECS + EC2 / EC2


Have an existing system or special requirements
        ↓
Consider EC2

For a new service, you can consider ECS with Fargate first, then evaluate EC2 if costs or technical requirements call for it.

Summary

The main difference is:

EC2 = Virtual servers

ECS = A service for managing containers

ECS can run its containers on either EC2 or Fargate.

When choosing an approach, you can start with these questions:

Want less server management?
        ↓
ECS + Fargate

Have an operations team and need cost optimization or more control?
        ↓
EC2 / ECS + EC2

Consider the time and people needed to operate the system alongside the AWS bill.

🚢A Beginner’s Guide to Running a Web App on ECS: How ECR, Task Definitions, and ALB Work Together

Naoki — Mon, 28 Sep 2026 04:58:23 +0000

A Beginner’s Guide to Running a Web App on ECS: How ECR, Task Definitions, and ALB Work Together

When you start learning Amazon ECS, you encounter many AWS services and settings:

ECS clusters
ECR
Task definitions
ECS services
VPCs
Security groups
ALB

You may understand each one separately but still wonder:

“What do I actually need to run a new web app on ECS?”

If someone asks you to run an app on ECS, you can start by thinking through this setup:

Prepare a Docker image in ECR
        ↓
Create a task definition
        ↓
Create an ECS service
        ↓
Configure the VPC, subnets, and security groups
        ↓
Make the app accessible through an ALB
        ↓
Set up logs and monitoring

This article explains the basic setup for running a web application on ECS.

Understand the Overall ECS Architecture

A typical setup for a web application accessible from the internet looks like this:

                    Internet
                       ↓
                      ALB
                       ↓
              ┌────── VPC ──────┐
              │                  │
              │   ECS Service    │
              │       ↓          │
              │     Task         │
              │       ↓          │
              │   Container      │
              │                  │
              └──────────────────┘
                       ↑
                      ECR

Container
   ↓
CloudWatch Logs

Here is what each part does:

Component	Role
ECR	Stores Docker images
Task definition	Defines how containers run
ECS task	Runs the containers
ECS service	Maintains the desired number of tasks
VPC / subnet	Provides the network where tasks run
Security group	Controls network traffic
ALB	Routes user requests to ECS tasks
CloudWatch Logs	Stores application logs for viewing and troubleshooting

Understanding these relationships makes the overall ECS setup easier to follow.

Prepare a Docker Image in ECR

To run an application on ECS, you first need a container image.

For example, if your application is written in:

Node.js
Python
PHP
Java

you can create a Dockerfile and build a Docker image.

Application
     ↓
Dockerfile
     ↓
Docker image

Amazon ECR (Elastic Container Registry) is an AWS service for storing that image.

Source code
     ↓
docker build
     ↓
Docker image
     ↓
    ECR

In simple terms, ECR is:

A place to store the Docker images used by ECS

When a task starts, it pulls its image from ECR or another container registry.

Create a Task Definition

After preparing the Docker image, create a task definition.

A task definition is a blueprint that tells ECS how to run your containers.

For example, it specifies:

Which Docker image should ECS use?
How much CPU does the task need?
How much memory does it need?
Which port does the container use?
Which environment variables does it need?
Where should its logs go?

A simplified example looks like this:

Task Definition

Image
→ Docker image in ECR

CPU
→ 1024

Memory
→ 2048

Port
→ 8080

Logs
→ CloudWatch Logs

An ECS task is a running instance created from a task definition.

Task definition
       ↓
“Start with these settings”
       ↓
ECS task
       ↓
Container

You can think of the task definition as the blueprint and the task as something running from that blueprint.

Create an ECS Service

An ECS service is useful when you want tasks to keep running.

Suppose you always want two tasks running:

Keep two tasks running

Set the service’s desired count to 2:

ECS Service

Desired Count = 2

      ↓

┌────────┐
│ Task 1 │
└────────┘

┌────────┐
│ Task 2 │
└────────┘

If Task 1 stops unexpectedly, the service starts a replacement to maintain the desired count.

Task 1
  ↓
Stops

ECS Service
  ↓
Starts a new task

That is why ECS services are commonly used for web applications that need to keep running.

What Is an ECS Cluster?

You will also come across the term cluster.

An ECS cluster is a logical group for ECS services and tasks.

ECS Cluster
     │
     ├── ECS Service A
     │       ├── Task
     │       └── Task
     │
     └── ECS Service B
             ├── Task
             └── Task

You can manage multiple services and tasks within the same cluster.

Fargate Lets You Run Tasks Without Managing EC2 Instances

Two common ways to run ECS tasks are:

ECS on EC2
AWS Fargate

With ECS on EC2, your tasks run on EC2 instances that you manage.

ECS + EC2

ECS
 ↓
EC2
 ↓
Task
 ↓
Container

With Fargate, AWS manages the underlying compute infrastructure, so you do not need to manage the EC2 instances yourself.

ECS + Fargate

ECS
 ↓
Fargate
 ↓
Task
 ↓
Container

For a new web application, ECS with Fargate is often a reasonable option to consider unless you have specific requirements for running on EC2.

Configure the VPC, Subnets, and Security Groups

You also need to plan the network where your ECS tasks will run.

For example, Fargate tasks run in subnets within a VPC.

VPC
 ↓
Subnet
 ↓
ECS task

A common web application setup places an internet-facing ALB in public subnets and ECS tasks in private subnets.

Internet
   ↓
ALB in public subnets
   ↓
ECS tasks in private subnets

Users access the application through the ALB, while the tasks remain in private subnets.

Configure Security Groups

Security groups control which network traffic is allowed.

For example, suppose users connect to the ALB over port 443, and the ALB sends requests to tasks over port 8080.

Internet
   ↓
Port 443
   ↓
ALB
   ↓
Port 8080
   ↓
ECS task

The ALB’s security group can allow inbound traffic on port 443 from the internet.

Internet
   ↓
Allow port 443
   ↓
ALB

The tasks’ security group can allow inbound traffic on port 8080 from the ALB’s security group.

ALB security group
        ↓
Allow port 8080
        ↓
ECS task

This lets the ALB reach the tasks without allowing the entire internet to connect directly to the tasks’ application port.

Configure an ALB

An Application Load Balancer (ALB) is commonly used to make a web application accessible from outside the VPC.

User
 ↓
ALB
 ↓
ECS task

The ALB receives user requests and forwards them to the ECS tasks.

If multiple tasks are running, the ALB can distribute requests among them.

             ALB
              ↓
        ┌─────┴─────┐
        ↓           ↓
      Task 1      Task 2

How Target Groups Fit In

A target group connects ALB routing to the tasks that receive requests.

Internet
   ↓
ALB
   ↓
Target group
   ↓
ECS task

An ALB listener rule forwards requests to a target group. The ECS tasks are registered as targets in that group.

When you connect an ECS service to an ALB, ECS registers and deregisters tasks as they start and stop.

Health Checks Matter Too

A target group can check whether an ECS task is responding properly.

For example, it might request:

/health

and expect:

HTTP 200

The check looks like this:

ALB target group
       ↓
GET /health
       ↓
ECS task
       ↓
200 OK
       ↓
Healthy

Health checks help the ALB avoid routing user requests to tasks that are not responding as expected.

Set Up Logs and Monitoring

Even if the application starts successfully, troubleshooting is difficult if you cannot see its logs.

ECS can send container logs to Amazon CloudWatch Logs.

ECS task
   ↓
Container
   ↓
Application logs
   ↓
CloudWatch Logs

Those logs can help you inspect:

Application errors
HTTP requests
Startup errors
Exceptions

A common setup uses the awslogs log driver in the task definition.

Monitor with CloudWatch

Logs are only one part of monitoring. You should also consider metrics and alarms, such as:

CPU utilization
Memory utilization
Running task count
ALB 5xx errors
Healthy and unhealthy target counts

ECS / ALB
    ↓
CloudWatch
    ↓
Metrics / Logs
    ↓
Alarms

The goal is to notice when the application has a problem, not just confirm that it started once.

You Can Also Configure Auto Scaling

If traffic varies, ECS Service Auto Scaling can adjust the number of running tasks.

For example:

Normal load

2 tasks

When load increases:

More traffic
     ↓
Higher CPU utilization
     ↓
Auto Scaling
     ↓
4 tasks

You can also configure scaling to reduce the task count when load falls.

What Should You Check When Asked to “Run This on ECS”?

When setting up a new web application on ECS, these questions help you understand what is needed:

Item	What to check
Docker	Can the application run in a container?
ECR	Where will the image be stored?
Task definition	What CPU, memory, port, and environment variables are needed?
ECS service	How many tasks should run, and how will deployments work?
Launch option	Will the tasks run on Fargate or EC2?
VPC	Which VPC will contain the tasks?
Subnets	Will the tasks use public or private subnets?
Security groups	Which traffic should be allowed between the ALB and tasks?
ALB	Does the application need external access?
Target group	Where should requests go, and how will health checks work?
CloudWatch Logs	Where will container logs be stored?
Monitoring	Which metrics and errors should trigger alerts?
Auto Scaling	Should the number of tasks change with load?

The Flow from Application to Running Tasks

Here is the overall setup flow:

Application
     ↓
Build a Docker image
     ↓
Push the image to ECR
     ↓
Task definition
・Image
・CPU
・Memory
・Port
・Environment
・Logs
     ↓
ECS service
・Desired count
・Fargate / EC2
     ↓
VPC / Subnets / Security groups
     ↓
ALB / Target group
     ↓
CloudWatch Logs / Monitoring
     ↓
Auto Scaling

From a user’s point of view, requests follow this route:

User
 ↓
Internet
 ↓
ALB
 ↓
Target group
 ↓
ECS task
 ↓
Container
 ↓
Application

The deployment flow is different:

Source code
     ↓
Docker build
     ↓
ECR
     ↓
Task definition
     ↓
ECS service
     ↓
ECS task

Keeping the request path and the deployment flow separate makes the architecture easier to understand.

Summary

Running a web application on ECS involves more than configuring ECS alone. You also need an image registry, networking, a way to route requests, and a way to observe the application.

A useful overview is:

ECR
 ↓
Task definition
 ↓
ECS service
 ↓
VPC / Security groups
 ↓
ALB
 ↓
Logs / Monitoring

Each component has a different job:

ECR
→ Stores Docker images

Task definition
→ Defines how containers run

ECS task
→ Runs the containers

ECS service
→ Maintains the desired number of tasks

VPC / Security groups
→ Provide networking and control traffic

ALB / Target group
→ Route user requests to ECS tasks

CloudWatch
→ Provides logs, metrics, and alarms

When someone asks you to run a new app on ECS, start by checking what you need for the image, task definition, service, network, ALB, and monitoring.