Migrate Application Load Balancer from IPv4 to dual-stack without public IPv4

To migrate your Application Load Balancer (ALB) from IPv4 to dual-stack without public IPv4 while still supporting both IPv4 and IPv6 clients, you'll need to consider a few important points:

1. The dual-stack without public IPv4 option for ALB allows clients to connect using only IPv6 addresses. This means that direct IPv4 connections to the ALB will no longer be possible.

2. To support both IPv4 and IPv6 clients with this configuration, you would need to implement an intermediary service or solution that can handle IPv4 traffic and forward it to your IPv6-only ALB.

3. One potential solution is to use a content delivery network (CDN) that supports both IPv4 and IPv6 endpoints. The CDN can act as an intermediary, accepting connections from both IPv4 and IPv6 clients and forwarding the traffic to your IPv6-only ALB.

4. Another option could be to set up a separate IPv4-capable proxy or load balancer in front of your IPv6-only ALB. This proxy would handle IPv4 connections and forward them to the ALB using IPv6.

5. Before migrating, it's crucial to verify that you don't have any clients still connecting using public IPv4. You can check this using the ALB access logs, specifically looking at the client:port field.

6. When implementing this change, consider creating two separate environments - one with the new IPv6-only configuration and one with the existing IPv4 setup. This allows you to test the new environment thoroughly before directing live application traffic to it.

7. Keep in mind that if you're using external identity provider (IdP) authentication with your ALB, you'll need to ensure that your ALB's subnet can reach the IdP public endpoint, as this communication typically uses IPv4.

8. Remember that while the ALB will only accept IPv6 connections from clients, it remains dual-stack for communication between the load balancer and your application targets. This means your backend services can still use both IPv4 and IPv6 as needed.

By implementing one of these solutions, you can maintain support for both IPv4 and IPv6 clients while benefiting from the cost savings of removing public IPv4 addresses from your ALB.

Sources
Introducing dual-stack without public IPv4 Application Load Balancer | Networking & Content Delivery
Update the IP address types for your Application Load Balancer - Elastic Load Balancing
ELB - Dualstack without public IPv4 - clarifcation needed | AWS re:Post