Are there any problems with this AWS architecture proposal?

│ │ Network Load Balancer Implementation Plan for DCV WebSocket Connections                                                │ │
│ │                                                                                                                        │ │
│ │ Current Architecture Overview                                                                                          │ │
│ │                                                                                                                        │ │
│ │ - Environment tasks are created dynamically by the orchestration service                                               │ │
│ │ - Each task runs DCV server on port 8443 with self-signed certificates                                                 │ │
│ │ - Frontend connects directly to task public IPs: https://{public_ip}:8443                                              │ │
│ │ - Current setup causes browser certificate warnings                                                                    │ │
│ │                                                                                                                        │ │
│ │ Proposed Solution: NLB with SSL/TLS Termination                                                                        │ │
│ │                                                                                                                        │ │
│ │ 1. Create Network Load Balancer Infrastructure                                                                         │ │
│ │                                                                                                                        │ │
│ │ - File: computer_use_aws/constructs/load_balancing.py                                                                  │ │
│ │   - Add new NetworkLoadBalancerConstruct class                                                                         │ │
│ │   - Configure NLB for TCP traffic on port 8443                                                                         │ │
│ │   - Enable cross-zone load balancing for better distribution                                                           │ │
│ │   - Create target group for environment tasks                                                                          │ │
│ │                                                                                                                        │ │
│ │ 2. Implement SSL/TLS Certificate Management                                                                            │ │
│ │                                                                                                                        │ │
│ │ - File: computer_use_aws/constructs/security.py                                                                        │ │
│ │   - Add ACM certificate request for NLB domain                                                                         │ │
│ │   - Use DNS validation (preferred) or email validation                                                                 │ │
│ │   - Certificate will validate *.elb.amazonaws.com domain                                                               │ │
│ │                                                                                                                        │ │
│ │ 3. Configure NLB Listener with TLS                                                                                     │ │
│ │                                                                                                                        │ │
│ │ - File: computer_use_aws/constructs/load_balancing.py                                                                  │ │
│ │   - Add TLS listener on port 8443                                                                                      │ │
│ │   - Configure SSL policy for WebSocket compatibility                                                                   │ │
│ │   - Set backend protocol to TCP (pass-through to DCV)                                                                  │ │
│ │                                                                                                                        │ │
│ │ 4. Dynamic Target Registration                                                                                         │ │
│ │                                                                                                                        │ │
│ │ - File: computer_use_aws/constructs/serverless.py                                                                      │ │
│ │   - Create Lambda function to register/deregister ECS tasks                                                            │ │
│ │   - Trigger on ECS task state changes (EventBridge)                                                                    │ │
│ │   - Register tasks with private IPs to NLB target group                                                                │ │
│ │                                                                                                                        │ │
│ │ 5. Update Security Groups                                                                                              │ │
│ │                                                                                                                        │ │
│ │ - File: computer_use_aws/constructs/security.py                                                                        │ │
│ │   - Add NLB security group                                                                                             │ │
│ │   - Allow inbound 8443 from anywhere to NLB                                                                            │ │
│ │   - Update environment SG to allow 8443 from NLB only                                                                  │ │
│ │   - Remove direct public access to environment tasks                                                                   │ │
│ │                                                                                                                        │ │
│ │ 6. Modify Task Configuration                                                                                           │ │
│ │                                                                                                                        │ │
│ │ - File: computer_use_aws/stacks/container_stack.py                                                                     │ │
│ │   - Remove assignPublicIp: 'ENABLED' from environment tasks                                                            │ │
│ │   - Tasks will use private IPs only                                                                                    │ │
│ │   - Configure health checks for target group                                                                           │ │
│ │                                                                                                                        │ │
│ │ 7. Update Frontend Connection Logic                                                                                    │ │
│ │                                                                                                                        │ │
│ │ - File: computer_use_aws/frontend/src/TabContainer.tsx                                                                 │ │
│ │   - Change from https://{public_ip}:8443 to NLB endpoint                                                               │ │
│ │   - Use NLB DNS name with proper SSL certificate                                                                       │ │
│ │   - Update connection URL pattern                                                                                      │ │
│ │                                                                                                                        │ │
│ │ 8. Add NLB Outputs                                                                                                     │ │
│ │                                                                                                                        │ │
│ │ - File: computer_use_aws/stacks/main_stack.py                                                                          │ │
│ │   - Output NLB DNS name                                                                                                │ │
│ │   - Output NLB ARN for monitoring                                                                                      │ │
│ │   - Add instructions for DNS alias if custom domain needed                                                             │ │
│ │                                                                                                                        │ │
│ │ Benefits                                                                                                               │ │
│ │                                                                                                                        │ │
│ │ 1. Valid SSL Certificate: Browser trusts ELB certificate                                                               │ │
│ │ 2. Simplified Access: Single endpoint for all DCV connections                                                          │ │
│ │ 3. Better Security: Environment tasks not directly exposed                                                             │ │
│ │ 4. Scalability: NLB handles load distribution automatically                                                            │ │
│ │ 5. Health Monitoring: Built-in health checks for targets                                                               │ │
│ │                                                                                                                        │ │
│ │ Implementation Order                                                                                                   │ │
│ │                                                                                                                        │ │
│ │ 1. Create NLB and certificate infrastructure                                                                           │ │
│ │ 2. Set up Lambda for dynamic target registration                                                                       │ │
│ │ 3. Update security groups                                                                                              │ │
│ │ 4. Modify ECS task configuration                                                                                       │ │
│ │ 5. Update frontend to use NLB endpoint                                                                                 │ │
│ │ 6. Test end-to-end connectivity                                                                                        │ │
│ │                                                                                                                        │ │
│ │ Notes                                                                                                                  │ │
│ │                                                                                                                        │ │
│ │ - NLB preserves WebSocket connections (Layer 4)                                                                        │ │
│ │ - TLS termination at NLB, then TCP to backend                                                                          │ │
│ │ - Backend DCV self-signed certs remain unchanged                                                                       │ │
│ │ - Consider using custom domain with Route53 alias