AWS elasticloadbalancing documentation change
Summary
Restructured documentation for using ALB as NLB target, including reordered steps, added prerequisite section, clarified limitations (max 2 NLBs per ALB), and expanded configuration examples for console/CLI/CloudFormation.
Security assessment
Changes focus on workflow reorganization and configuration details rather than addressing security vulnerabilities. The documentation update clarifies operational limits (e.g., max 2 NLBs per ALB) but doesn't reference any security patches or vulnerabilities. Security group configuration mentions remain similar to previous version without introducing new security features.
Diff
diff --git a/elasticloadbalancing/latest/network/application-load-balancer-target.md b/elasticloadbalancing/latest/network/application-load-balancer-target.md index ead619917..78073c530 100644 --- a//elasticloadbalancing/latest/network/application-load-balancer-target.md +++ b//elasticloadbalancing/latest/network/application-load-balancer-target.md @@ -5 +5 @@ -Step 1: Create the Application Load BalancerStep 2: Create the target group Step 3: Create the Network Load BalancerStep 4: (Optional) Enable AWS PrivateLink +PrerequisiteStep 1: Create the target group Step 2: Create the Network Load BalancerStep 3: (Optional) Enable private connectivity @@ -7 +7 @@ Step 1: Create the Application Load BalancerStep 2: Create the target group Step -# Use Application Load Balancers as targets of a Network Load Balancer +# Use an Application Load Balancer as a target of a Network Load Balancer @@ -22 +22 @@ You can use this feature with an internal or internet-facing Application Load Ba - * To associate an Application Load Balancer as a target of a Network Load Balancer, they must be in the same VPC within the same account. + * You can only register one Application Load Balancer per target group. @@ -24 +24,3 @@ You can use this feature with an internal or internet-facing Application Load Ba - * You can associate an Application Load Balancer as a target of multiple Network Load Balancers. To do this, register the Application Load Balancer with a separate target group for each individual Network Load Balancer. + * To associate an Application Load Balancer as a target of a Network Load Balancer, the load balancers must be in the same VPC within the same account. + + * You can associate an Application Load Balancer as a target of up to two Network Load Balancers. To do this, register the Application Load Balancer with a separate target group for each Network Load Balancer. @@ -37 +39 @@ You can use this feature with an internal or internet-facing Application Load Ba -## Step 1: Create the Application Load Balancer +###### Tasks @@ -39 +41 @@ You can use this feature with an internal or internet-facing Application Load Ba -Before you begin, configure the target groups that this Application Load Balancer will use. Ensure that you have a virtual private cloud (VPC) with the targets that you will register with the target group. This VPC must have at least one public subnet in each of the Availability Zones used by your targets. + * Prerequisite @@ -41 +43 @@ Before you begin, configure the target groups that this Application Load Balance -###### To create an Application Load Balancer using the console + * Step 1: Create a target group of type alb @@ -43 +45 @@ Before you begin, configure the target groups that this Application Load Balance - 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). + * Step 2: Create a Network Load Balancer and configure routing @@ -45 +47 @@ Before you begin, configure the target groups that this Application Load Balance - 2. On the navigation pane, under **Load Balancing** , choose **Load Balancers**. + * Step 3: (Optional) Create a VPC endpoint service @@ -47 +48,0 @@ Before you begin, configure the target groups that this Application Load Balance - 3. Choose **Create load balancer**. @@ -49 +49,0 @@ Before you begin, configure the target groups that this Application Load Balance - 4. Under **Application Load Balancer** , choose **Create**. @@ -51 +50,0 @@ Before you begin, configure the target groups that this Application Load Balance - 5. On the **Create Application Load Balancer** page, under **Basic configuration** , specify the **Load balancer name** , **Scheme** , and **IP address type**. @@ -53 +52 @@ Before you begin, configure the target groups that this Application Load Balance - 6. For **Listeners** , you can create an HTTP or HTTPS listener on any port. However, you must ensure that the port number of this listener matches the port of the target group in which this Application Load Balancer will reside. +## Prerequisite @@ -55 +54 @@ Before you begin, configure the target groups that this Application Load Balance - 7. Under **Availability Zones** , do the following: +If you don't already have an Application Load Balancer to use as a target, create the load balancer, its listeners, and its target groups. For more information, see [Create an Application Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-application-load-balancer.html) in the _User Guide for Application Load Balancers_. @@ -57 +56 @@ Before you begin, configure the target groups that this Application Load Balance - 1. For **VPC** , select a virtual private cloud (VPC) with instances or IP addresses that you included as targets of your Application Load Balancer. You must use the same VPC that you would use for your Network Load Balancer in Step 3: Create a Network Load Balancer, and configure the Application Load Balancer as its target. +## Step 1: Create a target group of type alb @@ -59 +58 @@ Before you begin, configure the target groups that this Application Load Balance - 2. Select two or more **Availability Zones** and corresponding subnets. Ensure that these Availability Zones match those enabled for your Network Load Balancer to optimize availability, scaling, and performance. +Create a target group of type `alb`. You can register your Application Load Balancer as a target when you create the target group or later on. @@ -61 +60 @@ Before you begin, configure the target groups that this Application Load Balance - 8. You can **Assign a security group** to your load balancer by creating a new security group or by selecting an existing one. +Console @@ -63 +61,0 @@ Before you begin, configure the target groups that this Application Load Balance -The security group that you select should contain a rule that allows traffic to the listener port for this load balancer. Use the CIDR blocks (IP address range) of the client's computers as the traffic source in the inbound rules for security groups. This allows clients to send traffic through this Application Load Balancer. For more information about configuring security groups for an Application Load Balancer as a target of a Network Load Balancer, see [Security groups for your Application Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-update-security-groups.html) in the _User Guide for Application Load Balancers_. @@ -65 +63 @@ The security group that you select should contain a rule that allows traffic to - 9. For **Configure Routing** , select the target group that you configured for this Application Load Balancer. If you don't have an available target group, and want to configure a new one, see [Create a target group](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-target-group.html) in the _User Guide for Application Load Balancers_. +###### To create a target group for an Application Load Balancer as a target @@ -67 +65 @@ The security group that you select should contain a rule that allows traffic to - 10. Review your configuration, and choose **Create load balancer**. + 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). @@ -68,0 +67 @@ The security group that you select should contain a rule that allows traffic to + 2. On the navigation pane, under **Load Balancing** , choose **Target Groups**. @@ -69,0 +69 @@ The security group that you select should contain a rule that allows traffic to + 3. Choose **Create target group**. @@ -70,0 +71 @@ The security group that you select should contain a rule that allows traffic to + 4. In the **Basic configuration** pane, for **Choose a target type** , choose **Application Load Balancer**. @@ -72 +73 @@ The security group that you select should contain a rule that allows traffic to -## Step 2: Create the target group with the Application Load Balancer as the target + 5. For **Target group name** , enter a name for the target group. @@ -74 +75 @@ The security group that you select should contain a rule that allows traffic to -Creating a target group allows you to register a new or existing Application Load Balancer as a target. You can only add one Application Load Balancer per target group. The same Application Load Balancer can also be used in a separate target group, as the target of up to two Network Load Balancers. + 6. For **Protocol** , only TCP is allowed. Select the **Port** for your target group. The port for this target group must match the listener port of the Application Load Balancer. If you choose a different port for this target group, you can update the listener port on the Application Load Balancer to match it. @@ -76 +77 @@ Creating a target group allows you to register a new or existing Application Loa -###### To create a target group and register the Application Load Balancer as a target, using the console + 7. For **VPC** , select the virtual private cloud (VPC) for the target group. This must be the same VPC used by the Application Load Balancer. @@ -78 +79 @@ Creating a target group allows you to register a new or existing Application Loa - 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). + 8. For **Health checks** , choose HTTP or HTTPS as the **Health check protocol**. Health checks are sent to the Application Load Balancer and forwarded to its targets using the specified port, protocol, and ping path. Ensure that your Application Load Balancer can receive these health checks by having a listener with a port and protocol that matches the health check port and protocol. @@ -80 +81 @@ Creating a target group allows you to register a new or existing Application Loa - 2. On the navigation pane, under **Load Balancing** , choose **Target Groups**. + 9. (Optional) Expand **Tags**. For each tag, choose **Add new tag** and enter a tag key and a tag value. @@ -82 +83 @@ Creating a target group allows you to register a new or existing Application Loa - 3. Choose **Create target group**. + 10. Choose **Next**. @@ -84 +85 @@ Creating a target group allows you to register a new or existing Application Loa - 4. On the **Specify group details** page, under **Basic configuration** , choose **Application Load Balancer**. + 11. If you are ready to register the Application Load Balancer, choose **Register now** , override the default port if needed, and select the Application Load Balancer. The Application Load Balancer must have a listener on the same port as the target group. You can add or edit a listener on this load balancer to match the target group port, or return to the previous step and change the port for the target group. @@ -86 +87 @@ Creating a target group allows you to register a new or existing Application Loa - 5. For **Target group name** , enter a name for the Application Load Balancer target group. +If you are not ready to register the Application Load Balancer as a target, choose **Register later** and register the target later on. For more information, see [Register targets](./target-group-register-targets.html#register-targets). @@ -88 +89 @@ Creating a target group allows you to register a new or existing Application Loa - 6. For **Protocol** , only TCP is allowed. Select the **Port** for your target group. This target group port must match the listener port of the Application Load Balancer. Alternatively, you can add or edit the listener port on the Application Load Balancer to match this port. + 12. Choose **Create target group**. @@ -90 +90,0 @@ Creating a target group allows you to register a new or existing Application Loa - 7. For **VPC** , select the virtual private cloud (VPC) with the Application Load Balancer to register with the target group. @@ -92 +91,0 @@ Creating a target group allows you to register a new or existing Application Loa - 8. For **Health checks** , choose HTTP or HTTPS as the **Health check protocol**. Health checks are sent to the Application Load Balancer and forwarded to its targets using the specified port, protocol, and ping path. Ensure that your Application Load Balancer can receive these health checks by having a listener with a port and protocol that matches the health check port and protocol. @@ -94 +92,0 @@ Creating a target group allows you to register a new or existing Application Loa - 9. (Optional) Add one or more tags as required. @@ -96 +94 @@ Creating a target group allows you to register a new or existing Application Loa - 10. Choose **Next**. +AWS CLI @@ -98 +95,0 @@ Creating a target group allows you to register a new or existing Application Loa - 11. On the **Register targets** page, choose the Application Load Balancer that you want to register as the target. The Application Load Balancer you choose from the list must have a listener on the same port as the target group you’re creating. You can add or edit a listener on this load balancer to match the target group’s port or return to the previous step and change the port that's specified for the target group. If you're unsure about which Application Load Balancer to add as the target, or don't want to add it at this point, you can choose to add the Application Load Balancer later. @@ -100 +97,20 @@ Creating a target group allows you to register a new or existing Application Loa - 12. Choose **Create target group**. +###### To create a target group of type alb + +Use the [create-target-group](https://docs.aws.amazon.com/cli/latest/reference/elbv2/create-target-group.html) command. The protocol must be TCP and the port must match the listener port of the Application Load Balancer. + + + aws elbv2 create-target-group \ + --name my-target-group \ + --protocol TCP \ + --port 80 \ + --target-type alb \ + --vpc-id vpc-1234567890abcdef0 \ + --tags Key=department,Value=123 + +CloudFormation + + +###### To create a target group of type alb + +Define a resource of type [AWS::ElasticLoadBalancingV2::TargetGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-targetgroup.html). The protocol must be TCP and the port must match the listener port of the Application Load Balancer. + @@ -101,0 +118,15 @@ Creating a target group allows you to register a new or existing Application Loa + Resources: + myTargetGroup: + Type: 'AWS::ElasticLoadBalancingV2::TargetGroup' + Properties: + Name: my-target-group + Protocol: TCP + Port: 80 + TargetType: alb + VpcId: !Ref myVPC + Tags: + - Key: 'department' + Value: '123' + Targets: + -Id: !Ref myApplicationLoadBalancer + Port: 80 @@ -102,0 +134 @@ Creating a target group allows you to register a new or existing Application Loa +## Step 2: Create a Network Load Balancer and configure routing @@ -103,0 +136 @@ Creating a target group allows you to register a new or existing Application Loa +When you create the Network Load Balancer, you can configure the default action to forward traffic to the Application Load Balancer. @@ -105 +138 @@ Creating a target group allows you to register a new or existing Application Loa -## Step 3: Create a Network Load Balancer, and configure the Application Load Balancer as its target +Console @@ -107 +139,0 @@ Creating a target group allows you to register a new or existing Application Loa -Use the following steps to create the Network Load Balancer and then configure the Application Load Balancer as its target using the console. @@ -109 +141 @@ Use the following steps to create the Network Load Balancer and then configure t -###### To create your Network Load Balancer and listener using the console +###### To create the Network Load Balancer @@ -121 +153,5 @@ Use the following steps to create the Network Load Balancer and then configure t -On the **Basic configuration** pane, configure **Load balancer name** , **Scheme** , and **IP address type**. + 1. For **Load balancer name** , enter a name for your Network Load Balancer. + + 2. For **Scheme** , choose **Internet-facing** or **Internal**. An internet-facing Network Load Balancer routes requests from clients to targets over the internet. An internal Network Load Balancer routes requests to targets using private IP addresses. + + 3. For **Load balancer IP address type** , choose **IPv4** if your clients use IPv4 addresses to communicate with the Network Load Balancer or **Dualstack** if your clients use both IPv4 and IPv6 addresses to communicate with the Network Load Balancer. @@ -125 +161 @@ On the **Basic configuration** pane, configure **Load balancer name** , **Scheme - 1. For **VPC** , select the same VPC that you used for your Application Load Balancer target. If you selected **Internet-facing** for **Scheme** , only VPCs with an internet gateway are available for selection. + 1. For **VPC** , select the same VPC that you used for your Application Load Balancer. With an internet-facing load balancer, only VPCs with an internet gateway are available for selection. @@ -127 +163 @@ On the **Basic configuration** pane, configure **Load balancer name** , **Scheme - 2. For **Mappings** , select one or more Availability Zones and corresponding subnets. We recommend that you select the same Availability Zones that are enabled for your Application Load Balancer. This optimizes availability, scaling, and performance. + 2. For **Availability Zones and subnets** , select at least one Availability Zones, and select one subnet per zone. We recommend that you select the same Availability Zones that are enabled for your Application Load Balancer. This optimizes availability, scaling, and performance. @@ -131 +167,9 @@ On the **Basic configuration** pane, configure **Load balancer name** , **Scheme - 7. **Listeners and routing** + 7. **Security groups** + +We preselect the default security group for the load balancer VPC. You can select additional security groups as needed. If you don't have a security group that meets your needs, choose **create a new security group** to create one now. For more information, see [Create a security group](https://docs.aws.amazon.com/vpc/latest/userguide/creating-security-groups.html) in the _Amazon VPC User Guide_. + +###### Warning + +If you don't associate any security groups with your Network Load Balancer now, you can't associate them later on. + + 8. **Listeners and routing** @@ -137 +181,40 @@ With this configuration, you can use HTTPS listeners on the Application Load Bal - 2. For **Default action** , select the Application Load Balancer target group to forward traffic. If you don't see it in the list, or can't select a target group (because it is already in use by another Network Load Balancer), you can create an Application Load Balancer target group as shown in Step 2: Create the target group with the Application Load Balancer as the target. + 2. For **Default action** , select the target group that you created in the previous step. + + 3. (Optional) Choose **Add listener tag** and enter a tag key and a tag value. + + 9. **Load balancer tags** + +(Optional) Expand **Load balancer tags**. Choose **Add new tag** and enter a tag key and a tag value. For more information, see [Tags](./load-balancer-tags.html). + + 10. **Summary** + +Review your configuration and choose **Create load balancer**. + + + + +AWS CLI + +