AWS elasticloadbalancing documentation change
Summary
Added documentation for IPAM IP address pools integration with Application Load Balancers
Security assessment
Introduces IPAM integration for better IP address management which helps enforce security policies, but does not address a specific security vulnerability
Diff
diff --git a/elasticloadbalancing/latest/application/application-load-balancers.md index a6492e647..3863c8660 100644 --- a/elasticloadbalancing/latest/application/application-load-balancers.md +++ b/elasticloadbalancing/latest/application/application-load-balancers.md @@ -5 +5 @@ -Subnets for your load balancerLoad balancer security groupsLoad balancer stateLoad balancer attributesIP address typeLoad balancer connectionsCross-zone load balancingDNS name +Subnets for your load balancerLoad balancer security groupsLoad balancer stateLoad balancer attributesIP address typeIPAM IP address poolsLoad balancer connectionsCross-zone load balancingDNS name @@ -24,0 +25,2 @@ For more information, see [How Elastic Load Balancing works](https://docs.aws.am + * IPAM IP address pools + @@ -38,0 +41,2 @@ For more information, see [How Elastic Load Balancing works](https://docs.aws.am + * [Update the IPAM IP address pools](./load-balancer-ip-pools.html) + @@ -278 +282 @@ Application Load Balancers support the following IP address types: -Clients must connect to the load balancer using IPv4 addresses (for example, 192.0.2.1) +Clients must connect to the load balancer using IPv4 addresses (for example, 192.0.2.1). @@ -309,0 +314,23 @@ For more information about IP address types, see [Update the IP address types fo +## IPAM IP address pools + +An IPAM IP address pool is a collection of contiguous IP address ranges (or CIDRs), within Amazon VPC IP Address Manager (IPAM). Using IPAM IP address pools with your Application Load Balancer enable you to organize your IPv4 addresses according to your routing and security needs. IPAM IP address pools must first be created within IPAM before they can be used by your Application Load Balancer. For more information, see [Bring your IP addresses to IPAM](https://docs.aws.amazon.com/vpc/latest/ipam/tutorials-byoip-ipam.html). + +###### Considerations + + * IPAM IP address pools are not compatible with internal load balancers, or the **Dualstack without public IPv4** IP address type. + + * IPAM IP address pools are not compatible with internal load balancers. + + * You can't delete an IP address in an IPAM IP address pool if it's currently in use by a load balancer. + + * During the transition to a different IPAM IP address pool, existing connections are terminated according to the load balancers HTTP client keepalive duration. + + * IPAM IP address pools can be shared across multiple accounts. For more information, see [Configure integration options for your IPAM](https://docs.aws.amazon.com/vpc/latest/ipam/choose-single-user-or-orgs-ipam.html) + + + + +IPAM IP address pools give you the choice to bring some or all of your public IPv4 address ranges to AWS and use them with your Application Load Balancers. With better control of IP address assignment, you can more effectively manage and enforce security polices and controls, while also benefiting from lower costs. There are no additional charges associated with using IPAM IP address pools with your Application Load Balancers, however, there may be charges associated with IPAM depending on which tier is used. For more information, see [Amazon VPC pricing](https://aws.amazon.com/vpc/pricing/) + +Your IPAM IP address pool is always prioritized when launching EC2 instances and Application Load Balancers, and when your IP addresses are no longer in use they become immediately available again. If there are no more assignable IP addresses in your IPAM IP address pool AWS managed IP addresses are assigned. AWS managed IP addresses incur additional cost. To add additional IP addresses, you can add new IP address ranges to an existing IPAM IP address pool. +