Responder gateways

Responder gateways are RTB Fabric infrastructure components that serve as connection points for customer gateways. Responder gateways receive requests from requester gateways and forward them to responder gateways, then return responses through the same pathway. Gateways operate colocated with your VPC and provide routing, load balancing, and processing capabilities. You maintain complete control over your bidding algorithms, response logic, and data processing, while RTB Fabric provides the secure infrastructure for connectivity.

Creating a responder gateway

Create a new responder gateway that can respond to bid opportunities.

After creating your gateway, you can view its details, monitor performance metrics, and make configuration changes as needed.

{
    "description": "My RTB responder gateway",
    "vpcId": "vpc-01f345ad6524a6d7",
    "subnetIds": [
        "subnet-abc12345",
        "subnet-def67890"
    ],
    "securityGroupIds": [
        "sg-12345678"
    ],
    "domainName": "responder.example.com",
    "port": 443,
    "protocol": "HTTPS",
    "trustStoreConfiguration": {
        "certificateAuthorityCertificates": [
            "LS0tLS1CRUdJTi...base64-encoded-CA-cert...LS0tLS1FTkQ="
        ]
    },
    "tags": {
        "Environment": "Production",
        "Team": "RTB"
    }
}

$ aws rtbfabric create-responder-gateway \
--cli-input-json file://create-gateway.json \
--endpoint-url https://rtbfabric.us-east-1.amazonaws.com \
--region us-east-1

$ aws rtbfabric create-responder-gateway \
--description "My EKS responder gateway" \
--vpc-id vpc-0abc1234def567890 \
--subnet-ids subnet-0abc1234def567890 subnet-0def5678abc901234 \
--security-group-ids sg-0abc1234def567890 \
--port 443 \
--protocol HTTPS \
--domain-name bidder.example.com \
--managed-endpoint-configuration '{"eksEndpoints":{"endpointsResourceName":"my-bidder-service","endpointsResourceNamespace":"bidding-ns","clusterApiServerEndpointUri":"https://ABCDEF1234567890.gr7.us-east-1.eks.amazonaws.com","clusterApiServerCaCertificateChain":"LS0tLS1CRUdJTi...base64-encoded-CA-cert...LS0tLS1FTkQ=","clusterName":"my-eks-cluster","roleArn":"arn:aws:iam::123456789012:role/RtbFabricManagedEndpointRole"}}' \
--endpoint-url https://rtbfabric.us-east-1.amazonaws.com \
--region us-east-1

$ aws rtbfabric create-responder-gateway \
--description "My ASG responder gateway" \
--vpc-id vpc-0abc1234def567890 \
--subnet-ids subnet-0abc1234def567890 subnet-0def5678abc901234 \
--security-group-ids sg-0abc1234def567890 \
--port 8080 \
--protocol HTTP \
--managed-endpoint-configuration '{"autoScalingGroups":{"autoScalingGroupNames":["my-asg-name"],"roleArn":"arn:aws:iam::123456789012:role/RtbFabricManagedEndpointRole"}}' \
--endpoint-url https://rtbfabric.us-east-1.amazonaws.com \
--region us-east-1

Logging

When logging is configured, default sampling behavior applies. Service logs capture all error logs (error_log sampling rate of 1) and no filter logs (filter_log sampling rate of 0). To modify sampling rates after creation, see UpdateLink in the AWS RTB Fabric API Reference.

Creating an external responder gateway

Create an external responder gateway in RTB Fabric if you do not already have one. Inbound external links with custom domains require an external gateway — a gateway type designed for receiving traffic from endpoints outside RTB Fabric. Standard (internal) responder gateways do not support inbound external links with custom domains features such as certificate association and routing rules.

Listener configuration

A listener configuration defines which protocols a gateway with external links accepts for incoming traffic. By default, a gateway listens on a single protocol (HTTPS). With multiprotocol support, you can configure a gateway to accept both HTTP and HTTPS traffic simultaneously using the listenerConfig parameter.

The listenerConfig contains a protocols list that specifies one or two protocols:

Multi-protocol support is useful when you need to support partners that send traffic over HTTP while also serving HTTPS traffic with TLS termination. When both protocols are enabled, the gateway provisions listeners for each protocol on the public ingress cluster.

$ aws rtbfabric create-responder-gateway \
--description "External gateway for inbound external links with custom domains" \
--vpc-id vpc-0abc123def456 \
--subnet-ids subnet-0abc123 subnet-0def456 \
--security-group-ids sg-0abc123 \
--port 80 \
--protocol HTTP \
--managed-endpoint-configuration '{"autoScalingGroups":{"autoScalingGroupNames":["my-asg-name"],"roleArn":"arn:aws:iam::123456789012:role/RtbFabricManagedEndpointRole"}}' \
--gateway-type EXTERNAL \
--endpoint-url https://rtbfabric.us-east-1.amazonaws.com \
--region us-east-1

$ aws rtbfabric create-responder-gateway \
--description "External gateway for inbound external links with custom domains" \
--vpc-id vpc-0abc123def456 \
--subnet-ids subnet-0abc123 subnet-0def456 \
--security-group-ids sg-0abc123 \
--port 443 \
--protocol HTTPS \
--listener-config '{"protocols":["HTTP","HTTPS"]}' \
--domain-name bidder.example.com \
--managed-endpoint-configuration '{"autoScalingGroups":{"autoScalingGroupNames":["my-asg-name"],"roleArn":"arn:aws:iam::123456789012:role/RtbFabricManagedEndpointRole"}}' \
--gateway-type EXTERNAL \
--endpoint-url https://rtbfabric.us-east-1.amazonaws.com \
--region us-east-1

$ aws rtbfabric create-responder-gateway \
--description "External gateway with EKS endpoint discovery" \
--vpc-id vpc-0abc123def456 \
--subnet-ids subnet-0abc123 subnet-0def456 \
--security-group-ids sg-0abc123 \
--port 443 \
--protocol HTTPS \
--domain-name bidder.example.com \
--managed-endpoint-configuration '{"eksEndpoints":{"endpointsResourceName":"my-bidder-service","endpointsResourceNamespace":"bidding-ns","clusterApiServerEndpointUri":"https://ABCDEF1234567890.gr7.us-east-1.eks.amazonaws.com","clusterApiServerCaCertificateChain":"LS0tLS1CRUdJTi...base64-encoded-CA-cert...LS0tLS1FTkQ=","clusterName":"my-eks-cluster","roleArn":"arn:aws:iam::123456789012:role/RtbFabricManagedEndpointRole"}}' \
--gateway-type EXTERNAL \
--endpoint-url https://rtbfabric.us-east-1.amazonaws.com \
--region us-east-1

Key parameters:

Record the gateway endpoint hostname (for example, rtb-gw-abc123.123456789012.gateway.rtbfabric.us-east-1.amazonaws.com). You need this value when updating DNS records to route traffic through your custom domain.

Configuring Availability Zone affinity

Requester gateways send traffic to a responder gateway. The client routing policy of the responder gateway controls which Availability Zones RTB Fabric uses to reach it. You set the client routing policy when you create a responder gateway. You can also change it later, while the gateway is in the ACTIVE state.

The client routing policy that you choose affects latency and capacity. Keeping requests inside the requester's own Availability Zone avoids the network latency of crossing an Availability Zone boundary. Using every Availability Zone that the responder gateway spans gives each requester access to more gateway capacity.

Choose one of the following client routing policies:

Unsupported client routing policies

RTB Fabric supports the two client routing policies described in the preceding list. AVAILABILITY_ZONE_AFFINITY and ANY_AVAILABILITY_ZONE are the only values that RTB Fabric accepts and the only values that it returns. Setting any other client routing policy fails with a ValidationException.

RTB Fabric does not support partial Availability Zone affinity. Under partial affinity, a fixed percentage of requests stay in the requester's own Availability Zone. The rest can go to any Availability Zone. If you are familiar with the client routing policies of a Network Load Balancer, RTB Fabric has no equivalent of its partial_availability_zone_affinity policy.

Prerequisites for Availability Zone affinity

A service quota for your account sets the number of Availability Zones that the subnets of a gateway can span. By default, this quota is one Availability Zone. To span more Availability Zones, request a quota increase. For more information about quotas, see Quotas for AWS RTB Fabric.

Setting ANY_AVAILABILITY_ZONE on a gateway whose subnets span a single Availability Zone succeeds and does not change how traffic reaches the gateway. To get the behavior described for ANY_AVAILABILITY_ZONE, create the gateway with subnets in more than one Availability Zone.

Capacity planning for Availability Zone affinity

Scale the targets in each Availability Zone independently. Give each Availability Zone enough capacity to serve more than an even share of your traffic.

Avoid scaling on a signal that aggregates data across your Availability Zones, such as average CPU utilization. An average hides which Availability Zone is over its share. The Availability Zones that receive less traffic dilute the average. An Availability Zone can be close to its limit while the average stays below your scaling threshold.

Uneven capacity across Availability Zones does not change how RTB Fabric distributes requests. This matters when your deployment tooling places uneven capacity, for example when Amazon EC2 Spot capacity is constrained in one Availability Zone.

What the client routing policy does not control

The client routing policy controls how requester gateways reach this responder gateway. It does not change how the responder gateway reaches your own capacity. RTB Fabric prefers managed endpoint targets in the gateway's Availability Zone. When no target is available in that Availability Zone, RTB Fabric can use targets in another Availability Zone. For more information about managed endpoints, see Managed endpoints.

Setting the client routing policy

You can set the client routing policy with the RTB Fabric API, the AWS CLI, or an AWS SDK. The console does not display or change the client routing policy.

To change the client routing policy of a responder gateway that already exists, use the UpdateResponderGateway operation. The following section contains an AWS CLI example that sets the client routing policy of a gateway.

$ aws rtbfabric update-responder-gateway \
--gateway-id "rtb-gw-kasoi29asfdhn" \
--client-routing-policy ANY_AVAILABILITY_ZONE \
--endpoint-url https://rtbfabric.us-east-1.amazonaws.com \
--region us-east-1

Monitoring Availability Zone affinity

RTB Fabric does not publish an Amazon CloudWatch dimension for Availability Zone. You cannot break down the metrics of a gateway or a link by Availability Zone. RTB Fabric also does not publish a metric for the volume of traffic that crosses an Availability Zone boundary. For more information about the metrics and dimensions that RTB Fabric publishes, see RTB Fabric metrics and RTB Fabric dimensions.

Searching for responder gateways

Use the search functionality in the console to locate specific gateways in your environment. The gateways table displays key information including gateway ID, status, name, associated links, and creation date.

Updating an existing responder gateway

In the console, you can update the gateway description and the Auto Scaling group managed endpoint configuration. Using the UpdateResponderGateway API, you can also update the client routing policy and the protocols list in the listener configuration, which controls the protocols that a gateway with external links accepts. For more information, see Listener configuration and AWS CLI.

For HTTPS endpoints, you can also rotate the CA certificate chain (trust store) by using the UpdateResponderGateway API. To rotate the trust store without interrupting traffic, see Rotating a responder gateway certificate.

You cannot change the domain name, port, and protocol parameters that you set when you create a responder gateway. To change any of them, delete the gateway and create a new one.

$ aws rtbfabric update-responder-gateway \
--gateway-id "rtb-gw-kasoi29asfdhn" \
--description "Updated responder gateway description" \
--port 443 \
--protocol HTTPS \
--endpoint-url https://rtbfabric.us-east-1.amazonaws.com \
--region us-east-1

$ aws rtbfabric update-responder-gateway \
--gateway-id "rtb-gw-kasoi29asfdhn" \
--managed-endpoint-configuration '{"autoScalingGroups":{"autoScalingGroupNames":["my-new-asg-name","my-second-asg"],"roleArn":"arn:aws:iam::123456789012:role/RtbFabricManagedEndpointRole"}}' \
--port 443 \
--protocol HTTPS \
--endpoint-url https://rtbfabric.us-east-1.amazonaws.com \
--region us-east-1

Rotating a responder gateway certificate

For HTTPS responder endpoints, you provide a certificate authority (CA) trust store. RTB Fabric verifies the certificate that your responder origin presents against this trust store. You configure the trust store as the CA certificate chain on the responder endpoint (the trustStoreConfiguration in the API). The trust store is separate from the inbound custom domain certificate that an external gateway presents to partner clients. For more information about the inbound custom domain certificate, see Manage TLS certificates.

Rotate the trust store by using the UpdateResponderGateway operation. Rotate when your origin's certificates approach expiry, or when you change the CA that signs them. On UpdateResponderGateway, you can supply up to two CA certificate chains at a time. With both chains in place, you trust both the outgoing and incoming CA during a transition. CreateResponderGateway accepts a single chain.

The following table shows the trust store contents at each step of a rotation from an old CA (CA-1) to a new CA (CA-2).

To confirm which CA certificates are trusted, call GetResponderGateway. The certificateAuthorityCertificates field returns a single element. That element holds all trusted CA certificates concatenated into one base64-encoded chain, even during the overlap window when two CAs are trusted. Decode that element and count the certificate blocks to see the individual CAs. You cannot pass this combined value back into a rotation step, so keep your own copy of each CA certificate chain that you supply. When you retire the old CA, supply the new CA chain on its own.

The following section provides AWS Command Line Interface (AWS CLI) commands for the rotation.

{
    "gatewayId": "rtb-gw-kasoi29asfdhn",
    "port": 443,
    "protocol": "HTTPS",
    "trustStoreConfiguration": {
        "certificateAuthorityCertificates": [
            "LS0tLS1CRUdJTi...current-CA-base64...LS0tLS1FTkQ=",
            "LS0tLS1CRUdJTi...new-CA-base64...LS0tLS1FTkQ="
        ]
    }
}

$ aws rtbfabric update-responder-gateway \
--cli-input-json file://rotate.json \
--endpoint-url https://rtbfabric.us-east-1.amazonaws.com \
--region us-east-1

{
    "gatewayId": "rtb-gw-kasoi29asfdhn",
    "port": 443,
    "protocol": "HTTPS",
    "trustStoreConfiguration": {
        "certificateAuthorityCertificates": [
            "LS0tLS1CRUdJTi...new-CA-base64...LS0tLS1FTkQ="
        ]
    }
}

Getting a responder gateway

Retrieve detailed information about a specific responder gateway, including its configuration, status, VPC settings, and endpoint configuration.

$ aws rtbfabric get-responder-gateway \
--gateway-id "rtb-gw-kasoi29asfdhn" \
--endpoint-url https://rtbfabric.us-east-1.amazonaws.com \
--region us-east-1

Listing responder gateways

List all responder gateways in your account.

$ aws rtbfabric list-responder-gateways \
--endpoint-url https://rtbfabric.us-east-1.amazonaws.com \
--region us-east-1

Viewing associated links

Each responder gateway can have associated links that connect it to requester gateways. You can view these links and their details through the console.

$ aws rtbfabric list-links \
--gateway-id "rtb-gw-dsj34i23nsllka" \
--endpoint-url https://rtbfabric.us-east-1.amazonaws.com \
--region us-east-1

$ aws rtbfabric list-links \
--gateway-id "rtb-gw-dsj34i23nsllka" \
--max-results 10 \
--next-token "token" \
--endpoint-url https://rtbfabric.us-east-1.amazonaws.com \
--region us-east-1

Deleting responder gateways

When you no longer need a responder gateway, you can delete it from your environment. This action is irreversible and will terminate all bidding activities associated with the gateway.

We recommend deleting unused responder gateways to optimize resource usage and costs. AWS may delete unused gateways after 30 days of inactivity to manage infrastructure resources.

$ aws rtbfabric delete-responder-gateway \
--gateway-id "rtb-gw-kasoi29asfdhn" \
--endpoint-url https://rtbfabric.us-east-1.amazonaws.com \
--region us-east-1