AWS elasticloadbalancing medium security documentation change
Summary
Restructured documentation to separate 'Register targets' and 'Deregister targets' sections. Added detailed requirements for target registration including CIDR restrictions, VPC constraints, and operational state requirements. Enhanced CLI/console instructions with specific examples for different target types (instance/IP/Lambda).
Security assessment
Added explicit CIDR block restrictions (RFC 1918/RFC 6598 ranges) for IP-based target registration to prevent exposure of unauthorized networks. Specified that instances must be in 'running' state and within the target group's VPC to avoid misconfiguration risks. Added prohibition against registering same-VPC ALB IPs, which could prevent accidental internal exposure. These changes enforce security boundaries and reduce attack surface.
Diff
diff --git a/elasticloadbalancing/latest/application/target-group-register-targets.md b/elasticloadbalancing/latest/application/target-group-register-targets.md index 49326272d..4f600baef 100644 --- a//elasticloadbalancing/latest/application/target-group-register-targets.md +++ b//elasticloadbalancing/latest/application/target-group-register-targets.md @@ -5 +5 @@ -Target security groupsShared subnetsRegister or deregister targets +Target security groupsShared subnetsRegister targetsDeregister targets @@ -39 +39,3 @@ Participants can create an Application Load Balancer in a shared VPC. Participan -## Register or deregister targets +## Register targets + +Each target group must have at least one registered target in each Availability Zone that is enabled for the load balancer. @@ -43 +45 @@ The target type of your target group determines how you register targets with th -###### Contents +###### Requirements and considerations @@ -45 +47 @@ The target type of your target group determines how you register targets with th - * Register or deregister targets by instance ID + * An instance must be in the `running` state when you register it. @@ -47 +49 @@ The target type of your target group determines how you register targets with th - * Register or deregister targets by IP address + * A target instance must be in the virtual private cloud (VPC) that you specified for the target group. @@ -49 +51 @@ The target type of your target group determines how you register targets with th - * Register or deregister a Lambda function + * When registering targets by instance ID for a IPv6 target group, the targets must have an assigned primary IPv6 address. To learn more, see [ IPv6 addresses](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#ipv6-addressing) in the _Amazon EC2 User Guide_ @@ -51 +53 @@ The target type of your target group determines how you register targets with th - * Register or deregister targets using the AWS CLI + * When registering targets by IP address for an IPv4 target group, the IP addresses that you register must be from one of the following CIDR blocks: @@ -52,0 +55 @@ The target type of your target group determines how you register targets with th + * The subnets of the target group VPC @@ -53,0 +57 @@ The target type of your target group determines how you register targets with th + * 10.0.0.0/8 (RFC 1918) @@ -54,0 +59 @@ The target type of your target group determines how you register targets with th + * 100.64.0.0/10 (RFC 6598) @@ -56 +61 @@ The target type of your target group determines how you register targets with th -### Register or deregister targets by instance ID + * 172.16.0.0/12 (RFC 1918) @@ -58 +63 @@ The target type of your target group determines how you register targets with th -###### Note + * 192.168.0.0/16 (RFC 1918) @@ -60 +65 @@ The target type of your target group determines how you register targets with th -When registering targets by instance ID for a IPv6 target group, the targets must have an assigned primary IPv6 address. To learn more, see [ IPv6 addresses](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#ipv6-addressing) in the _Amazon EC2 User Guide_ + * When registering targets by IP address for an IPv6 target group, the IP addresses that you register must be within the VPC IPv6 CIDR block or within the IPv6 CIDR block of a peered VPC. @@ -62 +67 @@ When registering targets by instance ID for a IPv6 target group, the targets mus -The instance must be in the virtual private cloud (VPC) that you specified for the target group. The instance must also be in the `running` state when you register it. + * You can't register the IP addresses of another Application Load Balancer in the same VPC. If the other Application Load Balancer is in a VPC that is peered to the load balancer VPC, you can register its IP addresses. @@ -64 +68,0 @@ The instance must be in the virtual private cloud (VPC) that you specified for t -###### To register or deregister targets by instance ID using the console @@ -66 +69,0 @@ The instance must be in the virtual private cloud (VPC) that you specified for t - 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). @@ -68 +70,0 @@ The instance must be in the virtual private cloud (VPC) that you specified for t - 2. On the navigation pane, under **Load Balancing** , choose **Target Groups**. @@ -70 +72 @@ The instance must be in the virtual private cloud (VPC) that you specified for t - 3. Choose the name of the target group to open its details page. +Console @@ -72 +73,0 @@ The instance must be in the virtual private cloud (VPC) that you specified for t - 4. Choose the **Targets** tab. @@ -74 +75 @@ The instance must be in the virtual private cloud (VPC) that you specified for t - 5. To register instances, choose **Register targets**. Select one or more instances, enter the default instance port as needed, and then choose **Include as pending below**. When you are finished adding instances, choose **Register pending targets**. +###### To register targets @@ -76 +77 @@ The instance must be in the virtual private cloud (VPC) that you specified for t -**Note:** + 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). @@ -78 +79 @@ The instance must be in the virtual private cloud (VPC) that you specified for t - * The instances must have an assigned primary IPv6 address to be registered with a IPv6 target group. + 2. On the navigation pane, under **Load Balancing** , choose **Target Groups**. @@ -80 +81 @@ The instance must be in the virtual private cloud (VPC) that you specified for t - * AWS GovCloud (US) Regions don't support assigning a primary IPv6 address using the console. You must use the API to assign primary IPv6 addresses in AWS GovCloud (US) Regions. + 3. Choose the name of the target group to open its details page. @@ -82 +83 @@ The instance must be in the virtual private cloud (VPC) that you specified for t - 6. To deregister instances, select the instances and then choose **Deregister**. + 4. Choose the **Targets** tab. @@ -83,0 +85 @@ The instance must be in the virtual private cloud (VPC) that you specified for t + 5. Choose **Register targets**. @@ -84,0 +87 @@ The instance must be in the virtual private cloud (VPC) that you specified for t + 6. If the target type of the target group is `instance`, select available instances, override the default port if needed, and then choose **Include as pending below**. @@ -85,0 +89 @@ The instance must be in the virtual private cloud (VPC) that you specified for t + 7. If the target type of the target group is `ip`, for each IP address, select the network, enter the IP addresses and ports, and choose **Include as pending below**. @@ -87 +91 @@ The instance must be in the virtual private cloud (VPC) that you specified for t -### Register or deregister targets by IP address + 8. If the target type of the target group is `lambda`, select the Lambda function or enter its ARN. For more information, see [Use Lambda functions as targets](./lambda-functions.html). @@ -89 +93 @@ The instance must be in the virtual private cloud (VPC) that you specified for t -###### IPv4 targets + 9. Choose **Register pending targets**. @@ -91 +94,0 @@ The instance must be in the virtual private cloud (VPC) that you specified for t -The IP addresses that you register must be from one of the following CIDR blocks: @@ -93 +95,0 @@ The IP addresses that you register must be from one of the following CIDR blocks - * The subnets of the VPC for the target group @@ -95 +96,0 @@ The IP addresses that you register must be from one of the following CIDR blocks - * 10.0.0.0/8 (RFC 1918) @@ -97 +98 @@ The IP addresses that you register must be from one of the following CIDR blocks - * 100.64.0.0/10 (RFC 6598) +AWS CLI @@ -99 +99,0 @@ The IP addresses that you register must be from one of the following CIDR blocks - * 172.16.0.0/12 (RFC 1918) @@ -101 +101 @@ The IP addresses that you register must be from one of the following CIDR blocks - * 192.168.0.0/16 (RFC 1918) +###### To register targets @@ -102,0 +103 @@ The IP addresses that you register must be from one of the following CIDR blocks +Use the [register-targets](https://docs.aws.amazon.com/cli/latest/reference/elbv2/register-targets.html) command. The following example registers targets by instance ID. Because the port is not specified, the load balancer uses the target group port. @@ -104,0 +106,3 @@ The IP addresses that you register must be from one of the following CIDR blocks + aws elbv2 register-targets \ + --target-group-arn target-group-arn \ + --targets Id=i-1234567890abcdef0 Id=i-0abcdef1234567890 @@ -106 +110 @@ The IP addresses that you register must be from one of the following CIDR blocks -You can't register the IP addresses of another Application Load Balancer in the same VPC. If the other Application Load Balancer is in a VPC that is peered to the load balancer VPC, you can register its IP addresses. +The following example registers targets by IP address. Because the port is not specified, the load balancer uses the target group port. @@ -108 +111,0 @@ You can't register the IP addresses of another Application Load Balancer in the -###### IPv6 targets @@ -110 +113,3 @@ You can't register the IP addresses of another Application Load Balancer in the - * The IP addresses that you register must be within the VPC CIDR block or within a peered VPC CIDR block. + aws elbv2 register-targets \ + --target-group-arn target-group-arn \ + --targets Id=10.0.50.10 Id=10.0.50.20 @@ -111,0 +117 @@ You can't register the IP addresses of another Application Load Balancer in the +The following example registers a Lambda function as a target. @@ -113,0 +120,3 @@ You can't register the IP addresses of another Application Load Balancer in the + aws elbv2 register-targets \ + --target-group-arn target-group-arn \ + --targets Id=lambda-function-arn @@ -115 +124 @@ You can't register the IP addresses of another Application Load Balancer in the -###### To register or deregister targets by IP address using the console +CloudFormation @@ -117 +125,0 @@ You can't register the IP addresses of another Application Load Balancer in the - 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). @@ -119 +127 @@ You can't register the IP addresses of another Application Load Balancer in the - 2. On the navigation pane, under **Load Balancing** , choose **Target Groups**. +###### To register targets @@ -121 +129 @@ You can't register the IP addresses of another Application Load Balancer in the - 3. Choose the name of the target group to open its details page. +Update the [AWS::ElasticLoadBalancingV2::TargetGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-targetgroup.html) resource to include the new targets. The following example registers two targets by instance ID. @@ -123 +130,0 @@ You can't register the IP addresses of another Application Load Balancer in the - 4. Choose the **Targets** tab. @@ -125 +132,14 @@ You can't register the IP addresses of another Application Load Balancer in the - 5. To register IP addresses, choose **Register targets**. For each IP address, select the network, enter the IP address and port, and choose **Include as pending below**. + Resources: + myTargetGroup: + Type: 'AWS::ElasticLoadBalancingV2::TargetGroup' + Properties: + Name: my-target-group + Protocol: HTTP + Port: 80 + TargetType: instance + VpcId: !Ref myVPC + Targets: + -Id: i-1234567890abcdef0 + Port: 80 + -Id: i-0abcdef1234567890 + Port: 80 @@ -127 +147 @@ You can't register the IP addresses of another Application Load Balancer in the - 6. **Optional:** If the IP address is outside of the selected VPC, you must specify an **Availability Zone**. +## Deregister targets @@ -129 +149 @@ You can't register the IP addresses of another Application Load Balancer in the - 7. When you are finished specifying addresses, choose **Register pending targets**. +If demand on your application decreases, or if you need to service your targets, you can deregister targets from your target groups. Deregistering a target removes it from your target group, but does not affect the target otherwise. @@ -131 +151 @@ You can't register the IP addresses of another Application Load Balancer in the - 8. To deregister IP addresses, select the IP addresses and then choose **Deregister**. If you have many registered IP addresses, you might find it helpful to add a filter or change the sort order. +Console @@ -133,0 +154 @@ You can't register the IP addresses of another Application Load Balancer in the +###### To deregister targets @@ -134,0 +156 @@ You can't register the IP addresses of another Application Load Balancer in the + 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). @@ -136 +158 @@ You can't register the IP addresses of another Application Load Balancer in the -### Register or deregister a Lambda function + 2. On the navigation pane, under **Load Balancing** , choose **Target Groups**. @@ -138 +160 @@ You can't register the IP addresses of another Application Load Balancer in the -You can register a single Lambda function with each target group. Elastic Load Balancing must have permissions to invoke the Lambda function. If you no longer need to send traffic to your Lambda function, you can deregister it. After you deregister a Lambda function, in-flight requests fail with HTTP 5XX errors. To replace a Lambda function, it is better to create a new target group instead. For more information, see [Use Lambda functions as targets of an Application Load Balancer](./lambda-functions.html). + 3. Choose the name of the target group to open its details page. @@ -140 +162 @@ You can register a single Lambda function with each target group. Elastic Load B -###### To register or deregister a Lambda function using the console + 4. On the **Targets** tab, select the targets to remove. @@ -142 +164 @@ You can register a single Lambda function with each target group. Elastic Load B - 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). + 5. Choose **Deregister**. @@ -144 +166 @@ You can register a single Lambda function with each target group. Elastic Load B - 2. On the navigation pane, under **Load Balancing** , choose **Target Groups**. + 6. When prompted for confirmation, choose **Deregister**. @@ -146 +167,0 @@ You can register a single Lambda function with each target group. Elastic Load B - 3. Choose the name of the target group to open its details page. @@ -148 +168,0 @@ You can register a single Lambda function with each target group. Elastic Load B - 4. Choose the **Targets** tab. @@ -150 +169,0 @@ You can register a single Lambda function with each target group. Elastic Load B - 5. If there is no Lambda function registered, choose **Register**. Select the Lambda function and choose **Register**. @@ -152 +171 @@ You can register a single Lambda function with each target group. Elastic Load B - 6. To deregister a Lambda function, choose **Deregister**. When prompted for confirmation, choose **Deregister**. +AWS CLI @@ -154,0 +174 @@ You can register a single Lambda function with each target group. Elastic Load B +###### To deregister targets @@ -155,0 +176 @@ You can register a single Lambda function with each target group. Elastic Load B +Use the [deregister-targets](https://docs.aws.amazon.com/cli/latest/reference/elbv2/deregister-targets.html) command. The following example deregisters two targets that were registered by instance ID. @@ -157 +177,0 @@ You can register a single Lambda function with each target group. Elastic Load B -### Register or deregister targets using the AWS CLI @@ -159 +179,3 @@ You can register a single Lambda function with each target group. Elastic Load B -Use the [register-targets](https://docs.aws.amazon.com/cli/latest/reference/elbv2/register-targets.html) command to add targets and the [deregister-targets](https://docs.aws.amazon.com/cli/latest/reference/elbv2/deregister-targets.html) command to remove targets. + aws elbv2 deregister-targets \ + --target-group-arn target-group-arn \ + --targets Id=i-1234567890abcdef0 Id=i-0abcdef1234567890