AWS service for port translation

Sure, the AWS ALB can do this. Additionally, it now supports host-based routing, so you can point multiple names to the ALB and configure it to route each one separately.

Note: the ALB is only able to load balance requests to backend servers that are within AWS. It's not a general-purpose load balancing service that can be used anywhere. Typically you will deploy backend servers in private subnet of a VPC and then deploy an ALB in front of them to accept client requests.

Client requests mydomain.com:80 -> AWS Route 53 translates to 123.123.123.123:8001 -> My firewall port forwards 8001 to the web server inside the LAN.

I think you're confused about the role of DNS. The DNS knows nothing about ports. For the purposes of publishing a web site, DNS only maps a name to one or more IP addresses. Period. There is no way to have DNS "redirect" to a port or anything like that.

I wrote my own port translator in NodeJS, and I am submitting the code here in case anyone else wants to use it. It does encrypted connections with https certificates as well as plain text port 80. I run it on an EC2 t2.micro instance for $10 per month and it runs great.

The only catch it it requires the browser to support SNICallback so the proxy server can dynamically use the correct certificate for the domain requested.

This tiny app below leverages the http-proxy library for NodeJS.

var proxyTable = {
    'mydomain.com': 'http://localhost:8001',
    'demo1.mydomain.com': 'https://localhost:8002', // https after proxy
    'demo2.mydomain.com': 'https://localhost:8005', // https after proxy
    'demo3.mydomain.com': 'https://localhost:8006', // https after proxy
    'demo4.mydomain.com': 'https://localhost:8007', // https after proxy
    'demo5.mydomain.com': 'https://localhost:8008', // https after proxy
}

http.createServer(function(req, res) {
    var hostname = req.headers.host.replace(/^www\./, ''); // remove www. subdomain prefix
    if (proxyTable[hostname]) {
        if (-1 != httpsDomains.indexOf(hostname)) { // redirect to https for httpsDomains
            redirectToHttps(req, res); // res.redirect() not available here
        } else {
            proxy.web(req, res, {target: proxyTable[hostname]});
        }
    } else {
        displayError(res, hostname)
    }
}).listen(80);

// Use SNICallback to dynamically use various SSL certificates depending upon hostname.
// To add a new SSL domain, add to secureContext AND proxyTable
const efboKey = fs.readFileSync(global.appRootPath + '/../mydomain.com.key', 'utf8');
const efboCert = fs.readFileSync(global.appRootPath + '/../mydomain.com.crt', 'utf8');
const efboCaBundleArray = makeCertificateAuthorityArray(global.appRootPath + '/../mydomain.com.ca-bundle', 'utf8');
const efboHttpsComponents = {
        key: efboKey,
        cert: efboCert,
        ca: efboCaBundleArray,
    };
var secureContext = {
    'mydomain.com': tls.createSecureContext(efboHttpsComponents),
    'demo1.mydomain.com': tls.createSecureContext(efboHttpsComponents),
    'demo2.mydomain.com': tls.createSecureContext(efboHttpsComponents),
    'demo3.mydomain.com': tls.createSecureContext(efboHttpsComponents),
    'demo4.mydomain.com': tls.createSecureContext(efboHttpsComponents),
    'demo5.mydomain.com': tls.createSecureContext(efboHttpsComponents),
}
try {
    var options = {
        SNICallback: function (hostname, cb) {
            if (secureContext[hostname]) {
                if (cb) {
                    cb(null, secureContext[hostname]);
                } else {
                    return secureContext[hostname]; // compatibility for older versions of node
                }
            } else {
                throw new Error('No keys/certificates for hostname requested');
            }
        },
        // must list a key and cert because required by tls.createServer()
        key: efboKey,
        cert: efboCert,
        ca: efboCaBundleArray,
    }
    https.createServer(options, function (req, res) {
        var hostname = req.headers.host.replace(/^www\./, ''); // remove www. subdomain prefix
        proxy.web(req, res, {target: proxyTable[hostname], secure: false}); // proxy https to http
    }).listen(443);
} catch (err){
    console.error(err.message);
    console.error(err.stack);
}