All Products
Search
Document Center

Serverless App Engine:Best practices for ALB gateway routing

Last Updated:Apr 01, 2026

SAE applications are isolated from the public internet by default. To accept inbound traffic, configure ALB gateway routing to expose your applications through an Application Load Balancer (ALB) listener. Each listener rule you define on the SAE side is an inbound forwarding rule — it matches incoming requests against one or more conditions and then executes one or more actions.

This topic covers key parameter decisions. For step-by-step instructions on creating gateway routes, see Configuring route rules by Application Load Balancer (ALB).

How forwarding rules work

A forwarding rule has two parts: forwarding conditions and forwarding actions. When an incoming request matches all the conditions in a rule, ALB executes the specified actions.

image

For Standard Edition and WAF-Enabled Edition ALB instances:

  • Inbound rules — ALB applies these to the request before forwarding it to the backend. Configure inbound rules from the SAE console.

  • Outbound rules — ALB applies these to the backend response before returning it to the client. Configure outbound rules from the SLB console, not the SAE console.

When creating a rule:

  • An inbound rule can only contain inbound conditions and inbound actions.

  • An outbound rule can contain both inbound and outbound conditions, but only outbound actions.

Every rule must include one of these actions: Forward to, Redirect to, or Return fixed response.

Navigate to gateway routing

  1. Log on to the SAE console. In the left-side navigation pane, click Namespaces and select the target region.

  2. On the Namespace page, click the name of the target namespace.

  3. On the Basic Information page, click Gateway Routing in the left-side navigation pane, then click Create Gateway Route.

Forwarding conditions

On the SAE side, you can configure forwarding conditions based on domain name, access port, and path. The sections below explain each condition type and its matching options.

Domain name

ALB supports three matching types for domain names:

Matching typeHow it worksInput constraints
Exact matchThe request domain name must exactly equal the configured value3–128 characters; uppercase/lowercase letters, digits, and `. - ? = ~ _ + \ ^ * ! $ &( ) [ ]`
Wildcard matchThe request domain name must match the wildcard pattern; * and ? are supportedSame character set as exact match
Regular expression matchThe request domain name must match the regular expression (case-insensitive)3–128 characters; uppercase/lowercase letters, digits, and `. - ? = ~ _ - + \ ^ * ! $ &( ) [ ]`

Examples for www.example.com:

Matching typeInputMatches?
Exactwww.example.comYes
Exactwww.example.orgNo
Wildcard*.example.comYes
Wildcardwww.example.*Yes
Wildcard*.other.comNo
Regex^www.example.com$Yes
Regex^api\.example\.com$No

Path

ALB supports three matching types for request paths. All path values must start with /.

Matching typeHow it worksInput constraints
Exact matchThe request path must exactly equal the configured valueUppercase/lowercase letters, digits, and $ - _ . + / & ~ @ :
Wildcard matchThe request path must match the wildcard pattern; * and ? are supportedSame character set as exact match
Regular expression matchThe request path must match the regular expression`. - _ / = ? ~ ^ * $ : ( ) [ ] +`
ALB does not support longest-prefix matching (unlike Nginx). To replicate location /abc in Nginx, use the wildcard pattern /abc/* in ALB.

Examples for /sys/aaa/HOST:

Matching typeInputMatches?
Exact/example/textYes
Exact/example/text/No — trailing slash is not matched
Exact/exampleNo — partial path is not matched
Wildcard/example/*Yes
Wildcard/other/*No
Regex (case-sensitive)^/sys/(.*)/HOST$Yes
Regex (case-insensitive)^/sys/(.*)/host$Yes
Regex (case-sensitive)^/example/other$No

Forwarding actions

The forwarding action determines what ALB does with a matched request. Before choosing an action type, understand the fundamental difference between redirect and rewrite:

DimensionRedirectRewrite
URL visible to userChanges in the browser address barNo change — the original URL is preserved
Processing locationBrowser-side (client follows the redirect)Server-side (ALB rewrites transparently)
HTTP status code301, 302, 303, 307, or 308No status code change
Common usesDomain migration, HTTP-to-HTTPS enforcement, fixing broken linksClean URLs, hiding internal path structures

Rewrite policy

A rewrite policy is available when you select Forward to as the action. It modifies the request path or query before forwarding to the backend — the client never sees the rewritten URL.

Path rewrite with regex capture groups

When the forwarding condition uses a regular expression, you can use capture groups in the rewrite path.

How it works: Each pair of parentheses () in the condition regex captures a segment of the matched path. The first three captured groups are stored as ${1}, ${2}, and ${3}. Use these variables in the rewrite path to construct the new URL sent to the backend. Rules: - The number of () groups in the condition must equal the number of ${} variables in the rewrite path. - Only ${1}, ${2}, and ${3} are supported — you cannot substitute other characters.

Example: Strip a path prefix and suffix using two capture groups.

Condition path regex: /sys/(.*)/(.*)/aaa Rewrite path: /${1}/${2}

Client request path${1}${2}Backend receives
/sys/ccc/bbb/aaacccbbb/ccc/bbb
/sys/foo/bar/aaafoobar/foo/bar
/sys/x/y/aaaxy/x/y

Query rewrite

The query string is the portion of the URL after ?. Set the rewrite query to ${query} to forward the original query parameters to the backend unchanged.

Example: For www.example.com/test/test1?x=1, the query content is x=1.

Redirection policy

A redirection policy sends the client to a different URL. Configure six parameters: protocol, domain name, access port, path, query, and status code.

Reserved variables

Use the following variables to retain components from the original request in your redirect target:

VariableWhat it retains
$(protocol)Original protocol (HTTP or HTTPS)
${host}Original domain name
${port}Original port
${query}Original query parameters

Protocol

An HTTP listener can redirect to HTTP or HTTPS. An HTTPS listener can only redirect to HTTPS.

Path redirect with regex capture groups

Path redirect follows the same capture-group mechanics as path rewrite. The condition path regex captures segments into ${1}, ${2}, and ${3}, and the redirect path uses these variables to construct the target URL.

Rules (same as rewrite):

  • The number of () groups in the condition must equal the number of ${} variables in the redirect path.

  • Only ${1}, ${2}, and ${3} are supported.

Example: Strip a path prefix and suffix using two capture groups.

Condition path regex: /sys/(.*)/(.*)/aaa Redirect path: /${1}/${2}

Client request path${1}${2}Redirected to
/sys/ccc/bbb/aaacccbbb/ccc/bbb
/sys/foo/bar/aaafoobar/foo/bar

Status codes

The default status code is 301. Choose the status code based on whether the redirect is permanent or temporary and whether the HTTP method must be preserved:

Status codeTypeHTTP method preserved?
301 (default)Permanent redirectNo
302Temporary redirectNo
303See other locationNo
307Temporary redirectYes
308Permanent redirectYes

Use 307 or 308 when clients send POST or PUT requests and the redirected endpoint must receive the same method.