AWS elasticloadbalancing high security documentation change
Summary
Restructured documentation flow, replacing step-by-step instructions with prerequisite-focused sections and adding detailed security group configuration requirements. Added mutual TLS (mTLS) configuration guidance in listener settings.
Security assessment
Added explicit requirements for security groups to allow traffic from load balancer nodes/client IPs and health check ports. Introduced mutual TLS authentication configuration options, which is a security feature requiring client certificate validation.
Diff
diff --git a/elasticloadbalancing/latest/application/create-application-load-balancer.md b/elasticloadbalancing/latest/application/create-application-load-balancer.md index 3818a67fd..2b02fe930 100644 --- a//elasticloadbalancing/latest/application/create-application-load-balancer.md +++ b//elasticloadbalancing/latest/application/create-application-load-balancer.md @@ -5 +5 @@ -Step 1: Configure a target groupStep 2: Register targetsStep 3: Configure a load balancer and a listenerStep 4: Test the load balancer +PrerequisitesCreate the load balancerTest the load balancerNext steps @@ -9,7 +9 @@ Step 1: Configure a target groupStep 2: Register targetsStep 3: Configure a load -A load balancer takes requests from clients and distributes them across targets in a target group. - -Before you begin, ensure that you have a virtual private cloud (VPC) with at least one public subnet in each of the zones used by your targets. For more information, see [Subnets for your load balancer](./application-load-balancers.html#subnets-load-balancer). - -To create a load balancer using the AWS CLI, see [Getting started with Application Load Balancers using the AWS CLI](./tutorial-application-load-balancer-cli.html). - -To create a load balancer using the AWS Management Console, complete the following tasks. +An Application Load Balancer takes requests from clients and distributes them across targets in a target group, such as EC2 instances. For more information, see [How Elastic Load Balancing works.](https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/how-elastic-load-balancing-works.html) in the _Elastic Load Balancing User Guide_. @@ -19,5 +13 @@ To create a load balancer using the AWS Management Console, complete the followi - * Step 1: Configure a target group - - * Step 2: Register targets - - * Step 3: Configure a load balancer and a listener + * Prerequisites @@ -25 +15 @@ To create a load balancer using the AWS Management Console, complete the followi - * Step 4: Test the load balancer + * Create the load balancer @@ -26,0 +17 @@ To create a load balancer using the AWS Management Console, complete the followi + * Test the load balancer @@ -27,0 +19 @@ To create a load balancer using the AWS Management Console, complete the followi + * Next steps @@ -30 +21,0 @@ To create a load balancer using the AWS Management Console, complete the followi -## Step 1: Configure a target group @@ -32 +22,0 @@ To create a load balancer using the AWS Management Console, complete the followi -Configuring a target group allows you to register targets such as EC2 instances. The target group that you configure in this step is used as the target group in the listener rule when you configure your load balancer. For more information, see [Target groups for your Application Load Balancers](./load-balancer-target-groups.html). @@ -34,5 +24 @@ Configuring a target group allows you to register targets such as EC2 instances. -###### To configure your target group using the console - - 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). - - 2. In the navigation pane, choose **Target Groups**. +## Prerequisites @@ -40 +26 @@ Configuring a target group allows you to register targets such as EC2 instances. - 3. Choose **Create target group**. + * Decide which Availability Zones and IP address types your application will support. Configure the load balancer VPC with subnets in each of these Availability Zones. If the application will support both IPv4 and IPv6 traffic, ensure that the subnets have both IPv4 and IPv6 CIDRs. Deploy at least one target in each Availability Zone. For more information, see [Subnets for your load balancer](./application-load-balancers.html#subnets-load-balancer). @@ -42 +28 @@ Configuring a target group allows you to register targets such as EC2 instances. - 4. In the **Basic configuration** section, set the following parameters: + * Ensure that the security groups for target instances allow traffic on the listener port from client IP addresses (if targets are specified by instance ID) or load balancer nodes (if targets are specified by IP address). For more information, see [Recommended rules](./load-balancer-update-security-groups.html#security-group-recommended-rules). @@ -44 +30 @@ Configuring a target group allows you to register targets such as EC2 instances. - 1. For **Choose a target type** , select **Instances** to specify targets by instance ID or **IP addresses** to specify targets by only IP address. If the target type is a **Lambda function** , you can enable health checks by selecting **Enable** in the **Health checks** section. + * Ensure that the security groups for target instances allow traffic from the load balancer on the health check port using the health check protocol. @@ -46 +31,0 @@ Configuring a target group allows you to register targets such as EC2 instances. - 2. For **Target group name** , enter a name for the target group. @@ -48 +32,0 @@ Configuring a target group allows you to register targets such as EC2 instances. - 3. Modify the **Port** and **Protocol** as needed. @@ -50 +33,0 @@ Configuring a target group allows you to register targets such as EC2 instances. - 4. If the target type is **Instances** or **IP addresses** , choose **IPv4** or **IPv6** as the **IP address type** , otherwise skip to the next step. @@ -52 +35 @@ Configuring a target group allows you to register targets such as EC2 instances. -Note that only targets that have the selected IP address type can be included in this target group. The IP address type cannot be changed after the target group is created. +## Create the load balancer @@ -54 +37 @@ Note that only targets that have the selected IP address type can be included in - 5. For **VPC** , select a virtual private cloud (VPC) with the targets that you want to include in your target group. +As part of creating an Application Load Balancer, you'll create the load balancer, at least one listener, and at least one target group. Your load balancer is ready to handle client requests when there is at least one healthy registered target in each of its enabled Availability Zones. @@ -56 +39 @@ Note that only targets that have the selected IP address type can be included in - 6. For **Protocol version** , select **HTTP1** when the request protocol is HTTP/1.1 or HTTP/2; select **HTTP2** , when the request protocol is HTTP/2 or gRPC; and select **gRPC** , when the request protocol is gRPC. +Console @@ -58 +40,0 @@ Note that only targets that have the selected IP address type can be included in - 5. In the **Health checks** section, modify the default settings as needed. For **Advanced health check settings** , choose the health check port, count, timeout, interval, and specify success codes. If health checks consecutively exceed the **Unhealthy threshold** count, the load balancer takes the target out of service. If health checks consecutively exceed the **Healthy threshold** count, the load balancer puts the target back in service. For more information, see [Health checks for Application Load Balancer target groups](./target-group-health-checks.html). @@ -60 +42 @@ Note that only targets that have the selected IP address type can be included in - 6. (Optional) Add one or more tags as follows: +###### To create an Application Load Balancer @@ -62,3 +44 @@ Note that only targets that have the selected IP address type can be included in - 1. Expand the **Tags** section. - - 2. Choose **Add tag**. + 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). @@ -66 +46 @@ Note that only targets that have the selected IP address type can be included in - 3. Enter the tag **Key** and tag **Value**. Allowed characters are letters, spaces, numbers (in UTF-8), and the following special characters: + \- = . _ : / @. Do not use leading or trailing spaces. Tag values are case-sensitive. + 2. In the navigation pane, choose **Load Balancers**. @@ -68 +48 @@ Note that only targets that have the selected IP address type can be included in - 7. Choose **Next**. + 3. Choose **Create load balancer**. @@ -69,0 +50 @@ Note that only targets that have the selected IP address type can be included in + 4. Under **Application Load Balancer** , choose **Create**. @@ -70,0 +52 @@ Note that only targets that have the selected IP address type can be included in + 5. **Basic configuration** @@ -71,0 +54 @@ Note that only targets that have the selected IP address type can be included in + 1. For **Load balancer name** , enter a name for your load balancer. The name must be unique within your set of load balancers for the Region. Names can have a maximum of 32 characters, and can contain only alphanumeric characters and hyphens. They can not begin or end with a hyphen, or with `internal-`. You can't change the name of your Application Load Balancer after it's created. @@ -73 +56 @@ Note that only targets that have the selected IP address type can be included in -## Step 2: Register targets + 2. For **Scheme** , choose **Internet-facing** or **Internal**. An internet-facing load balancer routes requests from clients to targets over the internet. An internal load balancer routes requests to targets using private IP addresses. @@ -75 +58 @@ Note that only targets that have the selected IP address type can be included in -You can register EC2 instances, IP addresses, or Lambda functions as targets in a target group. This is an optional step to create a load balancer. However, you must register your targets to ensure that your load balancer routes traffic to them. + 3. For **Load balancer IP address type** , choose **IPv4** if your clients use IPv4 addresses to communicate with the load balancer or **Dualstack** if your clients use both IPv4 and IPv6 addresses to communicate with the load balancer. Choose **Dualstack without public IPv4** if your clients use only IPv6 addresses to communicate with the load balancer. @@ -77 +60 @@ You can register EC2 instances, IP addresses, or Lambda functions as targets in - 1. In the **Register targets** page, add one or more targets as follows: + 6. **Network mapping** @@ -79 +62 @@ You can register EC2 instances, IP addresses, or Lambda functions as targets in - * If the target type is **Instances** , select one or more instances, enter one or more ports, and then choose **Include as pending below**. + 1. For **VPC** , select the VPC that you prepared for your load balancer. With an internet-facing load balancer, only VPCs with an internet gateway are available for selection. @@ -81 +64 @@ You can register EC2 instances, IP addresses, or Lambda functions as targets in - * If the target type is **IP addresses** , do the following: + 2. (Optional) For **IP pools** , you can select **Use IPAM pool for public IPv4 addresses**. For more information, see [IPAM IP address pools](./application-load-balancers.html#ip-pools). @@ -83 +66 @@ You can register EC2 instances, IP addresses, or Lambda functions as targets in - 1. Select a network **VPC** from the list, or choose **Other private IP addresses**. + 3. For **Availability Zones and subnets** , enable zones for your load balancer as follows: @@ -85 +68 @@ You can register EC2 instances, IP addresses, or Lambda functions as targets in - 2. Enter the IP address manually, or find the IP address using instance details. You can enter up to five IP addresses at a time. + * Select subnets from at least two Availability Zones @@ -87 +70 @@ You can register EC2 instances, IP addresses, or Lambda functions as targets in - 3. Enter the ports for routing traffic to the specified IP addresses. + * Select subnets from at least one Local Zone @@ -89 +72 @@ You can register EC2 instances, IP addresses, or Lambda functions as targets in - 4. Choose **Include as pending below**. + * Select one Outpost subnet @@ -91 +74 @@ You can register EC2 instances, IP addresses, or Lambda functions as targets in - * If the target type is **Lambda** , select a Lambda function, or enter a Lambda function ARN, and then choose **Include as pending below**. +For more information, see [Subnets for your load balancer](./application-load-balancers.html#subnets-load-balancer). @@ -93 +76 @@ You can register EC2 instances, IP addresses, or Lambda functions as targets in - 2. Choose **Create target group**. +With a **Dualstack** load balancer, you must select subnets with both IPv4 and IPv6 CIDR blocks. @@ -94,0 +78 @@ You can register EC2 instances, IP addresses, or Lambda functions as targets in + 7. **Security groups** @@ -95,0 +80 @@ You can register EC2 instances, IP addresses, or Lambda functions as targets in +We preselect the default security group for the load balancer VPC. You can select additional security groups as needed. If you don't have a security group that meets your needs, choose **create a new security group** to create one now. For more information, see [Create a security group](https://docs.aws.amazon.com/vpc/latest/userguide/creating-security-groups.html) in the _Amazon VPC User Guide_. @@ -96,0 +82 @@ You can register EC2 instances, IP addresses, or Lambda functions as targets in + 8. **Listeners and routing** @@ -98 +84 @@ You can register EC2 instances, IP addresses, or Lambda functions as targets in -## Step 3: Configure a load balancer and a listener + 1. The default is a listener that accepts HTTP traffic on port 80. You can keep the default listener settings, or modify **Protocol** and **Port** as needed. @@ -100 +86 @@ You can register EC2 instances, IP addresses, or Lambda functions as targets in -To create an Application Load Balancer, you must first provide basic configuration information for your load balancer, such as a name, scheme, and IP address type. Then, you provide information about your network, and one or more listeners. A listener is a process that checks for connection requests. It is configured with a protocol and a port for connections from clients to the load balancer. For more information about supported protocols and ports, see [Listener configuration](./load-balancer-listeners.html#listener-configuration). + 2. For **Default action** , select a target group to forward traffic. If you don't have a target group that meets your needs, choose **Create target group** to create one now. For more information, see [Create a target group](./create-target-group.html). @@ -102 +88 @@ To create an Application Load Balancer, you must first provide basic configurati -###### To configure your load balancer and listener using the console + 3. (Optional) Choose **Add listener tag** and enter a tag key and a tag value. @@ -104 +90 @@ To create an Application Load Balancer, you must first provide basic configurati - 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). + 4. (Optional) Choose **Add listener** to add another listener (for example, an HTTPS listener). @@ -106 +92 @@ To create an Application Load Balancer, you must first provide basic configurati - 2. In the navigation pane, choose **Load Balancers**. + 9. **Secure listener settings** @@ -108 +94 @@ To create an Application Load Balancer, you must first provide basic configurati - 3. Choose **Create Load Balancer**. +This section appears only if you add an HTTPS listener. @@ -110 +96 @@ To create an Application Load Balancer, you must first provide basic configurati - 4. Under **Application Load Balancer** , choose **Create**. + 1. For **Security policy** , choose a security policy that meets your requirements. For more information, see [Security policies](./describe-ssl-policies.html). @@ -112 +98 @@ To create an Application Load Balancer, you must first provide basic configurati - 5. **Basic configuration** + 2. For **Default SSL/TLS certificate** , the following options are available: @@ -114 +100 @@ To create an Application Load Balancer, you must first provide basic configurati - 1. For **Load balancer name** , enter a name for your load balancer. For example, `my-alb`. The name of your Application Load Balancer must be unique within your set of Application Load Balancers and Network Load Balancers for the Region. Names can have a maximum of 32 characters, and can contain only alphanumeric characters and hyphens. They can not begin or end with a hyphen, or with `internal-`. The name of your Application Load Balancer cannot be changed after it's created. + * If you created or imported a certificate using AWS Certificate Manager, choose **From ACM** , then choose the certificate. @@ -116 +102 @@ To create an Application Load Balancer, you must first provide basic configurati - 2. For **Scheme** , choose **Internet-facing** or **Internal**. An internet-facing load balancer routes requests from clients to targets over the internet. An internal load balancer routes requests to targets using private IP addresses. + * If you imported a certificate using IAM, choose **From IAM** , and then choose your certificate. @@ -118 +104 @@ To create an Application Load Balancer, you must first provide basic configurati - 3. For **IP address type** , choose **IPv4** , **Dualstack** , or **Dualstack without public IPv4**. Choose **IPv4** if your clients use IPv4 addresses to communicate with the load balancer. Choose **Dualstack** if your clients use both IPv4 and IPv6 addresses to communicate with the load balancer. Choose **Dualstack without public IPv4** if your clients use only IPv6 addresses to communicate with the load balancer. + * If you don't have an available certificate in ACM but do have a certificate for use with your load balancer, select **Import certificate** and provide the required information. Otherwise, choose **Request new ACM certificate**. For more information, see [AWS Certificate Manager certificates](https://docs.aws.amazon.com/acm/latest/userguide/gs.html) in the _AWS Certificate Manager User Guide_. @@ -120 +106 @@ To create an Application Load Balancer, you must first provide basic configurati - 6. **Network mapping** + 3. (Optional) Select **Mutual authentication (mTLS)** , choose a policy to enable ALPN. @@ -122 +108 @@ To create an Application Load Balancer, you must first provide basic configurati - 1. For **VPC** , select the VPC that you used for your EC2 instances. If you selected **Internet-facing** for **Scheme** , only VPCs with an internet gateway are available for selection. +For more information, see [Mutual TLS authentication](./mutual-authentication.html). @@ -124 +110 @@ To create an Application Load Balancer, you must first provide basic configurati - 2. For **IPAM IP address pools** you can choose to **Use IPAM pool for public IPv4 addresses**. For more information, see [IPAM IP address pools](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html#ip-pools) + 10. **Optimize with service integrations** @@ -126 +112 @@ To create an Application Load Balancer, you must first provide basic configurati - 3. For **Availability Zones and subnets** , enable zones for your load balancer by selecting subnets as follows: +(Optional) You can integrate other AWS with your load balancer. For more information, see [Load balancer integrations](./load-balancer-integrations.html). @@ -128 +114 @@ To create an Application Load Balancer, you must first provide basic configurati - * Subnets from two or more Availability Zones + 11. **Load balancer tags** @@ -130 +116 @@ To create an Application Load Balancer, you must first provide basic configurati - * Subnets from one or more Local Zones +(Optional) Expand **Load balancer tags**. Choose **Add new tag** and enter a tag key and a tag value. For more information, see [Tags](./load-balancer-tags.html). @@ -132 +118 @@ To create an Application Load Balancer, you must first provide basic configurati - * One Outpost subnet + 12. **Summary** @@ -134 +120 @@ To create an Application Load Balancer, you must first provide basic configurati -For more information, see [Subnets for your load balancer](./application-load-balancers.html#subnets-load-balancer). +Review your configuration, and choose **Create load balancer**. A few default attributes are applied to your Network Load Balancer during creation. You can view and edit them after creating the Network Load Balancer. For more information, see [Load balancer attributes](./application-load-balancers.html#load-balancer-attributes). @@ -136 +121,0 @@ For more information, see [Subnets for your load balancer](./application-load-ba -For internal load balancers, the IPv4 and IPv6 addresses are assigned from the subnet CIDR. @@ -138 +122,0 @@ For internal load balancers, the IPv4 and IPv6 addresses are assigned from the s -If you enabled **Dualstack** mode for the load balancer, select subnets with both IPv4 and IPv6 CIDR blocks. @@ -140 +123,0 @@ If you enabled **Dualstack** mode for the load balancer, select subnets with bot - 7. For **Security groups** , select an existing security group, or create a new one. @@ -142 +125 @@ If you enabled **Dualstack** mode for the load balancer, select subnets with bot -The security group for your load balancer must allow it to communicate with registered targets on both the listener port and the health check port. The console can create a security group for your load balancer on your behalf with rules that allow this communication. You can also create a security group and select it instead. For more information, see [Recommended rules](./load-balancer-update-security-groups.html#security-group-recommended-rules). +AWS CLI @@ -144 +126,0 @@ The security group for your load balancer must allow it to communicate with regi -(Optional) To create a new security group for your load balancer, choose **Create a new security group**. @@ -146 +128 @@ The security group for your load balancer must allow it to communicate with regi - 8. For **Listeners and routing** , the default listener accepts HTTP traffic on port 80. You can keep the default protocol and port, or choose different ones. For **Default action** , choose the target group that you created. You can optionally choose **Add listener** to add another listener (for example, an HTTPS listener). +###### To create an Application Load Balancer @@ -148 +130 @@ The security group for your load balancer must allow it to communicate with regi - 9. (Optional) If using an HTTPS listener +Use the [create-load-balancer](https://docs.aws.amazon.com/cli/latest/reference/elbv2/create-load-balancer.html) command.