Say you have a bunch of EC2 instances in an auto scaling group & you have a requirement to be able to connect to them via SFTP. Maybe they’re web servers sharing an EFS & you wanna get to that mounted EFS via SFTP. Or maybe you wanna download tons of application logs by SFTP-ing to the instances directly.
The problem here is that since the instances are in an auto scaling group, they could die & recreate any time & when they do, they change their IPs. Not to mention that they’re most likely not publicly accessible & you’ll need a bastion host to SFTP to them anyway.
Wouldn’t it be great if you could target your SFTP connection to a load balancer in front of the auto scaling group, instead of individual instances in the group itself. The LB won’t change its DNS name, unlike the private IP of the EC2s behind it. And you also don’t need to pay for a bastion host!
This can be achieved simply by creating a listener in the network load balancer as shown below. Application load balancer cannot be used here because it only supports HTTP(S) listeners.
Next, ensure that stickiness is enabled in the target group’s settings:
Now you can use any SFTP client like FileZilla to connect to the NLB’s DNS name & that’ll get you an SFTP session with 1 of the web servers:
Harish KM 