Elastic Load Balancing Developer Guide

Elastic Load Balancing

Developer Guide

API Version 2012-06-01

Elastic Load Balancing: Developer Guide

All trademarks not owned by Amazon are the property of their respective owners, who may or may not be affiliated with, connected

to, or sponsored by Amazon.

AWS services or capabilities described in AWS Documentation may vary by region/location. Click Getting Started with Amazon AWS

to see specific differences applicable to the China (Beijing) Region.

Elastic Load Balancing Developer Guide

Table of Contents

What Is Elastic Load Balancing? ...................................................................................................... 1

How Elastic Load Balancing Works ........................................................................................... 2

Architectural Overview of Elastic Load Balancing ................................................................ 3

Supported Platforms .............................................................................................................. 4

Concepts ............................................................................................................................. 4

Load Balancer .............................................................................................................. 5

Availability Zones and Regions ........................................................................................ 5

Request Routing ........................................................................................................... 6

Configuring EC2 Instances for Load Balancing ................................................................... 7

Health Check ................................................................................................................ 7

Connection Draining ...................................................................................................... 9

Idle Connection Timeout ............................................................................................... 10

Sticky Sessions ........................................................................................................... 10

HTTP Methods ............................................................................................................ 11

HTTPS Support ........................................................................................................... 11

Proxy Protocol ............................................................................................................. 11

Tagging ...................................................................................................................... 12

X-Forwarded Headers .................................................................................................. 13

Interfaces ........................................................................................................................... 14

Regions and Endpoints ......................................................................................................... 15

Limits ................................................................................................................................ 15

Related Services ................................................................................................................. 16

Next Steps ................................................................................................................. 17

Setting Up .................................................................................................................................. 18

Sign Up ............................................................................................................................. 18

AWS Management Console ................................................................................................... 19

AWS Command Line Interface ............................................................................................... 20

Query Requests .................................................................................................................. 21

Signing Query Requests ............................................................................................... 21

AWS SDKs ......................................................................................................................... 22

Next Steps ......................................................................................................................... 22

Getting Started ............................................................................................................................ 23

Create a Basic Load Balancer in EC2-Classic ........................................................................... 23

Configure Listeners for Your Load Balancer ...................................................................... 24

Configure Health Check for Your Amazon EC2 Instances .................................................... 26

Review Settings and Create Your Load Balancer ............................................................... 28

Verify the Creation of Your Load Balancer ......................................................................... 28

Delete Your Load Balancer ............................................................................................ 30

Create a Basic Load Balancer in EC2-VPC .............................................................................. 31

Configure Listeners for Your Load Balancer ...................................................................... 32

Configure Health Check for Your Amazon EC2 Instances .................................................... 34

Select a Subnet for Your Back-end Instance ...................................................................... 35

Assign a Security Group to Your Load Balancer ................................................................. 36

Review Settings and Create Your Load Balancer ............................................................... 37

Verify Creation of Your Load Balancer ............................................................................. 38

Delete Your Load Balancer ............................................................................................ 39

Create a Basic Load Balancer in Default VPC ........................................................................... 41

Configure Listeners for Your Load Balancer ...................................................................... 42

Configure Health Check for Your Amazon EC2 Instances .................................................... 43

Assign a Security Group to Your Load Balancer ................................................................. 44

Review Settings and Create Your Load Balancer ............................................................... 45

Verify Creation of Your Load Balancer ............................................................................. 46

API Version 2012-06-01

iii

Elastic Load Balancing Developer Guide

Delete Your Load Balancer ............................................................................................ 48

Listener Configurations ................................................................................................................. 49

Listeners ............................................................................................................................ 49

Using TCP/SSL Protocol with Elastic Load Balancing ................................................................. 50

Using HTTP/HTTPS Protocol with Elastic Load Balancing .......................................................... 50

SSL Server Certificates ........................................................................................................ 51

SSL Negotiation ................................................................................................................. 51

Using Back-End Server Authentication with Elastic Load Balancing .............................................. 51

Listener Configurations Quick Reference ................................................................................. 52

Next Steps ......................................................................................................................... 54

SSL Negotiation Configurations ...................................................................................................... 55

SSL Security Policies ........................................................................................................... 56

SSL Security Policy Table ...................................................................................................... 56

SSL Certificates .......................................................................................................................... 61

Prerequisite: Install and Configure OpenSSL ............................................................................ 62

Generate Private Key and Certificate Signing Request ............................................................... 63

Create a Private Key .................................................................................................... 63

Create a Certificate Signing Request .............................................................................. 64

Submit CSR to Certificate Authority ................................................................................ 65

Upload the Signed Certificate ................................................................................................ 65

Verify Server Certificate ........................................................................................................ 67

Sample Certificates .............................................................................................................. 68

Elastic Load Balancing in Amazon EC2-Classic ................................................................................ 70

Create HTTPS/SSL Load Balancer ......................................................................................... 72

Using the AWS Management Console ............................................................................. 72

Using the AWS Command Line Interface ......................................................................... 82

Add or Remove Availability Zones ........................................................................................... 96

Add Availability Zone ................................................................................................... 96

Remove Availability Zone .............................................................................................. 99

Security Groups ................................................................................................................. 101

Locking down traffic between Elastic Load Balancing and back-end Amazon EC2 instance ..... 101

Internet Protocol version 6 (IPv6) .......................................................................................... 111

IPv6 and CNAME records for Elastic Load Balancing ....................................................... 111

IPv6 and Hosted Zones for Elastic Load Balancing .......................................................... 112

Elastic Load Balancing in Amazon VPC ......................................................................................... 113

Understanding Public and Private Subnets ............................................................................. 114

Security for Your Load Balancers and Instances in Amazon VPC ................................................ 115

Default VPC ...................................................................................................................... 115

Internet-facing and Internal Load Balancers ............................................................................ 116

Configure Amazon VPC for Elastic Load Balancing .................................................................. 118

Create an Internal Load Balancer ......................................................................................... 119

Using the AWS Management Console ........................................................................... 120

Using the AWS Command Line Interface ........................................................................ 124

Using the Query API ................................................................................................... 127

Attach Subnets .................................................................................................................. 129

Using AWS Management Console ................................................................................ 129

Using the AWS Command Line Interface ........................................................................ 130

Using the Query API ................................................................................................... 130

Detach Subnet .................................................................................................................. 131

Using AWS Management Console ................................................................................ 131

Using the AWS Command Line Interface ........................................................................ 131

Using the Query API ................................................................................................... 132

Security Groups ................................................................................................................. 133

Using the AWS Management Console ........................................................................... 133

Using the AWS Command Line Interface ........................................................................ 133

Using the Query API ................................................................................................... 134

Managing Load Balancers ........................................................................................................... 135

Add Listener ..................................................................................................................... 136

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Using the AWS Management Console ........................................................................... 136

Using the AWS Command Line Interface ........................................................................ 138

Using the Query API ................................................................................................... 140

Delete Listener .................................................................................................................. 142

Using the AWS Management Console ........................................................................... 142

Using the AWS Command Line Interface ........................................................................ 142

Using the Query API ................................................................................................... 143

Deregister and Register Instances ........................................................................................ 145

De-Registering Your Amazon EC2 Instances from Your Load Balancer ................................ 145

Registering Your Amazon EC2 Instances with Your Load Balancer ...................................... 146

Update SSL Certificate ....................................................................................................... 147

Using the AWS Management Console ........................................................................... 148

Using the AWS Command Line Interface ........................................................................ 149

Using the Query API ................................................................................................... 149

Update SSL Negotiation Configuration ................................................................................... 151

Using the AWS Management Console ........................................................................... 151

Using the AWS Command Line Interface ........................................................................ 152

Using the Query API ................................................................................................... 156

Custom Domain Names ...................................................................................................... 158

Associating Your Custom Domain Name with Your Load Balancer Name .............................. 158

Disassociating Your Custom Domain Name From Your Load Balancer Name ........................ 162

Cross-Zone Load Balancing ................................................................................................. 163

Enable Cross-Zone Load Balancing .............................................................................. 163

Disable Cross-Zone Load Balancing .............................................................................. 166

Connection Draining ........................................................................................................... 170

Enable Connection Draining ......................................................................................... 170

Disable Connection Draining ........................................................................................ 173

Idle Timeout ...................................................................................................................... 177

Using the AWS Management Console ........................................................................... 177

Using the AWS Command Line Interface ........................................................................ 177

Using the Query API ................................................................................................... 179

Proxy Protocol ................................................................................................................... 181

Enable Proxy Protocol Using the AWS Command Line Interface ......................................... 182

Enable Proxy Protocol Using the Query API .................................................................... 188

DNS Failover ..................................................................................................................... 194

Prerequisites ............................................................................................................. 194

Use the Console to Configure DNS Failover for Your Load Balancers ................................... 194

Sticky Sessions ................................................................................................................. 198

Duration-Based Session Stickiness ............................................................................... 198

Application-Controlled Session Stickiness ...................................................................... 203

Tags ................................................................................................................................ 208

Add Tags .................................................................................................................. 208

Remove Tags ............................................................................................................ 211

Delete Your Load Balancer ................................................................................................... 215

Using the AWS Management Console .......................................................................... 215

Using the Query API .................................................................................................. 215

Using the AWS Command Line Interface ........................................................................ 215

Monitoring and Logging ............................................................................................................... 217

Monitoring Load Balancers .................................................................................................. 218

Available Metrics ........................................................................................................ 218

View Metrics ............................................................................................................ 225

Create Alarms ........................................................................................................... 226

Access Logs ..................................................................................................................... 228

Access Log File ......................................................................................................... 228

Access Log Entry ....................................................................................................... 229

Log Processing .......................................................................................................... 231

Enable Access Logs ................................................................................................... 231

Disable Access Logs ................................................................................................. 237

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Configure an Amazon S3 Bucket for Storing Access Logs ................................................. 241

Elastic Load Balancing API Call Logs .................................................................................... 245

Configure CloudTrail Event Logging ............................................................................... 245

Elastic Load Balancing Event Entries in CloudTrail Log Files .............................................. 245

Controlling User Access to Your Load Balancer ............................................................................... 248

Using IAM Policy to Grant Permissions ................................................................................. 248

IAM Policy Syntax ...................................................................................................... 248

Allow or Deny Permissions in an IAM Policy .................................................................... 249

Specifying ELB Actions in an IAM Policy ........................................................................ 249

Specifying ELB Resources in an IAM Policy .................................................................... 250

Specifying Condition Keys in an IAM Policy ..................................................................... 251

Example IAM Policies for Elastic Load Balancing ............................................................. 252

Troubleshooting ......................................................................................................................... 255

API Response ................................................................................................................... 256

CertificateNotFound: undefined .................................................................................... 256

OutofService: A Transient Error Occurred ....................................................................... 257

Error Messages ................................................................................................................. 257

HTTP 400: BAD_REQUEST ........................................................................................ 257

HTTP 405: METHOD_NOT_ALLOWED ......................................................................... 257

HTTP 408: Request Timeout ........................................................................................ 257

HTTP 502: Bad Gateway ............................................................................................. 257

HTTP 503: Service Unavailable or HTTP 504 Gateway Timeout ......................................... 257

Response Codes ............................................................................................................... 258

What is Response Code Metrics? ................................................................................. 258

HTTPCode_ELB_4XX ................................................................................................ 258

HTTPCode_ELB_5XX ................................................................................................ 258

HTTPCode_Backend_2XX .......................................................................................... 259

HTTPCode_Backend_3XX .......................................................................................... 259

HTTPCode_Backend_4XX .......................................................................................... 259

HTTPCode_Backend_5XX .......................................................................................... 259

Health Check .................................................................................................................... 259

Connection to the instances has timed out ...................................................................... 260

Health check target page error ..................................................................................... 260

Public key authentication is failing ................................................................................. 261

Stopped and started instances failing load balancer health check ....................................... 261

Instance is not receiving traffic from the load balancer. ..................................................... 261

Ports on instance are not open ..................................................................................... 262

Instances in the Auto Scaling group are failing load balancer health check ........................... 262

Registering Instances ......................................................................................................... 262

Taking too long to register back-end instances. ................................................................ 262

Unable to register instance launched from a paid AMI. ...................................................... 263

Resources ................................................................................................................................ 264

Document History ...................................................................................................................... 265

Appendices ............................................................................................................................... 272

Appendix A: Using the Elastic Load Balancing Command Line Interface ...................................... 272

Task 1: Download the Command Line Interface ............................................................... 273

Task 2: Set the JAVA_HOME Environment Variable .......................................................... 273

Task 3: Set the AWS_ELB_HOME Environment Variable ................................................... 274

Task 4: Set the AWS_CREDENTIAL_FILE Environment Variable ........................................ 275

Task 5: Set the Region ................................................................................................ 276

Verify if Elastic Load Balancing Command Line Interface(CLI) is Installed ............................ 276

Appendix B: Using the SOAP API ......................................................................................... 279

Endpoints ................................................................................................................. 279

WSDL and Schema Definitions ..................................................................................... 279

Programming Language Support .................................................................................. 279

Request Authentication ............................................................................................... 279

The Response Structure ............................................................................................. 281

Web Services References ........................................................................................... 282

API Version 2012-06-01

Elastic Load Balancing Developer Guide

AWS Glossary ........................................................................................................................... 283

API Version 2012-06-01

vii

Elastic Load Balancing Developer Guide

What Is Elastic Load Balancing?

Amazon Web Services (AWS) provides Elastic Load Balancing to automatically distribute incoming web

traffic across multiple Amazon Elastic Compute Cloud (Amazon EC2) instances.With Elastic Load Bal-

ancing, you can add and remove EC2 instances as your needs change without disrupting the overall flow

of information. If one EC2 instance fails, Elastic Load Balancing automatically reroutes the traffic to the

remaining running EC2 instances. If the failed EC2 instance is restored, Elastic Load Balancing restores

the traffic to that instance. Elastic Load Balancing offers clients a single point of contact, and it can also

serve as the first line of defense against attacks on your network.You can offload the work of encryption

and decryption to Elastic Load Balancing, so your servers can focus on their main task.

When you use Elastic Load Balancing to manage traffic to your application, you get the following benefits:

• Distribution of requests to Amazon EC2 instances (servers) in multiple Availability Zones so that the

risk of overloading one single instance is minimized. And if an entire Availability Zone goes offline,

Elastic Load Balancing routes traffic to instances in other Availability Zones.

• Continuous monitoring of the health of Amazon EC2 instances registered with the load balancer so

that requests are sent only to the healthy instances. If an instance becomes unhealthy, Elastic Load

Balancing stops sending traffic to that instance and spreads the load across the remaining healthy in-

stances.

• Support for end-to-end traffic encryption on those networks that use secure (HTTPS/SSL) connections.

• The ability to take over the encryption and decryption work from the Amazon EC2 instances, and

manage it centrally on the load balancer.

• Support for the sticky session feature, which is the ability to "stick" user sessions to specific Amazon

EC2 instances.

• Association of the load balancer with your domain name. Because the load balancer is the only computer

that is exposed to the Internet, you don’t have to create and manage public domain names for the in-

stances that the load balancer manages.You can point the instance's domain records at the load bal-

ancer instead and scale as needed (either adding or removing capacity) without having to update the

records with each scaling activity.

• When used in an Amazon Virtual Private Cloud (Amazon VPC), support for creation and management

of security groups associated with your load balancer to provide additional networking and security

options.

• Supports use of both the Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6).

Pricing

As with all Amazon Web Services, you pay only for what you use. For Elastic Load Balancing, you pay

for each hour or portion of an hour that the service is running, and you pay for each gigabyte of data that

API Version 2012-06-01

Elastic Load Balancing Developer Guide

is transferred through your load balancer. For current pricing information for Elastic Load Balancing, go

to Elastic Load Balancing Pricing.

Free Tier

If you are a new AWS customer, you are eligible to use the free usage tier for twelve months following

your AWS sign-up date.The free tier includes 750 hours per month of Amazon EC2 Micro Instance usage,

and 750 hours per month of Elastic Load Balancing, plus 15 GB of data processing. For information about

the free usage tier, go to AWS Free Usage Tier.

How Elastic Load Balancing Works

Elastic Load Balancing (ELB) consists of two components: the load balancers and the controller service.

The load balancers monitor the traffic and handle requests that come in through the Internet.The controller

service monitors the load balancers, adding and removing load balancers as needed and verifying that

the load balancers are functioning properly.

You have to create your load balancer before you can start using it. Elastic Load Balancing automatically

generates a unique Domain Name System (DNS) name for each load balancer instance you create. For

example, if you create a load balancer named myLB in the us-east-1a, your load balancer might have a

DNS name such as myLB-1234567890.us-east-1.elb.amazonaws.com. Clients can request access

your load balancer by using the ELB generated DNS name.

If you'd rather use a user-friendly domain name, such as www.example.com, instead of the load balancer

DNS name, you can create a custom domain name and then associate the custom domain name with

the load balancer DNS name.When a request is placed to your load balancer using the custom domain

name that you created, it resolves to the load balancer DNS name.

When a client makes a request to your application using either your load balancer's DNS name or the

custom domain name, the DNS server returns one or more IP addresses.The client then makes a con-

nection to your load balancer at the provided IP address.When Elastic Load Balancing scales, it updates

the DNS record for the load balancer.The DNS record for the load balancer has the time-to-live (TTL)

set to 60 seconds.This setting ensures that IP addresses can be re-mapped quickly to respond to events

that cause Elastic Load Balancing to scale up or down.

When you create a load balancer, you must configure it to accept incoming traffic and route requests to

your EC2 instances.The controller ensures that load balancers are operating with the correct configuration.

After you create your load balancer, you have to register the EC2 instances that you want to load balance

with the load balancer.Your load balancer monitors and routes the incoming traffic to the registered in-

stances.The instances are registered with the load balancer using the IP addresses associated with the

instances.

Your load balancer also monitors the health of the registered instances and ensures that the traffic goes

to healthy instances.When the load balancer detects an unhealthy instance, it stops routing the traffic to

that instance and resumes the routing when the instance has been restored to a healthy state. Elastic

Load Balancing performs health checks on all your registered instances using the configuration you

provide, regardless of whether the instance is in a healthy or unhealthy state.

Amazon Elastic Compute Cloud (Amazon EC2) provides the ability to launch your instances in multiple

Availability Zones.You can configure your load balancer to load balance incoming application traffic

across multiple instances in a single Availability Zone or across multiple instances in several Availability

Zones in the same region. For example, if you choose to load balance multiple instances across two

Availability Zones, and all the instances in the first Availability Zone become unhealthy, the load balancer

will route traffic to the healthy instances in the other Availability Zone. When you use multiple Availability

Zones, it is important to keep approximately the same capacity in each Availability Zone registered with

the load balancer.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

How Elastic Load Balancing Works

Using Auto Scaling with Elastic Load Balancing makes it easy to increase or decrease your back-end

capacity to meet varying traffic levels. For example, you could set a condition declaring that when the

number of healthy instances behind a load balancer goes down to two, two or more instances are launched.

Or, you could set a condition to monitor the latency of the load balancer, and when the latency exceeds

certain time period, such as three seconds, capacity is increased.You can also use the AWS Management

Console to register or deregister instances used by the load balancer as the capacity requirements of

your application change over time.

Amazon Route 53 is AWS's highly available and cost-effective DNS service.You can use Amazon Route

53 to associate the custom domain name of your load balancer with the load balancer DNS name. Using

Amazon Route 53's Alias records will provide performance improvements because the clients will need

only to make a single request to resolve the domain name. Also, queries to Alias records are free of

charge.

Architectural Overview of Elastic Load Balancing

The following diagram shows how the various components of the Elastic Load Balancing work together.

The remainder of this section provides a step-by-step view of the flow of events that take place when a

client requests a URL served by your applications.

This example assumes that you have created a load balancer, created a custom domain name and asso-

ciated your load balancer with the domain name using a CNAME entry in DNS, and have registered your

instances with it.

1. The client sends a URL request to DNS servers to access your application.The DNS server responds

with a DNS name. For example, myLB-1234567890.us-east-1.elb.amazonaws.com.

2. The client looks for the resolution of the DNS name sent by the DNS server. The DNS entry is con-

trolled by Amazon because your application instances are under the amazonaws.com domain.The

Amazon DNS servers return one or more IP addresses.

3. The client then opens a connection to the machine at the provided IP address. The instance at this

address is the load balancer you created.

4. The load balancer checks the health states of all the registered EC2 application instances within the

selected Availability Zones and will begin routing traffic to instances that have met the healthy threshold

defined in the health check configuration.

5. The load balancer routes the client request to the healthy EC2 application instance identified in the

previous step. At this point, the client is communicating with one of your EC2 instances through your

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Architectural Overview of Elastic Load Balancing

load balancer.The load balancer listeners can be configured to use either HTTP, HTTPS, TCP, or

SSL protocols for both front-end connection (client to load balancer) and back-end connection (load

balancer to back-end instance).

Supported Platforms

Elastic Load Balancing supports load balancing your Amazon EC2 instances launched within the following

platforms:

• EC2-Classic — Instances launched in EC2-Classic run in a flat network that you share with other

customers.To load balance your EC2 instances launched in EC2-Classic, you must create your load

balancer in EC2-Classic. For more information about Amazon EC2, see What is Amazon EC2? in the

Amazon Elastic Compute Cloud User Guide.

• EC2-VPC — Instances launched in EC2-VPC run in an virtual private cloud (VPC) that is logically

isolated from other virtual networks in the AWS cloud.You create your VPC by assigning classless

inter-domain routing (CIDR) range of your choice (for example, 10.0.0.0/16).To load balance your EC2

instances launched in a VPC, you must create your load balancer in the same VPC as your EC2 in-

stances. For more information about Amazon VPC, see What is Amazon VPC in the Amazon Virtual

Private Cloud User Guide.

If your AWS account comes with a default virtual private cloud (default VPC), your EC2 instances and

load balancer are launched within the default VPC, by default. For more information on default VPCs

and subnets, see Your Default VPC and Subnets.

For information about how you can tell which platform your AWS account supports, see Supported Platforms

in the Amazon Compute Cloud User Guide.

Elastic Load Balancing Concepts

Topics

• Load Balancer (p. 5)

• Availability Zones and Regions (p. 5)

• Request Routing (p. 6)

• Configuring EC2 Instances for Load Balancing (p. 7)

• Health Check (p. 7)

• Connection Draining (p. 9)

• Idle Connection Timeout (p. 10)

• Sticky Sessions (p. 10)

• HTTP Methods (p. 11)

• HTTPS Support (p. 11)

• Proxy Protocol (p. 11)

• Tagging (p. 12)

• X-Forwarded Headers (p. 13)

This topic introduces you to Elastic Load Balancing basics you need to understand before you create

your load balancer.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Supported Platforms

Load Balancer

A load balancer is the destination to which all requests intended for your load balanced application should

be directed. Each load balancer can distribute requests to multiple EC2 instances. A load balancer is

represented by a DNS name and a set of ports. Load balancers can span multiple Availability Zones

within an EC2 Region, but they cannot span multiple regions.

To create or work with a load balancer in a specific region, use the corresponding regional service endpoint.

For information about regions and endpoints supported by Elastic Load Balancing, go to Regions and

Endpoints.

Elastic Load Balancing automatically generates a DNS name for each load balancer instance you create.

Typically, the DNS name includes the name of the AWS region in which the load balancer is created. For

example, if you create a load balancer named myLB in the us-east-1a, your load balancer might have a

DNS name such as myLB-1234567890.us-east-1.elb.amazonaws.com.You use the DNS name

generated by Elastic Load Balancing to connect with your load balancer. To connect, paste the DNS

name of your load balancer into the address field of an Internet-connected web browser.

If you'd rather use a user-friendly domain name for your load balancer, such as www.example.com, instead

of the load balancer DNS name, you can create a custom domain name and then associate the custom

domain name with the load balancer DNS name.When a request is placed to your load balancer using

the custom domain name that you created, it resolves to the load balancer DNS name.

For more information on creating and using a custom domain name for your load balancer, see Configure

Custom Domain Name for Your Load Balancer (p. 158).

When you create your load balancer, you must configure it to accept incoming traffic by specifying the

configurations for your load balancer listeners. A listener is a process that listens for connections from

incoming requests. It is configured with a protocol and a port number for front-end (load balancer) and

back-end (back-end instance) connections. For more information on the ports and protocols supported

by Elastic Load Balancing, see Listener Configurations for Elastic Load Balancing (p. 49).

Availability Zones and Regions

You can set up your Elastic Load Balancing to distribute incoming requests across EC2 instances in a

single Availability Zone or multiple Availability Zones within a region.Your load balancer does not distribute

traffic across regions.

For critical applications, we recommend that you distribute incoming traffic across more than one Avail-

ability Zone.To distribute traffic across multiple Availability Zones, launch your Amazon EC2 instances

in all the Availability Zones you plan to use and then register the instances with your load balancer.

When you register your EC2 instances, Elastic Load Balancing provisions load balancer nodes in all the

Availability Zones that has the registered instances.The load balancer node continuously monitors the

health of all the registered instances and routes traffic to the healthy instances. If a load balancer node

detects unhealthy or de-registered instances, it stops routing traffic to those instances. Instead, it sends

requests to the remaining healthy instances.

You can always expand or shrink the availability of your instances after your initial set up.To expand the

availability of your application, launch instances in an additional Availability Zone, register the new instances

with your load balancer, and then add the new Availability Zone. After you've added the new Availability

Zone, the load balancer begins to route traffic equally amongst all the enabled Availability Zones.To

shrink the availability of your instances, remove an Availability Zone that was enabled for your load bal-

ancer. After you've removed the Availability Zone, the load balancer will stop routing the traffic to the

disabled Availability Zone and continue to route traffic to the registered and healthy instances in the enabled

Availability Zones.

For information see Add or Remove Availability Zones for Your Load Balanced Application (p. 96).

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Load Balancer

Request Routing

Before a client sends a request to your load balancer, it first resolves the load balancer's domain name

with the Domain Name System (DNS) servers.The DNS server resolves the load balancer's domain

name by returning one or more IP addresses to the client. The client then uses DNS round robin to de-

termine which load balancer node in a specific Availability Zone will receive the request.

The selected load balancer node then sends the request to instances within the same Availability Zone.

To determine the instances, the load balancer node uses either the round robin (for TCP connections)

or the least outstanding request (for HTTP/HTTPS connections) routing algorithm. The least outstanding

request routing algorithm favors back-end instances with the fewest outstanding requests.

By default, the load balancer node routes traffic to back-end instances within the same Availability Zone.

To ensure that your back-end instances are able to handle the request load in each Availability Zone, it

is important to have approximately equivalent numbers of instances in each zone. For example, if you

have ten instances in Availability Zone us-east-1a and two instances in us-east-1b, the traffic will still be

equally distributed between the two Availability Zones. As a result, the two instances in us-east-1b will

have to serve the same amount of traffic as the ten instances in us-east-1a. As a best practice, we recom-

mend that you keep an equivalent or nearly equivalent number of instances in each of your Availability

Zones. So in the example, rather than having ten instances in us-east-1a and two in us-east-1b, you

could distribute your instances so that you have six instances in each Availability Zone.

If you want the request traffic to be routed evenly across all back-end instances, regardless of the Avail-

ability Zone that they may be in, enable cross-zone load balancing on your load balancer. Cross-zone

load balancing allows each load balancer node to route requests across multiple Availability Zones, en-

suring that all zones receive an equal amount of request traffic. Cross-zone load balancing reduces the

need to maintain equivalent numbers of back-end instances in each zone, and improves the application's

ability to handle the loss of one or more back-end instances. However, we still recommend that you

maintain approximately equivalent numbers of instances in each Availability Zone for higher fault tolerance.

The traffic between Elastic Load Balancing and your EC2 instances in another Availability Zone will not

incur any EC2 data transfer charges.

For environments where clients cache DNS lookups, incoming requests may prefer one of the Availability

Zones. Using cross-zone load balancing, this imbalance in request load will be spread across all available

back-end instances in the region, reducing the impact of misbehaving clients on the application.

Routing traffic to EC2 instances in EC2-Classic

To allow communication between Elastic Load Balancing and your back-end instances launched in EC2-

Classic, create a security group ingress rule that applies to all of your back-end instances.The security

group rule can either allow ingress traffic from all IP addresses (the 0.0.0.0/0 CIDR range) or allow ingress

traffic only from Elastic Load Balancing.To ensure that your back-end EC2 instances can receive traffic

only from Elastic Load Balancing, enable network ingress for the Elastic Load Balancing security group

on all of your back-end EC2 instances. For more information about configuring security groups for EC2

instances launched in EC2-Classic, see Manage Security Groups in Amazon EC2-Classic (p. 101).

Routing traffic to EC2 instances in Amazon VPC

If you are planning on deploying your load balancer within Amazon Virtual Private Cloud (Amazon VPC),

be sure to configure the security group rules and network ACLs to allow traffic to be routed between the

subnets in your VPC. If your rules are not configured correctly, instances in other subnets may not be

reachable by load balancer nodes in a different subnet. For more information on deploying load balancer

within Amazon VPC, see Elastic Load Balancing in Amazon VPC (p. 113). For information on configuring

security groups for your load balancer deployed in VPC, see Manage Security Groups in Amazon

VPC (p. 133).

For a procedure on enabling or disabling cross-zone load balancing for your load balancer, see Enable

or Disable Cross-Zone Load Balancing for Your Load Balancer (p. 163)

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Request Routing

Configuring EC2 Instances for Load Balancing

After you've created your load balancer, you have to register your EC2 instances with the load balancer.

Your EC2 instances can be within a single Availability Zone or span multiple Availability Zones within a

region. Elastic Load Balancing routinely performs health check on all the registered EC2 instances and

automatically distributes all incoming requests to the DNS name of your load balancer across your re-

gistered, healthy EC2 instances. For more information on the health check of your EC2 instances, see

Health Check (p. 7).

Make sure to install webserver, such as Apache or Internet Information Services (IIS), on all the EC2 in-

stances you plan to register with your load balancer.

Stop and Start EC2 Instances

The instances are registered with the load balancer using the IP addresses associated with the instances.

When an instance is stopped and then started, the IP address associated with your instance changes.

This prevents the load balancer from routing traffic to your restarted instance.When you stop and then

start your registered EC2 instances, we recommend that you de-register your stopped instance from your

load balancer, and then register the restarted instance. Failure to do so may prevent the load balancer

from performing health checks and routing the traffic to the restarted instance. For procedures associated

with de-registering and then registering your instances with your load balancer, see Deregister and Register

Amazon EC2 Instances (p. 145).

Setting Keepalive On Your EC2 Instances

For HTTP and HTTPS listeners, we recommend that you enable the keep-alive option in your EC2 in-

stances.This may be done in your web server settings and/or in the kernel settings for your back-end

instance. Keep-alive option will allow the load balancer to re-use connections to your backend for multiple

client requests.This reduces the load on your web server and improves the throughput of the load balancer.

The keep-alive timeout should be at least 60 seconds to ensure that the load balancer is responsible for

closing the connection to your instance.

Health Check

To discover the availability of your EC2 instances, the load balancer periodically sends pings, attempts

connections, or sends requests to test the EC2 instances.These tests are called health checks. Instances

that are healthy at the time of the health check are marked as "InService" and the instances that are un-

healthy at the time of the health check are marked as "OutOfService".The load balancer performs health

checks on all registered instances, regardless of whether the instance is in a healthy or unhealthy state.

The load balancer routes traffic only to the healthy instances.When the load balancer determines that

an instance is unhealthy, it stops routing traffic to that instance.The load balancer resumes routing traffic

to the instance when it has been restored to a healthy state.

The load balancer checks the health of the registered instances using either the default health check

configuration provided by Elastic Load Balancing (ELB) or a health check configuration that you specify.

Health Check Configuration

A health configuration contains the information that a load balancer uses to determine the health state

of the registered instances.The following table describes the health check configuration fields:

Default ValueDescriptionField

Console: HTTP

CLI/API/SDK: TCP

The protocol to use to connect with the

instance.The protocol can be TCP,

HTTP, HTTPS, or SSL.

Ping Protocol

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Configuring EC2 Instances for Load Balancing

Default ValueDescriptionField

Console: HTTP:80

CLI/API/SDK: TCP:80

The port to use to connect with the

instance.The ping port can be within the

range of one (1) through 65535.

Specified as a protocol:port pair.

If you specify a TCP or SSL protocol, you

only have to include the protocol and the

port, such as TCP:80.

The load balancer attempts to open a

TCP connection to the instance on the

specified port. If the load balancer fails to

connect with the instance at the specified

port within the configured response

timeout period, the instance is considered

unhealthy.

Ping Port

HTTP:80/index.htmlThe destination for sending the

HTTP/HTTPS request.

If you specify an HTTP or HTTPS

protocol, you have to include a ping port

and a ping path, such as

HTTP:80/index.html. An HTTP GET

request or an HTTPS GET request is

issued to the instance on the ping port

and the ping path. If the load balancer

receives any response other than "200

OK" within the response timeout period,

the instance is considered unhealthy. If

the response includes a body, then your

application must either set the

Content-Length header to a value greater

than or equal to zero, or specify

Transfer-Encoding with a value set to

'chunked'.

Ping Path

5 secondsTime to wait when receiving a response

from the health check (2 sec - 60 sec).

Response Timeout

30 secondsAmount of time between health checks

(5 sec - 300 sec).

HealthCheck Interval

2Number of consecutive health check

failures before declaring an EC2 instance

unhealthy.

Unhealthy Threshold

10Number of consecutive health check

successes before declaring an EC2

instance healthy.

Healthy Threshold

Here is an example of a customized health check configuration:

• Ping Protocol = HTTP

• Ping Port = 80

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Health Check

• Ping Path = HTTP:80/welcome.html

• Response Timeout = 5 seconds

• Health Check Interval = 30 seconds

• Unhealthy Threshold = 2

• Healthy Threshold = 5

The load balancer interprets the health check configuration as follows: Send a request to registered instance

at the ping port and ping path, http://EC2InstanceIPaddress:80/welcome.html, every 30 seconds.

Allow a response timeout period of 5 seconds for the instance to respond. If the load balancer gets 2

consecutive failures, take the instance out of service. If the load balancer gets 5 consecutive successful

responses, put the instance back in service.

You can update your health check configuration at any time using the AWS Management Console, the

configure-health-check AWS CLI command, or the ConfigureHealthCheck action.

You can check the health state of your registered instances using the AWS Management Console, the

describe-instance-health command, or the DescribeInstanceHealth action.

Health Checks and Auto Scaling Groups

If you have associated your Auto Scaling group with a load balancer, you can use the load balancer health

check to determine the health state of instances in your Auto Scaling group. By default, an Auto Scaling

group periodically makes calls to the Amazon Elastic Compute Cloud (EC2) DescribeInstanceStatus action

to determine the health state of each instance. If the Auto Scaling group is registered with a load balancer

and associated with the load balancer health check, Auto Scaling will make calls to both the Amazon

EC2 DescribeInstanceStatus action and the ELB DescribeInstanceHealth action to determine the health

state of the instances. For more information, see Add an Elastic Load Balancing Health Check to your

Auto Scaling Group in the Auto Scaling Developer Guide.

Troubleshooting Health Check

Your registered instances can fail the load balancer health check for several reasons.The most common

reasons for failing a health check are where EC2 instances close connections to your load balancer or

where the response from the EC2 instances times out. For information on potential causes and steps

you can take to resolve failed health check issues, see Troubleshooting Elastic Load Balancing: Health

Check Configuration (p. 259).

Connection Draining

Connection draining causes the ELB load balancer to stop sending new requests to a deregistering instance

or an unhealthy instance, while keeping the existing connections open. This allows the load balancer to

complete in-flight requests made to the deregistering or unhealthy instances.

Connection draining is a load balancer attribute and applies to all listeners for the load balancer.You can

enable or disable connection draining for your load balancer at any time.You can check if connection

draining is enabled for your load balancer by using the DescribeLoadBalancerAtrributes action, the elb-

describe-lb-attributes command, or by using the AWS Management Console and clicking the In-

stances tab in the bottom pane of the selected load balancer.

When you enable connection draining for your load balancer, you can set a maximum time for the load

balancer to continue serving in-flight requests to the deregistering instance before the load balancer

closes the connection.The load balancer forcibly closes connections to the deregistering instance when

the maximum time limit is reached.

While the in-flight requests are being served, the load balancer reports the instance state of the deregis-

tering instance as InService: Instance deregistration currently in progress. The load

balancer reports the instance state as OutOfService: Instance is not currently registered

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Connection Draining

with the LoadBalancer when the deregistering instance has completed serving all in-flight requests

or when the maximum timeout limit is reached, whichever comes first.

When an instance becomes unhealthy the load balancer reports the instance state as OutOfService.

If there are in-flight requests made to the unhealthy instance, they get completed.The maximum timeout

limit does not apply for the connections to the unhealthy instance.

You can check the instance state of a deregistering instance or an unhealthy instance by using the De-

scribeInstanceHealth action, or the elb-describe-instance-health command.

If your instances are part of an Auto Scaling group and if connection draining is enabled for your load

balancer, Auto Scaling will wait for the in-flight requests to complete or for the maximum timeout to expire,

whichever comes first, before terminating instances due to a scaling event or health check replacement.

For information about using Elastic Load Balancing with Auto Scaling, see Use Elastic Load Balancing

to Load Balance Your Auto Scaling Group.

For tutorials on how to enable or disable connection draining attribute for your load balancer, see Enable

or Disable Connection Draining for Your Load Balancer (p. 170).

Idle Connection Timeout

For each request a client makes through a load balancer, the load balancer maintains two connections.

One connection is with the client and the other connection is to the back-end instance. For each connection,

the load balancer manages an idle timeout that is triggered when no data is sent over the connection for

a specified time period. After this time period has elapsed, if no data has been sent or received, the load

balancer closes the connection.

By default, Elastic Load Balancing maintains a 60-second idle timeout setting for the connections to the

client and the back-end instance.You can change the idle timeout setting for your load balancer at any

time.

If you use HTTP and HTTPS listeners, we recommend that you enable the keep-alive option for your

EC2 instances.You can enable keep-alive in your web server settings and/or in the kernel settings for

your EC2 instance. Keep-alive, when enabled, allows the load balancer to re-use connections to your

back-end instance, which reduces the CPU utilization on your instances.To ensure that the load balancer

is responsible for closing the connections to your back-end instance, make sure that the value set on

your instance for the keep-alive time is greater than the idle timeout setting on your load balancer.

For a tutorial on configuring the idle timeout settings for your load balancer, see Configure Idle Connection

Timeout (p. 177).

Sticky Sessions

By default, a load balancer routes each request independently to the application instance with the smallest

load. However, you can use the sticky session feature (also known as session affinity), which enables

the load balancer to bind a user's session to a specific application instance.This ensures that all requests

coming from the user during the session will be sent to the same application instance.

The key to managing the sticky session is determining how long your load balancer should consistently

route the user's request to the same application instance. If your application has its own session cookie,

then you can set Elastic Load Balancing to create the session cookie to follow the duration specified by

the application's session cookie. If your application does not have its own session cookie, then you can

set Elastic Load Balancing to create a session cookie by specifying your own stickiness duration.You

can associate stickiness duration for only HTTP/HTTPS load balancer listeners.

• For more information about creating cookies that allow duration-based session stickiness, see Duration-

Based Session Stickiness (p. 198).

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Idle Connection Timeout

• For more information about creating cookies that allow application-specific session stickiness, see

Application-Controlled Session Stickiness (p. 203).

An application instance must always receive and send two cookies: A cookie that defines the stickiness

duration and a special Elastic Load Balancing cookie named AWSELB, that has the mapping to the ap-

plication instance.

HTTP Methods

The HTTP method (also called the verb) specifies the action to be performed on the resource receiving

an HTTP request.The standard methods for HTTP requests are defined in RFC 2616, Hypertext

Transfer Protocol-HTTP/1.1. Standard methods include GET, POST, PUT, HEAD, and OPTIONS. Some

web applications require (and sometimes also introduce) new methods that are extensions of HTTP/1.1

methods.These HTTP extensions can be non-standard. Some common examples of HTTP extended

methods include (but are not limited to) PATCH, REPORT, MKCOL, PROPFIND, MOVE, and LOCK.

Elastic Load Balancing accepts all standard and non-standard HTTP methods.

When a load balancer receives an HTTP request, it performs checks for malformed requests and for the

length of the method.The total method length in an HTTP request to a load balancer must not exceed

127 characters. If the HTTP request passes both the checks, the load balancer sends the request to the

back-end EC2 instance. If the method field in the request is malformed, the load balancer responds with

a HTTP 400: BAD_REQUEST (p. 257) error message. If the length of the method in the request exceeds

127 characters, the load balancer responds with a HTTP 405: METHOD_NOT_ALLOWED (p. 257) error

message.

The back-end EC2 instance processes a valid request by implementing the method contained in the request

and then sending a response back to the client.Your back-end instance must be configured to handle

both supported and unsupported methods.

HTTPS Support

HTTPS Support is a feature that allows you to use the SSL/TLS protocol for encrypted connections (also

known as SSL offload).This feature enables traffic encryption between the clients that initiate HTTPS

sessions with your load balancer and also for connections between the load balancer and your back-end

instances.

To enable HTTPS support for your load balancer, you'll have to install an SSL server certificate on your

load balancer.The load balancer uses the certificate to terminate and then decrypt requests before

sending them to the back-end instances.

For more information, see Using HTTP/HTTPS Protocol with Elastic Load Balancing (p. 50). For inform-

ation about creating a load balancer that uses HTTPS, see Create a HTTPS/SSL Load Balancer (p. 72).

Proxy Protocol

The Proxy Protocol header helps you identify the IP address of a client when you use a load balancer

configured for TCP/SSL connections. Because load balancers intercept traffic between clients and your

back-end instances, the access logs from your back-end instance contain the IP address of the load

balancer instead of the originating client.When Proxy Protocol is enabled, the load balancer adds a human-

readable format header that contains the connection information, such as the source IP address, destin-

ation IP address, and port numbers of the client. The header is then sent to the back-end instance as a

part of the request.You can parse the first line of the request to retrieve your client's IP address and the

port number.

The Proxy Protocol line is a single line that ends with a carriage return and line feed ("\r\n"). It takes

the following form:

API Version 2012-06-01

Elastic Load Balancing Developer Guide

HTTP Methods

PROXY_STRING + single space + INET_PROTOCOL + single space + CLIENT_IP + single

space + PROXY_IP + single space + CLIENT_PORT + single space + PROXY_PORT +

"\r\n"

The following is an example of the IPv4 Proxy Protocol.

PROXY TCP4 198.51.100.22 203.0.113.7 35646 80\r\n

The Proxy Protocol line for IPv6 takes an identical form, except it begins with TCP6 and the address is in

IPv6 format.

The following is an example of the IPv6 Proxy Protocol.

PROXY TCP6 2001:DB8::21f:5bff:febf:ce22:8a2e 2001:DB8::12f:8baa:eafc:ce29:6b2e

35646 80\r\n

If the client connects with IPv6, the address of the proxy in the header will be the public IPv6 address of

your load balancer.This IPv6 address matches the IP address that is resolved from your load balancer's

DNS name that is prefixed with either ipv6 or dualstack. If the client connects with IPv4, the address

of the proxy in the header will be the private IPv4 address of the load balancer and will therefore not be

resolvable through a DNS lookup outside the Amazon Elastic Compute Cloud (Amazon EC2) network.

For information about enabling the Proxy Protocol header, see Enable or Disable Proxy Protocol Sup-

port (p. 181).

Tagging

You can categorize and track your Amazon Web Services resources, such as EC2 instances, load balan-

cers, or Auto Scaling groups by using tags.To categorize your load balancers in Elastic Load Balancing

you assign a tag to each load balancer. Tags contain metadata that describes useful categories, such

as a purpose, owner, or environment. A tag consists of a key and a value, both of which you define. For

example, you could define a key=value pair, such as “department=digital-media” or “project=lima,” and

assign it to a load balancer.You can then use the tags to track the load balancers designated for project

lima or for your digital-media department.We recommend that you use a consistent set of tag keys to

make it easier to track metadata associated with your load balancers.

You can tag your load balancers to organize your AWS bill and see how costs are allocated.To do this,

load balancers, organize your billing information according to load balancers with the same tag key values.

For example, if you use the "department=digital-media" tag, you can track the cost of running load balancers

assigned to the digital-media department. For more information about cost allocation, see Use Cost Al-

location Tags for Custom Billing Reports in the AWS Account Billing and Cost Management User Guide.

Tag Restrictions

The following basic restrictions apply to tags:

• Maximum number of tags per load balancer—10.

• Maximum key length—128 Unicode characters.

• Maximum value length—256 Unicode characters.

• Tag keys and values are case sensitive. Allowed characters are letters, space, and numbers represent-

able in UTF-8, plus the following special characters: + - = . _ : / @

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Tagging

Note

If you need to use characters outside this set, you can standard base-64 encode your tag.

• Tag keys and values must not contain leading or trailing spaces.

• Do not use aws: as a prefix in your tag names because it is reserved for AWS use.

Note

Tags containing the prefix aws: have been created by AWS.These tags cannot be edited or

deleted, and they do not count toward your limit of 10 tags per load balancer.

You can create a load balancer with tags, or you can add tags to an existing load balancer.You can remove

load balancer tags at any time. When you delete your load balancer, the tags assigned to that load bal-

ancer are deleted.

For information on creating load balancer with tags, see Create a HTTPS/SSL Load Balancer (p. 72).

For information on adding tags to or removing tags from an existing load balancer, see Add or Remove

Tags (p. 208).

X-Forwarded Headers

The HTTP requests and HTTP responses use header fields to send information about the HTTP message.

Header fields are colon-separated name-value pairs that are separated by a carriage return (CR) and a

line feed (LF). A standard set of HTTP header fields is defined in RFC 2616, Message Headers.There

are also non-standard HTTP headers available that are widely used by the applications. Some of the

non-standard HTTP headers have a X-Forwarded prefix. Elastic Load Balancing supports the following

X-Forwarded headers:

X-Forwarded-For

The X-Forwarded-For request header helps you identify the IP address of a client when you use HT-

TP/HTTPS load balancer. Because load balancers intercept traffic between clients and servers, your

server access logs contain only the IP address of the load balancer.To see the IP address of the client,

use the X-Forwarded-For request header. Elastic Load Balancing stores the IP address of the client

in the X-Forwarded-For request header and passes the header along to your server.

The X-Forwarded-For request header takes the following form:

X-Forwarded-For: clientIPAddress

The following example is an X-Forwarded-For request header for a client with an IP address of

203.0.113.7.

X-Forwarded-For: 203.0.113.7

The following example is an X-Forwarded-For request header for a client with an IPv6 address of

2001:DB8::21f:5bff:febf:ce22:8a2e.

X-Forwarded-For: 2001:DB8::21f:5bff:febf:ce22:8a2e

If the request goes through multiple proxies, then the clientIPAddress in the X-Forwarded-For request

header is followed by IP addresses of each successive proxy that passes along the request before the

request reaches your load balancer.Thus, the right-most value is the IP address of the most recent proxy

API Version 2012-06-01

Elastic Load Balancing Developer Guide

X-Forwarded Headers

(for your load balancer) and the left-most value is the IP address of the originating client. In such cases,

the X-Forwarded-For request header takes the following form:

X-Forwarded-For: OriginatingClientIPAddress, proxy1-IPAddress, proxy2-IPAddress

X-Forwarded-Proto

The X-Forwarded-Proto request header helps you identify the protocol (HTTP or HTTPS) that a client

used to connect to your server.Your server access logs contain only the protocol used between the

server and the load balancer; they contain no information about the protocol used between the client and

the load balancer.To determine the protocol used between the client and the load balancer, use the X-

Forwarded-Proto request header. Elastic Load Balancing stores the protocol used between the client

and the load balancer in the X-Forwarded-Proto request header and passes the header along to your

server.

Your application or website can use the protocol stored in the X-Forwarded-Proto request header to

render a response that redirects to the appropriate URL.

The X-Forwarded-Proto request header takes the following form:

X-Forwarded-Proto: originatingProtocol

The following example contains an X-Forwarded-Proto request header for a request that originated

from the client as an HTTPS request:

X-Forwarded-Proto: https

X-Forwarded-Port

The X-Forwarded-Port request header helps you identify the port a HTTP/HTTPS load balancer uses

to connect to the client.

Accessing Elastic Load Balancing

You can create, access and manage your load balancer using any one of the following Elastic Load Bal-

ancing interfaces:

• AWS Management Console— The AWS Management Console provides a web-based interface you

can use to access Elastic Load Balancing.You can use the console to make requests to an API.

• AWS Command Line Interface—Amazon Web Services (AWS) provides a command line interface

that support the broader set of AWS services, including Elastic Load Balancing. The AWS Command

Line Interface (AWS CLI) can be used to control and automate AWS services on Windows, Mac, and

Linux. AWS also offers the AWS Tools for Windows PowerShell for those who script in the PowerShell

environment.

• Query API— Elastic Load Balancing provides a Query API you can use to programmatically access

Elastic Load Balancing functionality. Query requests are HTTP or HTTPS requests that use the HTTP

verbs GET or POST and a Query parameter named Action or Operation. Calling an API using a Query

request is the most direct way to access a web service, but requires that your application handle low-

level details such as generating the hash to sign the request, and error handling.The benefit of using

a Query request is that you have access to the complete functionality of an API.

• AWS SDKs— The AWS SDKs provide functions that wrap an API and take care of many of the con-

nection details, such as calculating signatures, handling request retries, and error handling.With AWS

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Interfaces

SDKs, you can get started in minutes with a single, downloadable package that includes the library,

code samples, and reference documentation.You can access Elastic Load Balancing programmatically

using the SDKs in Java, .NET, PHP, or Ruby.

• SOAP API— You can access the Elastic Load Balancing web service using the SOAP web services

messaging protocol.This interface is described by a Web Services Description Language (WSDL)

document that defines the operations and security model for the particular service.The WSDL references

an XML schema document, which strictly defines the data types that might appear in SOAP requests

and responses. For information on using the SOAP API, see Appendix B: Using the SOAP API (p. 279)

For information about installing and configuring Elastic Load Balancing interfaces, see Setting Up Elastic

Load Balancing Interfaces (p. 18)

Regions and Endpoints for Elastic Load Balan-

cing

By default, the AWS SDKs and console for Elastic Load Balancing reference the US West (Oregon) region

and the Elastic Load Balancing Query requests reference the US East (N.Virginia) region.You can

change the default region for the AWS SDK, the console, and the Elastic Load Balancing Query requests

and set it to the region of your choice at any time.You must specify a region when using the AWS Com-

mand Line Interface (AWS CLI). For information on configuring the default region for Elastic Load Balancing,

see Setting Up Elastic Load Balancing Interfaces (p.18) and follow the instructions for changing the default

region for your interface.

As Elastic Load Balancing expands availability to new regions, new endpoints for these regions are also

available to use in your own HTTP requests, the AWS SDKs, the AWS CLI, and the console. For a current

list of supported regions and endpoints, see Regions and Endpoints.

Elastic Load Balancing Limits

Your AWS account comes with default limits on resources for Elastic Load Balancing and other Amazon

Web Services. Unless otherwise noted, each limit is per region.There is a default limit of 20 load balancers

per region per account.You can go to AWS Service Limits and select Elastic Load Balancing

Limits or any other service listed on the page to see its default limits.

You can request an increase for the number of load balancers for your account by performing the following

steps:

1. Go to AWS Support Center page, sign in, if necessary, and click Open a new case.

2. Under Regarding, select Service Limit Increase.

3. Under Limit Type, select Elastic Load Balancers, fill in all of the necessary fields in the form,

and click the button at the bottom of the page for your desired method of contact.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Regions and Endpoints

Related Services

Elastic Load Balancing works with the following AWS products to provide solutions to help your load

balancer improve availability and scalability of your applications.

SolutionsAWS Product

Runs your back-end application instances.Amazon EC2

Creates capacity groups of instances that can grow or shrink on demand.

For more information, see Auto Scaling Developer Guide.

Auto Scaling

Collects the data provided by your load balancer and presents it as

readable, near real-time metrics.These metrics can be used to monitor

the health state of your instances.You can create an Amazon

CloudWatch alarm to send notification to an Auto Scaling policy if an

individual metric goes outside of what you consider an acceptable range.

For more information on using Amazon CloudWatch with your load

balancer, see Monitor Your Load Balancer Using Amazon

CloudWatch (p. 218). For information on Amazon CloudWatch, see

Amazon CloudWatch Developer Guide.

Amazon CloudWatch

Provides secure and reliable routing to your application instances. Route

53 automatically routes queries to the nearest DNS server in a global

network of DNS servers, resulting in low latency.You can use Route 53

to translate friendly domain names like www.example.com into IP

addresses like 192.0.2.1. For information on using Amazon Route 53

to create a custom domain name for your load balancer, see Configure

Custom Domain Name for Your Load Balancer (p. 158). For information

on Amazon Route 53, see Amazon Route 53 Developer Guide.

Amazon Route 53

Manages digital server certificates to use with your load balancer.Your

load balancer uses server certificates to terminate and then decrypt

requests before sending them to the back-end instances. Use IAM to

upload the server certificate to your load balancer. For information on

creating and uploading server certificate, see Creating and Uploading

Server Certificates.

Manages users and user permissions in AWS. IAM provides central

control over users and security credentials. Use IAM to create multiple

users who can use AWS products, each with individual security

credentials, all controlled by a single AWS account. For information on

specifying user permissions for Elastic Load Balancing resources, see

Controlling User Access to Your Load Balancer (p.248). For information

on AWS Identity and Access Management, see Using IAM.

AWS Identity and Access

Management (IAM)

The following diagram shows how the various services in AWS integrate with Elastic Load Balancing.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Related Services

Next Steps

• You might want to test drive Elastic Load Balancing by creating a basic load balancer and registering

your EC2 instances with the newly created load balancer.Get Started with Elastic Load Balancing (p.23)

provides information on creating a basic load balancer using the AWS Management Console.

• You might want to explore some common user scenarios for Elastic Load Balancing. Before you do

this, you must install the tools and interfaces that you plan to use to access your load balancer. For

information on installing the command line interfaces and using the Query API, go to Get Set Up with

Elastic Load Balancing Interfaces.

• For detailed instructions on using Elastic Load Balancing in Amazon EC2, see Elastic Load Balancing

in Amazon EC2-Classic (p. 70).

• For detailed instructions on using Elastic Load Balancing in Amazon Virtual Private Cloud(VPC), see

Elastic Load Balancing in Amazon VPC (p. 113).

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Next Steps

Setting Up Elastic Load Balancing

Interfaces

You can create, access, and manage your load balancers using any one of the Elastic Load Balancing

interfaces: the AWS Management Console, the AWS Command Line Interface, the Query API, the SOAP

API, or the SDK for Elastic Load Balancing.

Before you can use Elastic Load Balancing, you'll need to sign up for Amazon Web Services (AWS) ac-

count. Signing up allows you to access Elastic Load Balancing and other services in AWS that you might

need, such as Amazon EC2, Amazon CloudWatch, Amazon Route 53, AWS Identity and Access Man-

agement (IAM), and Auto Scaling.

After signing up, you'll need to install and configure the Elastic Load Balancing interface you want to use

to create, access, and manage your Elastic Load Balancing resources.

Topics

• Sign Up for Amazon Web Services(AWS) (p. 18)

• Sign in to Elastic Load Balancing Using the AWS Management Console (p. 19)

• Use the AWS Command Line Interface (p. 20)

• Use Query Requests to Call Elastic Load Balancing APIs (p. 21)

• Use the AWS SDKs (p. 22)

• Next Steps (p. 22)

When you create an AWS account, we automatically sign up your account for all AWS services.You pay

only for the services that you use.

If you already have an AWS account, skip this step. If you don't have an AWS account, use the following

procedure to create one.

To sign up for an AWS account

1. Go to http://amazonaws.cn and click the Sign Up button.

2. Follow the on-screen instructions.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Part of the sign-up procedure involves receiving a phone call and entering a PIN using the phone

keypad.

Management Console

The AWS Management Console is a point-and-click web-based interface you can use to access Elastic

Load Balancing and other AWS products.You can use the console to make requests to Elastic Load

Balancing and other AWS APIs.

Elastic Load Balancing resources can be accessed using the EC2 console in the AWS Management

Console.

To sign in to the Elastic Load Balancing using the EC2 console

1. Sign in to the AWS Management Console and open the Amazon EC2 console at https://con-

sole.amazonaws.cn/ec2/.

2. On the Amazon EC2 console Resources page, in the left navigation pane, under NETWORK &

SECURITY, click Load Balancers.

3. If this is the first time you are accessing Elastic Load Balancing or you do not have any load balancers

in the selected region, your load balancer page might look something like the following:

4. The load balancers you create is tied to a region you specify and are not replicated across regions.

For more information, see Regions and Endpoints for Elastic Load Balancing (p. 15).

API Version 2012-06-01

Elastic Load Balancing Developer Guide

AWS Management Console

The AWS Management Console selects a region for you by default. The default region is displayed

in the navigation bar. If necessary, change the region. From the navigation bar, select the region that

meets your needs.

To create your load balancer using the AWS Management Console, see Get Started with Elastic Load

Balancing (p. 23)

Use the AWS Command Line Interface

Amazon Web Services (AWS) provides a command line interface (CLI) that supports the broader set of

AWS services, including Elastic Load Balancing. The AWS Command Line Interface (AWS CLI) can be

used to control and automate AWS services on Windows, Mac, and Linux.

The AWS CLI is the recommended CLI tool for Elastic Load Balancing.

For more information about AWS CLI and for instructions on installing the AWS CLI tools, step through

the following sections in the AWS Command Line Interface User Guide.

• What Is the AWS Command Line Interface? provides introduction to the AWS CLI.

• Getting Set Up with the AWS Command Line Interface provides instructions on installing and configuring

the AWS CLI.

For details about the AWS CLI commands for Elastic Load Balancing, see AWS CLI elb.

Note

The prior Elastic Load Balancing Command Line Interface (ELB CLI) is still available, but not

recommended. New features released after ELB CLI version 1.0.35.0 (dated 7/24/14) will be

included in the AWS CLI only.

For a list of the ELB CLI versions and the functionality the ELB CLI versions support, see Elastic

Load Balancing API Tools.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

AWS Command Line Interface

Use Query Requests to Call Elastic Load Balan-

cing APIs

Elastic Load Balancing provides APIs that you can call by submitting a Query Request. Query requests

are HTTP or HTTPS requests that use the HTTP verb GET or POST and a Query parameter named

Action or Operation that specifies the API you are calling. Action is used throughout this documentation,

although Operation is also supported for backward compatibility with other Amazon Web Services (AWS)

Query APIs.

Calling the API using a Query request is the most direct way to access the web service, but requires that

your application handle low-level details such as generating the hash to sign the request, and error

handling.The benefit of calling the service using a Query request is that you are assured of having access

to the complete functionality of the API.

Note

The Query interface used by AWS is similar to REST, but does not adhere completely to the

REST principles.

Signing Query Requests

Query requests travel over the Internet using either HTTP or HTTPS, and are vulnerable to being inter-

cepted and altered in transit.To prevent this and ensure that the incoming request is both from a valid

AWS account and unaltered, AWS requires all requests to be signed.

To sign a Query request, you calculate a digital signature using a cryptographic hash function over the

text of the request and your AWS secret key. A cryptographic hash is a one-way function that returns

unique results based on the input.The input to the hash function includes the text of your request and

your secret access key. The hash function returns a hash value that you include in the request as your

signature.

When Elastic Load Balancing receives the request, it re-calculates the signature using the request text

and the secret key that matches the AWS access key in the request. If the two signatures match, Elastic

Load Balancing knows that the query has not been altered and that the request originated from your ac-

count.This is one reason why it is important to safeguard your private key. Any malicious user who obtains

it would be able to make AWS calls, and incur charges, on your account.

For additional security, you should transmit your requests using Secure Sockets Layer (SSL) by using

HTTPS. SSL encrypts the transmission, protecting your request or the response from being viewed in

transit. For more information about securing your Query requests, see Making Secure Requests to Amazon

Web Services.

The signature format that AWS uses has been refined over time to increase security and ease of use.

Elastic Load Balancing supports Signature Version 2 and Signature Version 4. If you are creating new

applications that use Elastic Load Balancing, then we recommend using Signature Version 4 for signing

your query requests.

For information about how to create the signature using Signature Version 4, see Signature Version 4

Signing Process in the AWS General Reference.

For information about how to create the signature using Signature Version 2, see Signature Version 2

Signing Process in the AWS General Reference.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Query Requests

Use the AWS SDKs

AWS SDKs make it easier for developers to build applications that tap into cost-effective, scalable, and

reliable AWS infrastructure services.With AWS SDKs, you can get started in minutes with a single,

downloadable package that includes the library, code samples, and reference documentation.You can

access Elastic Load Balancing programmatically using the SDKs in Java, .NET, PHP, or Ruby.

The following table lists the available SDKs and third-party libraries you can use to access Elastic Load

Balancing programmatically.

DescriptionType of Access

AWS provides the following SDKs:

• AWS SDK for Java Documentation

• AWS SDK for .NET Documentation

• AWS SDK for PHP Documentation

• AWS SDK for Ruby Documentation

AWS SDKs

Developers in the AWS developer community also provide their own libraries,

which you can find at the following AWS developer centers:

• AWS Java Developer Center

• AWS PHP Developer Center

• AWS Python Developer Center

• AWS Ruby Developer Center

• AWS Windows and .NET Developer Center

Third-Party Libraries

Next Steps

To get a hands-on introduction to creating your load balancer, see Get Started with Elastic Load Balan-

cing (p. 23).

For information on scenarios specific to load balancers in Amazon EC2, see Elastic Load Balancing in

Amazon EC2-Classic (p. 70).

For information on scenarios specific to load balancers in Amazon VPC, see Elastic Load Balancing in

Amazon VPC (p. 113).

For information on using the various features supported by Elastic Load Balancing, see Managing Load

Balancers (p. 135).

API Version 2012-06-01

Elastic Load Balancing Developer Guide

AWS SDKs

Get Started with Elastic Load

Balancing

After you have read What Is Elastic Load Balancing? (p. 1), and you have decided to load balance your

Amazon Elastic Compute Cloud (Amazon EC2) instances, it's time to get started with basic load balancing

tasks.Your first task will be to create a load balancer.

You can create your load balancer in EC2-Classic or Amazon VPC platforms. For more information, see

Supported Platforms (p. 4).

If you are creating a load balancer in EC2-Classic, see Create a Basic Load Balancer in EC2-Clas-

sic (p. 23).

If you are creating a load balancer in EC2-VPC, see Create a Basic Load Balancer in EC2-VPC (p. 31).

If you are creating your load balancer in default VPC, see Create a Basic Load Balancer in Default

VPC (p. 41).

Create a Basic Load Balancer in EC2-Classic

This getting started tutorial walks you through the process for creating a basic ELB load balancer to load

balance your EC2 instances that are launched in EC2-Classic platform.

The following step-by-step instructions will help you create a basic load balancer using the AWS Manage-

ment Console, a point-and-click web-based interface. Before you get started with the console, be sure

you've done the following:

• Sign up for Amazon Web Services (AWS). If you haven't signed up for AWS yet, complete the steps

listed in Sign Up for Amazon Web Services(AWS) (p. 18).

Note

If you are a new AWS customer, you are eligible to use the free usage tier for twelve months

following your AWS sign-up date.The free tier includes 750 hours per month of Amazon EC2

Micro Instance usage, and 750 hours per month Elastic Load Balancing plus 15GB of data

processing. For more information on what is available on the free tier, go to AWS Free Usage

Tier.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Create a Basic Load Balancer in EC2-Classic

• Launch Amazon EC2 instances with HTTP access on port 80.You'll be registering these instances

with your load balancer. For more information about launching Amazon EC2 instances, see Launching

and Using Instances in the Amazon Cloud Compute User Guide.

• Install a webserver, such as Apache or Internet Information Services (IIS), on the EC2 instances you

plan to register with the load balancer.

Make sure to create your load balancer in the same region your EC2 instances are launched in.

The following steps outline how to create a basic load balancer in EC2-Classic.

1. Configure the listeners for your load balancer by specifying the ports and protocols to use for the front-

end connection (client to load balancer) and the back-end connection (load balancer to back-end in-

stance).

2. Configure a health check for your Amazon EC2 back-end instances.

3. Register your Amazon EC2 instances with the load balancer.

4. Review settings and create your load balancer.

5. Verify that your load balancer is created.

6. [Optional] Delete your load balancer.

Important

The load balancer you're about to create will be live (and not running in a sandbox). If you are

not signed up for free usage tier, you will incur the standard Elastic Load Balancing usage fees

for the load balancer until you terminate it. The total charges will be minimal (typically less than

a dollar), if you complete the Getting Started in one sitting and delete your load balancer when

you are finished. For more information about Elastic Load Balancing usage rates, go to the

Elastic Load Balancing Pricing page.

Configure Listeners for Your Load Balancer

To configure listeners for your load balancer

1. Sign in to the AWS Management Console and open the Amazon EC2 console at https://con-

sole.amazonaws.cn/ec2/.

2. Start the Create Load Balancer wizard:

a. On the Amazon EC2 console Resources page, in the EC2 Dashboard pane, under NETWORK

& SECURITY, click Load Balancers.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Configure Listeners for Your Load Balancer

b. On the Load Balancers page, click Create Load Balancer.

3. On the Define Load Balancer page, make the following selections:

a. In the Load Balancer name: field, enter a name for your load balancer (e.g., my-test-load-

balancer).

The load balancer name you choose must be unique within your set of load balancers, must

have a maximum of 32 characters, and must only contain alphanumeric characters or hyphens.

b. Leave Create LB inside: field set to EC2-Classic for this tutorial.

Note

In this tutorial, you are creating a load balancer for your EC2 instances launched within

Amazon EC2. If you want to create a load balancer for your EC2 instances inside

Amazon Virtual Private Cloud (Amazon VPC), see Create a Basic Load Balancer in

EC2-VPC (p. 31)

c. Leave Listener Configuration: fields set to the default values for this example.

Important

The default settings require that your Amazon EC2 HTTP servers are active and accept-

ing requests on port 80.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Configure Listeners for Your Load Balancer

4. Click Continue to configure health check for your Amazon EC2 instances.

Configure Health Check for Your Amazon EC2 In-

stances

Elastic Load Balancing routinely checks the health of each load-balanced Amazon EC2 instance based

on the configurations that you specify. If Elastic Load Balancing finds an unhealthy instance, it stops

sending traffic to the instance and reroutes traffic to healthy instances.

To configure a health check for your Amazon EC2 instances

1. On the Configure Health Check page of the Create Load Balancer wizard, set the following con-

figurations:

a. Leave Ping Protocol set to its default value of HTTP.

b. Leave Ping Port set to its default value of 80.

Elastic Load Balancing pings the port you choose (in this example, port 80) to send health check

queries to your Amazon EC2 instances.

Important

Your Amazon EC2 instances must accept incoming traffic on the ping port.This example

assumes that each of your instances has a working webserver that accepts incoming

traffic on port 80.

c. In the Ping Path field, replace the default value with a single forward slash ("/").

Elastic Load Balancing sends health check queries to the path you specify in Ping Path. This

example uses a single forward slash so that Elastic Load Balancing sends the query to your

webserver's default home page, whether that default page is named index.html, de-

fault.html, or a different name.

d. Leave the fields in the Advanced Details pane set to their default values.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Configure Health Check for Your Amazon EC2 Instances

2. Click Continue to register your Amazon EC2 instances with your load balancer.

Now that you've made your configuration choices you're ready to register your EC2 instances.

To register your Amazon EC2 instances

1. On the Add EC2 Instances page, in the Add Instances to Load Balancer table, select the boxes

in the Instance column to register instances with your load balancer.

2. Keep Enable Cross-Zone Load Balancing and Enable Connection Draining boxes set to the

default settings for this tutorial.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

3. Click Continue.

4. For this tutorial, skip the step for adding tags and click Continue to review your settings and then

create your load balancer.

Review Settings and Create Your Load Balancer

Now that you've registered your EC2 instances with your load balancer it's time to review the settings

you have selected.

To review your settings

1. On the Review page of the Create Load Balancer wizard, check your settings.You can make

changes by clicking the edit link for each setting.

Note

You can modify some of the settings even after you've created your load balancer. For ex-

ample, you can modify the port configurations, health check configurations, and add or re-

move EC2 instances from your load balancer. For more information, see Managing Load

Balancers (p. 135).

2. Click Create to create your load balancer.

Verify the Creation of Your Load Balancer

Now that you've created your load balancer, you're ready to verify its settings.

To verify creation of your load balancer

1. The Create Load Balancer wizard displays the status of your newly created load balancer. Click

Close after confirming that your load balancer was successfully created.

2. Your new load balancer now appears in the load balancer list page. Select your load balancer.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Review Settings and Create Your Load Balancer

3. The bottom pane displays the details of your load balancer. Verify that the descriptions match your

specifications.

If the description in the Status row indicates that some of your instances are not in service, its

probably because your instances are still in the registration process. For more information, see

Troubleshooting Elastic Load Balancing: Registering Instances (p. 262).

4. You can test your load balancer after you've verified that at least one of your EC2 instances is InSer-

vice.To test your load balancer, copy the DNS Name value that is listed in the Description tab and

paste it into the address field of an Internet-connected web browser. If your load balancer is working,

you will see the default page of your HTTP server.

Congratulations! You've successfully created a basic load balancer. The load balancer is live and has

started incurring the standard Elastic Load Balancing usage fees.You can either delete the load balancer

now and incur minimal hourly (typically less than a dollar) charges, or you can continue using the load

balancer.

Note

If you are a new AWS customer and are using the free usage tier, you can continue using the

load balancer. Go to AWS Free Usage Tier to check the number of hours available to you.

• For information on deleting your load balancer, see the following section.

• Elastic Load Balancing supports the load balancing of applications using HTTP, HTTPS (Secure HTTP),

TCP, and SSL (Secure TCP) listener protocols. For a quick overview of the different configurations

available for your load balancer, see Elastic Load Balancing Listener Configurations Quick Refer-

ence (p. 52).

• For information on some common Elastic Load Balancing user scenarios, and the tasks needed to

accomplish efficient distribution of application loads among your Amazon EC2 instances, see Managing

Load Balancers (p. 135).

• For information about Elastic Load Balancing usage rates, go to the Elastic Load Balancing product

page.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Verify the Creation of Your Load Balancer

Delete Your Load Balancer

As soon as your load balancer becomes available, you are billed for each hour or partial hour that you

keep the load balancer running. After you've decided that you no longer need the load balancer, you can

delete it.

To delete your load balancer

1. On the Amazon EC2 console Resources page, in the EC2 Dashboard pane, under NETWORK &

SECURITY, click Load Balancers.

2. On the Create Load Balancer page, click the box next to the load balancer you want to delete.

3. Click Actions and in the Actions drop-down box, click Delete.

4. In the Delete Load Balancer dialog box, click Yes, Delete.

Elastic Load Balancing deletes the load balancer. As soon as the load balancer is deleted, you stop

incurring charges for that load balancer.

Note

Even after you delete a load balancer, the Amazon EC2 instances associated with the load

balancer continue to run.You will continue to incur charges on the Amazon EC2 instances

while they are running. For information on stopping your EC2 instances, go to Stopping and

Starting Instances in the Amazon EC2 User Guide. For information on terminating your EC2

instances, go to Terminate Your Instance.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Delete Your Load Balancer

Create a Basic Load Balancer in EC2-VPC

Amazon Virtual Private Cloud (Amazon VPC) enables you to launch Amazon Web Services (AWS) re-

sources, such as, ELB load balancers and Amazon EC2 instances, into a virtual network that you've

defined.You can use a load balancer deployed in Amazon EC2-VPC to monitor and route traffic to your

EC2 instances launched within a the same VPC.

This getting started tutorial walks you through the process for creating a basic ELB load balancer for your

EC2 instances that are launched in EC2-VPC platform.The load balancer you create in this tutorial will

be launched in the same VPC where your EC2 instances are launched.

Before you create your load balancer in a VPC, you must define your VPC by specifying IP addresses in

the classless inter-domain routing (CIDR) range of your choice (for example, 10.0.0.0/16).Within this

VPC, you launch your load balancer (and EC2 instances) that have private IP addresses from private IP

address range of the VPC.Your VPC spans multiple Availability Zones within the region it is created.

You can also create subnets within your VPC. A subnet is a range of IP addresses in your VPC.You can

use subnets to group your resources based on your security and operational needs. A subnet resides

entirely within the Availability Zone and cannot span zones.

After you create your VPC and define your subnets, you can optionally add an Internet gateway to your

subnet. An Internet gateway enables your resources to connect to the Internet through the Amazon EC2

network edge. If a subnet's traffic is routed to an Internet gateway, the subnet is known as a public subnet.

If a subnet's traffic is not routed to an Internet gateway, the subnet is known as a private subnet. Use a

public subnet for resources that must be connected to the Internet, and a private subnet for resources

that need not be connected to the Internet.

If your AWS account comes with a default VPC, your Amazon EC2 instances will be launched in default

VPC, by default.To load balance your EC2 instances launched in default VPC, you must create your

load balancer in default VPC. For information on how you can tell whether your AWS account comes with

default VPC, see Detecting Your Supported Platforms and Whether You Have a Default VPC. For inform-

ation on creating a basic load balancer within a default VPC, see Create a Basic Load Balancer in Default

VPC (p. 41).

The following step-by-step instructions will help you create a basic load balancer in EC2-VPC using the

AWS Management Console, a point-and-click web-based interface. Before you get started with the console,

be sure you've done the following:

• Sign up for Amazon Web Services (AWS). If you haven't signed up for AWS yet, go to http://amazon-

aws.cn and click the Sign Up Now button.

Note

If you are a new AWS customer, you are eligible to use the free usage tier for twelve months

following your AWS sign-up date.The free tier includes 750 hours per month of Amazon EC2

Micro Instance usage, and 750 hours per month Elastic Load Balancing plus 15GB of data

processing. For more information on what is available on the free tier, go to AWS Free Usage

Tier.

• This tutorial uses a VPC with one public subnet to create a load balancer in a VPC public subnet that

is connected to the Internet.

Create an Amazon VPC and then create one public subnet in the VPC. If you haven't yet created a

VPC and a public subnet, see Getting Started with Amazon VPC for step-by-step instructions for using

VPC wizard to create a VPC with a single public subnet.

Note

You can skip Step 4: Assign an Elastic IP Address to Your Instance for this tutorial.

• Make a note of the VPC ID, subnet ID, and the security group associated with the VPC.You will need

them later when you create your load balancer.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Create a Basic Load Balancer in EC2-VPC

• If you have not already done so, launch Amazon EC2 instances with HTTP access on port 80 into your

newly created VPC. For more information about launching Amazon EC2 instances, see Launching and

Using Instances in the Amazon Cloud Compute User Guide.

• Install a webserver, such as Apache or Internet Information Services (IIS), on the EC2 instances you

plan to register with the load balancer.

The following steps outline how to create a basic load balancer in EC2-VPC.

1. Configure the listeners for your load balancer by specifying the ports and protocols to use for the front-

end connection (client to load balancer) and the back-end connection (load balancer to back-end in-

stance).

Specify the VPC in which you want to launch your load balancer.

2. Configure a health check for your Amazon EC2 back-end instances.

3. Select the subnet for your back-end instances.

4. Assign a security group to your load balancer.

5. Register your Amazon EC2 instances with the load balancer.

6. Review settings and create your load balancer.

7. Verify that your load balancer is created.

8. [Optional] Delete your load balancer.

Important

The load balancer you're about to create will be live (and not running in a sandbox). If you are

not signed up for the free usage tier, you will incur the standard Elastic Load Balancing usage

fees for the load balancer until you terminate it. The total charges will be minimal (typically less

than a dollar), if you complete the Getting Started in one sitting and delete your load balancer

when you are finished. For more information about Elastic Load Balancing usage rates, go to

the Elastic Load Balancing product page.

Configure Listeners for Your Load Balancer

To configure listeners for your load balancer

1. Sign in to the AWS Management Console and open the Amazon EC2 console at https://con-

sole.amazonaws.cn/ec2/.

2. Start the Create Load Balancer wizard:

a. On the Amazon EC2 console Resources page, in the EC2 Dashboard pane, under NETWORK

& SECURITY, click Load Balancers.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Configure Listeners for Your Load Balancer

b. Click Create Load Balancer.

3. On the Define Load Balancer page, make the following selections:

a. Enter a name for your load balancer (e.g., my-vpc-loadbalancer).

The load balancer name you choose must be unique within your set of load balancers, must

have a maximum of 32 characters, and must only contain alphanumeric characters or hyphens.

b. Click the arrow in the Create LB Inside drop-down box and select the VPC ID you saved after

you created your VPC.

c. Leave the Create an internal load balancer box blank for this tutorial.

Note

In this tutorial, you are creating an Internet-facing load balancer in a public subnet. For

more information about internal load balancer, see Internet-facing and Internal Load

Balancers (p. 116)

d. Leave Listener Configuration set to the default value for this tutorial.

Important

The default settings require that your Amazon EC2 webservers are active and accepting

requests on port 80.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Configure Listeners for Your Load Balancer

4. Click Continue to configure health check for your Amazon EC2 instances.

Configure Health Check for Your Amazon EC2 In-

stances

Elastic Load Balancing routinely checks the health of each load-balanced Amazon EC2 instance based

on the configurations that you specify. If Elastic Load Balancing finds an unhealthy instance, it stops

sending traffic to the instance and reroutes traffic to healthy instances.

To configure a health check for your Amazon EC2 instances

1. On the Configure Health Check page of the Create a New Load Balancer wizard, set the following

configurations:

a. Leave Ping Protocol set to its default value of HTTP.

b. Leave Ping Port set to its default value of 80.

Elastic Load Balancing pings the port you choose (in this example, port 80) to send health check

queries to your Amazon EC2 instances.

Important

Your Amazon EC2 instances must accept incoming traffic on the ping port.This example

assumes that each of your instances has a working webserver that accepts incoming

traffic on port 80.

c. In the Ping Path field, replace the default value with a single forward slash ("/").

Elastic Load Balancing sends health check queries to the path you specify in Ping Path. This

example uses a single forward slash so that Elastic Load Balancing sends the query to your

webserver's default home page, whether that default page is named index.html, de-

fault.html, or a different name.

d. Leave the Advanced Options set to their default values.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Configure Health Check for Your Amazon EC2 Instances

2. Click Continue to select the subnet in which you want to launch your load balancer instance.

Select a Subnet for Your Back-end Instance

In this step, you select the subnet for your back-end instance.

To select your VPC subnet

• On the Select Subnets page, in the Available Subnets table, Click the button in the Action column

to select the subnet ID you saved.

Your selected subnet is displayed in the Selected Subnets table.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Select a Subnet for Your Back-end Instance

Assign a Security Group to Your Load Balancer

To select security group for your load balancer

1. You can either use a pre-existing security group or create a new security group. The security group

you assign to your load balancer must allow ingress to the ports that you configured the load balancer

to use. If you create a security group in this step, the console will define ports to be open for you. If

the defined port is different from the port specified in your health check configuration, edit the security

group to add the port specified in your health check configuration.This tutorial uses the default VPC

security group that allows ingress to port 80, the port specified for the health check.

On the Assign Security Groups page, select Select an existing Security Groups, and then select

the default VPC security group.

2. Click Continue to register EC2 instances with your load balancer.

Now that you've made your configuration choices you're ready to register your EC2 instances.

To register your EC2 instances launched within VPC with your load balancer

1. On the Add EC2 Instances page, in the Add Instances to Load Balancer table, select the boxes

in the Instance column to register instances with your load balancer.

2. Keep Enable Cross-Zone Load Balancing and Enable Connection Draining boxes set to the

default settings for this tutorial.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Assign a Security Group to Your Load Balancer

Note

When you register a multi-homed instance (an instance that has an elastic network interface

(ENI) attached) with your load balancer, the load balancer will route traffic to the primary IP

address of the instance (eth0). For more information on using ENIs, go to Elastic Network

Interfaces.

3. Click Continue.

4. For this tutorial, skip the step for adding tags. Click Continue to review your settings and then create

your load balancer.

Review Settings and Create Your Load Balancer

Now that you've registered your EC2 instances with your load balancer it's time to review the settings

you have selected.

To review your settings

1. On the Review page of the Create Load Balancer wizard, check your settings.You can make

changes by clicking the edit link for each setting.

The description in the Scheme row indicates that the load balancer is internet-facing.This

means that your load balancer is created in a public subnet.

Note

You can modify some of the settings even after you've created your load balancer. For ex-

ample, you can modify the port configurations, health check configurations, and add or re-

move EC2 instances from your load balancer. For more information, see Managing Load

Balancers (p. 135).

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Review Settings and Create Your Load Balancer

2. Click Create to create your load balancer.

Verify Creation of Your Load Balancer

Now that you've created your load balancer, you're ready to verify its settings.

To verify creation of your load balancer

1. The Create Load Balancer wizard displays the status of your newly created load balancer. Click

Close after confirming that your load balancer was successfully created.

2. Your new load balancer now appears in the list. Select the check box next to your load balancer.

3. The bottom pane displays the description of your load balancer.Verify that the descriptions match

your specifications.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Verify Creation of Your Load Balancer

If the description in the Status row indicates that some of your instances are not in service, its

probably because your instances are still in the registration process. For more information, see

Troubleshooting Elastic Load Balancing: Registering Instances (p. 262).

4. You can test your load balancer after you've verified that at least one of your EC2 instances is InSer-

vice.To test your load balancer, copy the DNS Name value that is listed in the Description tab and

paste it into the address field of an Internet-connected web browser. If your load balancer is working,

you will see the default page of your webserver.

Congratulations! You've successfully created a basic load balancer. The load balancer is live and has

started incurring the standard Elastic Load Balancing usage fees.You can either delete the load balancer

now and incur minimal hourly (typically less than a dollar) charges, or you can continue using the load

balancer.

Note

If you are a new AWS customer and are using the free usage tier, you can continue using the

load balancer. Go to AWS Free Usage Tier to check the number of hours available to you.

• For information on deleting your load balancer, see the following section.

• Elastic Load Balancing supports the load balancing of applications using HTTP, HTTPS (Secure HTTP),

TCP, and SSL (Secure TCP) listener protocols. For a quick overview of the different configurations

available for your load balancer, see Elastic Load Balancing Listener Configurations Quick Refer-

ence (p. 52).

• For information on some common Elastic Load Balancing user scenarios for Amazon VPC, and the

tasks needed to accomplish efficient distribution of application loads among your Amazon EC2 instances

in Amazon VPC, see Elastic Load Balancing in Amazon VPC (p. 113).

• For information about Elastic Load Balancing usage rates, go to the Elastic Load Balancing product

page.

Delete Your Load Balancer

As soon as your load balancer becomes available, you are billed for each hour or partial hour that you

keep the load balancer running. After you've decided that you no longer need the load balancer, you can

delete it.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Delete Your Load Balancer

To delete your load balancer

1. On the Amazon EC2 console Resources page, in the EC2 Dashboard pane, under NETWORK &

SECURITY, click Load Balancers.

2. On the Create Load Balancer page, click the box next to the load balancer you want to delete.

3. Click Actions and in the Actions drop-down box, click Delete.

4. In the Delete Load Balancer confirmation window, click Yes, Delete.

Elastic Load Balancing deletes the load balancer. As soon as the load balancer is deleted, you stop

incurring charges for that load balancer.

Note

Even after you delete a load balancer, the Amazon EC2 instances associated with the load

balancer continue to run.You will continue to incur charges on the Amazon EC2 instances

while they are running. For information on stopping your EC2 instances, go to Stopping and

Starting Instances in the Amazon EC2 User Guide. For information on terminating your EC2

instances, go to Terminate Your Instance.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Delete Your Load Balancer

Create a Basic Load Balancer in Default VPC

An Amazon Virtual Private Cloud (Amazon VPC) is defined by specifying IP addresses in the classless

inter-domain routing (CIDR) range (for example, 10.0.0.0/16).Within this VPC, you can create your AWS

resources, such as ELB load balancers and EC2 instances. The load balancers created within the VPC

have private IP addresses from private IP address range of the VPC.The VPC spans multiple Availability

Zones within the region it is created.

You can also create subnets within a VPC. A subnet is a range of IP addresses in your VPC.You can

use subnets to group your instances based on your security and operational needs. A subnet resides

entirely within the Availability Zone and cannot span zones.

If your AWS account comes with a default VPC, by default, all your AWS resources, such as EC2 instances,

will be created within the default VPC. For information on how you can tell whether your AWS account

comes with a default VPC, see Detecting Your Supported Platforms and Whether You Have a Default

VPC.

Your default VPC automatically creates a VPC and default subnets in each Availability Zone, among

other components. For more information on default VPC set up, see Your Default VPC and Subnets.To

load balance your EC2 instances launched in default VPC, you must create your load balancer in default

VPC.

This getting started tutorial walks you through the process for creating a basic load balancer in default

VPC.

The following step-by-step instructions will help you create a basic load balancer in default VPC using

the AWS Management Console, a point-and-click web-based interface. Before you get started with the

console, be sure you've done the following:

• Sign in to the AWS Management Console and open the Amazon EC2 console at https://console.amazon-

aws.cn/ec2/.

Note

If you are a new AWS customer, you are eligible to use the free usage tier for twelve months

following your AWS sign-up date.The free tier includes 750 hours per month of Amazon EC2

Micro Instance usage, and 750 hours per month Elastic Load Balancing plus 15GB of data

processing. For more information on what is available on the free tier, go to AWS Free Usage

Tier.

• If you have not already done so, launch your Amazon EC2 instances with HTTP access on port 80 into

your default VPC using default subnets and default security group. For more information, see Launching

an EC2 Instance into Your Default VPC.

• Install a webserver, such as Apache or Internet Information Services (IIS), on the EC2 instances you

plan to register with the load balancer.

The following steps outline how to create a basic load balancer in default VPC.

1. Configure the listeners for your load balancer by specifying the ports and protocols to use for the front-

end connection (client to load balancer) and the back-end connection (load balancer to back-end in-

stance).

2. Configure a health check for your Amazon EC2 back-end instances.

3. Assign security groups to your load balancer.

4. Register your Amazon EC2 instances with the load balancer.

5. Review settings and create your load balancer.

6. Verify the creation of your load balancer.

7. [Optional] Delete your load balancer.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Create a Basic Load Balancer in Default VPC

Important

The load balancer you're about to create will be live (and not running in a sandbox). If you are

not signed up for the free usage tier, you will incur the standard Elastic Load Balancing usage

fees for the load balancer until you terminate it. The total charges will be minimal (typically less

than a dollar), if you complete the Getting Started in one sitting and delete your load balancer

when you are finished. For more information about Elastic Load Balancing usage rates, go to

the Elastic Load Balancing Pricing page.

Configure Listeners for Your Load Balancer

To configure listeners for your load balancer

1. Sign in to the AWS Management Console and open the Amazon EC2 console at https://con-

sole.amazonaws.cn/ec2/.

2. Start the Create Load Balancer wizard:

a. On the Amazon EC2 console Resources page, in the EC2 Dashboard pane, under NETWORK

& SECURITY, click Load Balancers.

b. Click Create Load Balancer.

3. On the Define Load Balancer page, make the following selections:

a. Enter a name for your load balancer (e.g., my-test-loadbalancer).

The load balancer name you choose must be unique within your set of load balancers, must

have a maximum of 32 characters, and must only contain alphanumeric characters or hyphens.

b. Leave the entry in the Create LB inside: box set to the default VPC for this tutorial.

c. Leave Create an internal load balancer box blank for this tutorial.

Note

In this tutorial, you are creating an Internet-facing load balancer in a public subnet. For

more information about internal load balancer, see Internet-facing and Internal Load

Balancers (p. 116)

d. Leave the Enable advanced VPC configuration: box blank for this tutorial.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Configure Listeners for Your Load Balancer

Note

Advanced VPC configuration option allows you to specify your own subnets. Select

this option if you have created your own subnets and want to use them instead of the

default subnets.

e. Leave Listener Configuration set to the default value for this tutorial.

Important

The default settings require that your Amazon EC2 HTTP servers are active and accept-

ing requests on port 80.

4. Click Continue to configure the health check for your instances.

Configure Health Check for Your Amazon EC2 In-

stances

Elastic Load Balancing routinely checks the health of each load-balanced Amazon EC2 instance based

on the configurations that you specify. If Elastic Load Balancing finds an unhealthy instance, it stops

sending traffic to the instance and reroutes traffic to healthy instances.

To configure a health check for your Amazon EC2 instances

1. On the Configure Health Check page of the Create Load Balancer wizard, set the following con-

figurations:

a. Leave Ping Protocol set to its default value of HTTP.

b. Leave Ping Port set to its default value of 80.

Elastic Load Balancing pings the port you choose (in this example, port 80) to send health check

queries to your Amazon EC2 instances.

Important

Your Amazon EC2 instances must accept incoming traffic on the ping port.This example

assumes that each of your instances has a webserver installed and accepts incoming

traffic on port 80.

c. In the Ping Path field, replace the default value with a single forward slash ("/").

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Configure Health Check for Your Amazon EC2 Instances

Elastic Load Balancing sends health check queries to the path you specify in Ping Path. This

example uses a single forward slash so that Elastic Load Balancing sends the query to your

webserver's default home page, whether that default page is named index.html, de-

fault.html, or a different name.

d. Leave the Advanced Options set to their default values.

2. Click Continue to select security groups to assign to your load balancer.

Assign a Security Group to Your Load Balancer

To select a security group for your load balancer

1. This tutorial uses the default VPC security group associated with your default VPC.

On the Assign Security Groups page, select Choose from your existing Security Groups and

then select the default VPC security group.

If you choose a non-default pre-existing security group, ensure that it allows ingress to the ports that

you configured the load balancer to use. If you create a security group in this step, the console will

define these ports to be open for you.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Assign a Security Group to Your Load Balancer

2. Click Continue to register your Amazon EC2 instances with your load balancer.

Now that you've made your configuration choices you're ready to register your EC2 instances with your

load balancer.

To register your EC2 instances launched within the default VPC

1. On the Add EC2 Instances page, in the Add Instances to Load Balancer table, check the boxes

in the Instance column to register instances to your load balancer.

2. Keep Enable Cross-Zone Load Balancing and Enable Connection Draining boxes set to the

default settings for this tutorial.

Note

When you register a multi-homed instance (an instance that has an elastic network interface

(ENI) attached) with your load balancer, the load balancer will route traffic to the primary IP

address of the instance (eth0). For more information on using ENIs, go to Elastic Network

Interfaces.

3. Click Continue.

4. For this tutorial, skip the step for adding tags. Click Continue to review your settings and then create

your load balancer.

Review Settings and Create Your Load Balancer

Now that you've registered your EC2 instances with your load balancer it's time to review the settings

you have selected.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

To review your settings

1. On the Review page of the Create Load Balancer wizard, check your settings.You can make

changes by clicking the edit link for each setting.

The description in the Scheme row indicates that the load balancer is internet-facing.This

means that your load balancer has a publicly resolvable DNS name that resolves to public IP ad-

dresses.

The VPC and subnets listed under VPC Information are the default VPC and default subnets auto-

matically created for your AWS account.

Note

You can modify some of the settings even after you've created your load balancer. For ex-

ample, you can modify the port configurations, health check configurations, and add or re-

move EC2 instances from your load balancer. For more information, see Elastic Load Bal-

ancing in Amazon VPC (p. 113).

2. Click Create to create your load balancer.

Verify Creation of Your Load Balancer

Now that you've created your load balancer, you're ready to verify its settings.

To verify your load balancer is created

1. The Create Load Balancer wizard displays the status of your newly created load balancer. Click

Close after confirming that your load balancer was successfully created.

2. Your new load balancer now appears in the load balancer list. Select the check box next to your load

balancer.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Verify Creation of Your Load Balancer

3. The bottom pane displays the description of the selected load balancer.Verify that the descriptions

match your specifications.

If the description in the Status row indicates that some of your instances are not in service, its

probably because your instances are still in the registration process. For more information, see

Troubleshooting Elastic Load Balancing: Registering Instances (p. 262).

4. You can test your load balancer after you've verified that at least one of your EC2 instances is InSer-

vice.To test your load balancer, copy the DNS Name value that is listed in the Description tab and

paste it into the address field of an Internet-connected web browser. If your load balancer is working,

you will see the default page of your HTTP server.

Congratulations! You've successfully created a basic load balancer in default VPC.The load balancer is

live and has started incurring the standard Elastic Load Balancing usage fees.You can either delete the

load balancer now and incur minimal hourly (typically less than a dollar) charges, or continue using the

load balancer.

Note

If you are a new AWS customer and are using the free usage tier, you can continue using the

load balancer. Go to AWS Free Usage Tier to check the number of hours available to you.

• For information on deleting your load balancer, see the following section.

• Elastic Load Balancing supports the load balancing of applications using HTTP, HTTPS (Secure HTTP),

TCP, and SSL (Secure TCP) listener protocols. For a quick overview of the different configurations

available for your load balancer, see Elastic Load Balancing Listener Configurations Quick Refer-

ence (p. 52).

• For information on some common Elastic Load Balancing user scenarios, and the tasks needed to

accomplish efficient distribution of application loads among your Amazon EC2 instances in Amazon

VPC, see Elastic Load Balancing in Amazon VPC (p. 113).

• For information about Elastic Load Balancing usage rates, go to the Elastic Load Balancing product

page.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Verify Creation of Your Load Balancer

Delete Your Load Balancer

As soon as your load balancer becomes available, you are billed for each hour or partial hour that you

keep the load balancer running. After you've decided that you no longer need the load balancer, you can

delete it.

To delete your load balancer

1. On the Amazon EC2 console Getting Started page, in the EC2 Dashboard pane, under NETWORK

& SECURITY, click Load Balancers.

2. Select the check box next to the load balancer you want to delete, and then click Delete.

3. In the Delete Load Balancer window, click Yes, Delete.

Elastic Load Balancing deletes the load balancer. As soon as the load balancer is deleted, you stop

incurring charges for that load balancer.

Note

Even after you delete a load balancer, the Amazon EC2 instances associated with the load

balancer continue to run.You will continue to incur charges on the Amazon EC2 instances

while they are running. For information on stopping your EC2 instances, go to Stopping and

Starting Instances in the Amazon EC2 User Guide. For information on terminating your EC2

instances, go to Terminate Your Instance.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Delete Your Load Balancer

Listener Configurations for Elastic

Load Balancing

A typical web application communication goes through layers of hardware and software. Each layer

provides a specific communication function.The control over the communication function is passed from

one layer to the next, in sequence.The Open System Interconnection (OSI) defines a model framework

for implementing a standard format for communication, called a protocol, in these layers. For detailed

information about the layers of the OSI model, go to http://en.wikipedia.org/wiki/OSI_model.

When you use Elastic Load Balancing, you need to have a basic understanding of two layers: layer 4 and

layer 7. Layer 4 is the transport layer that describes the Transmission Control Protocol (TCP) connection

between the client and your back-end instance, through the load balancer. Layer 4 is the lowest level that

is configurable for your load balancer. Layer 7 is the application layer that describes the use of Hypertext

Transfer Protocol (HTTP) and HTTPS (secure HTTP) connections from clients to the load balancer and

from the load balancer to your back-end instance.

You also need to have an understanding of the Secure Sockets Layer (SSL) protocol. The SSL protocol

is primarily used to encrypt confidential data over insecure networks such as the Internet.The SSL protocol

establishes a secure connection between a client and the back-end server and ensures that all the data

passed between your client and your server is private and integral.

Listeners

Before you start using Elastic Load Balancing, you have to configure the listeners for your load balancer.

A listener is a process that listens for connection requests. It is configured with a protocol and a port

number for front-end (client to load balancer) and back-end (load balancer to back-end instance) connec-

tions.

Elastic Load Balancing supports the load balancing of applications using HTTP, HTTPS (secure HTTP),

TCP, and SSL (secure TCP) protocols.The HTTPS uses the SSL protocol to establish secure connections

over the HTTP layer.You can also use SSL protocol to establish secure connections over the TCP layer.

The acceptable ports for both HTTPS/SSL and HTTP/TCP connections are 25, 80, 443, 465, 587, and

1024-65535.

You can specify the protocols for the front-end connections (client to load balancer) and the back-end

connections (load balancer to back-end instance) independently.The front-end connection and the back-

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Listeners

end connection must be from the same layer. For example, if your front-end connection is using the TCP

or SSL protocol then your back-end connection can either be TCP or SSL. If the front-end connection of

your load balancer is using HTTP or HTTPS then your back-end connections can either be HTTP or

HTTPS.

By default, your load balancer is set to use the HTTP protocol with port 80 for the front-end connection

and the back-end connection.The default settings can be changed using the AWS Management Console,

the Query API, the command line interface (CLI), or the SDKs.

Using TCP/SSL Protocol with Elastic Load Bal-

ancing

When you use TCP (layer 4) for both front-end and back-end connections, your load balancer forwards

the request to the back-end instances without modification to the headers. After getting the request, your

load balancer attempts to open a TCP connection to the back-end instance on the port specified in the

health check configuration. If the load balancer fails to connect with the instance at the specified port

within the configured response timeout period, the instance is considered unhealthy.

Because load balancers intercept traffic between clients and your back-end instances, the access logs

from your back-end instance contain the IP address of the load balancer instead of the originating client.

You can enable Proxy Protocol, which adds a header containing the connection information, such as the

source IP address, the destination IP address, and the port numbers of the client.The header is then

sent to the back-end instance as a part of the request.You can parse the first line in the request to retrieve

the connection information. For information about enabling Proxy Protocol, see Enable or Disable Proxy

Protocol Support (p. 181).

This configuration will not insert cookies for session stickiness or the X-Forwarded-* headers.

Using HTTP/HTTPS Protocol with Elastic Load

Balancing

When you use HTTP (layer 7) for both front-end and back-end connections, your load balancer parses

the headers in the request and terminates the connection before re-sending the request to the back-end

instance(s).This is the default configuration provided by Elastic Load Balancing.

To connect with the back-end instances, an HTTP GET request or an HTTPS GET request is issued to

the instance on the ping port and the ping path specified in the health check configuration. If the load

balancer receives any response other than "200 OK" within the response timeout period, the instance is

considered unhealthy.

For every registered and healthy instance behind a HTTP/HTTPS load balancer, Elastic Load Balancing

opens and maintains one or more TCP connections.The pre-opened connections ensure that there is

always an established connection ready to receive HTTP/HTTPS requests.

The HTTP requests and HTTP responses use header fields to send information about HTTP message.

Elastic Load Balancing supports X-Forwarded-For headers. Because load balancers intercept traffic

between clients and servers, your server access logs contain only the IP address of the load balancer.

To see the IP address of the client, use the X-Forwarded-For request header. For more information,

see X-Forwarded-For (p. 13).

When you use HTTP/HTTPS, you can enable sticky sessions on your load balancer. A sticky session

binds a user’s session to a specific back-end instance.This ensures that all requests coming from the

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Using TCP/SSL Protocol with Elastic Load Balancing

user during the session will be sent to the same back-end instance. For more information on sticky sessions,

see Sticky Sessions (p. 10).

Not all HTTP extensions are supported in the load balancer. In some cases you will need to use a TCP

listener if the load balancer is not able to terminate the request due to unexpected methods, response

codes, or other non-standard HTTP 1.0/1.1 implementations.

SSL Server Certificates

If you use HTTPS or SSL for your front-end listener, you must install an SSL certificate on your load bal-

ancer.The load balancer uses the certificate to terminate the connection and then decrypt requests from

clients before sending them to the back-end instances.

The SSL protocol uses an X.509 certificate (SSL server certificate) to authenticate both the client and

the back-end instance.The X.509 certificate is a digital form of identification issued by a certificate authority

(CA) and contains identification information, a validity period, a public key, a serial number, and the digital

signature of the issuer.

Before you can install the SSL certificate on your load balancer, you must create the certificate, get the

certificate signed by a CA, and then upload the certificate using the AWS Identity and Access Management

(AWS IAM) service.

The SSL certificate comes with a validity period.You must replace the certificate before its validity period

ends. For information on creating SSL certificate see SSL Certificate for Elastic Load Balancing (p. 61).

For procedure related to replacing your existing certificate, see Update an SSL Certificate for a Load

Balancer (p. 147).

SSL Negotiation

Elastic Load Balancing provides security policies that have predefined SSL negotiation configurations.

These configurations are used for SSL negotiation when a connection is established between a client

and your load balancer. The SSL negotiation configurations provide compatibility with a broad range of

clients and use high-strength cryptographic algorithms called ciphers. However, some use cases might

require all data on the network to be encrypted and allow only specific ciphers. Some security compliance

standards (such as PCI, SOX, and so on) might require a specific set of protocols and ciphers from clients

to ensure that the security standards are met. In such cases, Elastic Load Balancing provides options for

selecting different configurations for protocols and ciphers, based on your specific requirements. Depending

on the number of nodes, your ciphers and protocols should take effect within 30 seconds.

If you use SSL/HTTPS protocol for your front-end connection, you can either use one of the predefined

security policies or create a custom security policy.For information about the predefined SSL negotiation

configurations used by Elastic Load Balancing, see SSL Negotiation Configurations for Elastic Load

Balancing (p. 55). For information on how to configure the ciphers and protocols, see Step 2: Configure

SSL Security Policy (p. 75).

Using Back-End Server Authentication with

Elastic Load Balancing

If want to use an SSL protocol but do not want to terminate the connection on your load balancer, you

can use a TCP protocol for connection from the client to your load balancer, use the SSL protocol for

API Version 2012-06-01

Elastic Load Balancing Developer Guide

SSL Server Certificates

connection from the load balancer to your back-end application, and install certificates on all the back-

end instances handling requests.

If you choose to use an HTTPS/SSL connection for your back end, you can enable authentication on

your back-end instance.This authentication can be used to ensure that back-end instances accept only

encrypted communication and to ensure that the back-end instance has the correct certificates.

You can install any certificate you want on your back-end instances, including a self-signed certificate.

For a quick reference to the listener configurations supported by Elastic Load Balancing, see Elastic Load

Balancing Listener Configurations Quick Reference (p. 52).

Elastic Load Balancing Listener Configurations

Quick Reference

The following table summarizes the listener settings that you can use to configure your load balancer.

HTTP/HTTPS Load Balancing

NotesBack-End

Optional

Configuration

Back-End

Protocol

Front-End

Optional

Configuration

Front-End

Protocol

Use Case

• Default

setting.

• Supports

X-Forwarded-For (p.13)

header.

• Supports

Sticky

Sessions (p.10).

NAHTTPNAHTTPBasic HTTP

load balancer.

• Supports

Sticky

Sessions (p.10).

• Supports

X-Forwarded-For (p.13)

header.

• Requires SSL

Certificate (p.61)

installed on

the load

balancer.

NAHTTPSSL

Negotiation

Configurations (p.55)

HTTPSSecure

website or

application

using Elastic

Load

Balancing to

offload SSL

decryption.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Listener Configurations Quick Reference

NotesBack-End

Optional

Configuration

Back-End

Protocol

Front-End

Optional

Configuration

Front-End

Protocol

Use Case

• Supports

Sticky

Sessions (p.10).

• Supports

X-Forwarded-For (p.13)

header.

• Requires SSL

Certificate (p.61)

installed on

the load

balancer and

on the

registered

instances.

Back-end

authentication

HTTPSSSL

Negotiation

Configurations (p.55)

HTTPSSecure

website or

application

using

end-to-end

encryption with

Elastic Load

Balancing

providing

X-Forward

headers and

sticky

sessions.

The following quick reference table shows you the listener configuration options for typical TCP/SSL load

balancer use cases.

TCP/SSL Load Balancing

NotesBack-End

Optional

Configuration

Back-End

Protocol

Front-End

Optional

Configuration

Front-End

Protocol

Use Case

• Basic TCP

load

balancing.

• Supports

Proxy

Protocol (p.11)

header.

NATCPNATCPBasic TCP

load balancer.

• Supports

Proxy

Protocol (p.11)

header.

• Requires SSL

Certificate (p.61)

installed on

the load

balancer.

NATCPSSL

Negotiation

Configurations (p.55)

SSLSecure

website or

application

using Elastic

Load

Balancing to

offload SSL

decryption.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Listener Configurations Quick Reference

NotesBack-End

Optional

Configuration

Back-End

Protocol

Front-End

Optional

Configuration

Front-End

Protocol

Use Case

• Supports

Proxy

Protocol (p.11)

header.

• Requires SSL

Certificate (p.61)

installed on

the load

balancer and

on the

registered

instances.

Back-end

authentication

SSLSSL

Negotiation

Configurations (p.55)

SSLSecure

website or

application

using

end-to-end

encryption with

Elastic Load

Balancing.

Next Steps

For configuring listeners:

• To learn how to set up a basic HTTP/TCP load balancer using the AWS Management Console, see

Get Started with Elastic Load Balancing (p. 23).

• For information on how to set up an HTTPS/SSL load balancer with cipher settings and back-end au-

thentication, see Create a HTTPS/SSL Load Balancer (p. 72).

• For information on how to set up a basic HTTP/TCP load balancer within Amazon VPC, see Elastic

Load Balancing in Amazon VPC (p. 113).

• For information on adding a listener to an existing load balancer, see Adding a Listener to your Load

Balancer (p. 136).

• For information on deleting a listener from an existing load balancer, see Delete a Listener from Your

Load Balancer (p. 142).

For performing Elastic Load Balancing tasks:

• If you haven't already, install the tools you plan to use for performing Elastic Load Balancing tasks. For

information on installing the command line interface or the Query API, see Setting Up Elastic Load

Balancing Interfaces (p. 18).

• For information on using the various features supported by Elastic Load Balancing, see Managing Load

Balancers (p. 135).

• For detailed descriptions of the Elastic Load Balancing API operations, see the Elastic Load Balancing

API Reference.

• For detailed descriptions of the Elastic Load Balancing commands, see the Elastic Load Balancing

Quick Reference Card.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Next Steps

SSL Negotiation Configurations for

Elastic Load Balancing

Elastic Load Balancing uses an Secure Socket Layer (SSL) negotiation configuration, known as a Security

Policy, to negotiate SSL connections between a client and the load balancer. A security policy is a com-

bination of SSL Protocols, SSL Ciphers, and the Server Order Preference option. For more information

about configuring SSL connection for your load balancer, see Listener Configurations for Elastic Load

Balancing (p. 49).

SSL Protocols

Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols that are

used to encrypt confidential data over insecure networks such as the Internet. The TLS protocol is the

newer version of the SSL protocol. In this section, we refer to both SSL and TLS protocols as SSL protocol.

The SSL protocol establishes a secure connection between a client and a server and ensures that all the

data passed between the client and your load balancer is private.

Elastic Load Balancing supports the following versions of the SSL protocol:

• TLS 1.2

• TLS 1.1

• TLS 1.0

• SSL 3.0

• SSL 2.0

SSL Ciphers

SSL cipher is an encryption algorithm that uses encryption keys to create a coded message. SSL protocols

use several cipher algorithms to encrypt data over the Internet. For information about SSL ciphers and

SSL protocols supported by Elastic Load Balancing, see SSL Security Policy Table (p. 56).

Server Order Preference

Elastic Load Balancing supports the Server Order Preference for negotiating connections between the

client and the load balancer. During the SSL connection negotiation process, the client and the load bal-

ancer present a list of ciphers and protocols that they each support, in order of preference. Normally, the

first cipher on the client's list that matches any one of the load balancer's ciphers is selected for the SSL

API Version 2012-06-01

Elastic Load Balancing Developer Guide

connection. If the load balancer is configured to support the Server Order Preference, then the load bal-

ancer gets to select the first cipher in its list that matches any one of the ciphers in the client's list. Server

Order Preference ensures that the load balancer determines which cipher is used for SSL connection.

For information about the order of ciphers used by Elastic Load Balancing, see SSL Security Policy

Table (p. 56).

• SSL Security Policies (p. 56)

• SSL Security Policy Table (p. 56)

SSL Security Policies

Elastic Load Balancing provides you with the following Security Policy options to configure settings for

SSL negotiations for your load balancer:

• Predefined Security Policy—A list of predefined SSL negotiation configurations with enabled ciphers

and protocols.The naming convention of the predefined security policy includes version information

based on the year and month that the predefined security policy was released. For example, the pre-

defined security policy ELBSecurityPolicy-2014-10 indicates that this policy was released in the

tenth (10) month of the year 2014. Some older policies do not follow the versioned naming convention.

As new configurations become available, Elastic Load Balancing will release the newer versions of

predefined policies.You can use the latest version of the predefined security policy and then update

your configuration whenever a new version is released.

Elastic Load Balancing currently provides you with the following predefined security policies:

• ELBSecurityPolicy-2014-10

• ELBSecurityPolicy-2014-01

• ELBSecurityPolicy-2011-08

• ELBSample-ELBDefaultNegotiationPolicy or ELBSample-ELBDefaultCipherPolicy

• ELBSample-OpenSSLDefaultNegotiationPolicy or ELBSample-OpenSSLDefaultCipherPolicy

For information about the SSL protocols, SSL ciphers, and SSL option enabled for the predefined se-

curity policies, see SSL Security Policy Table (p. 56).

• Custom Security Policy—A list of ciphers and protocols that you specify to create a custom negotiation

configuration. Some security compliance standards (such as PCI, SOX, and so on) might require a

specific set of protocols and ciphers to ensure that the security standards are met. In such cases, create

a custom security policy to meet those standards. If you enable Server Order Preference option in your

custom security policy, the order of ciphers listed in the following section will be used to negotiate

connections between client and the load balancer. If you do not enable Server Order Preference option

in your custom security policy, the order of ciphers presented by the client will be used to negotiate

connections between the client and the load balancer. For information about the protocols and ciphers

supported by Elastic Load Balancing, see SSL Security Policy Table (p. 56).

You can choose an SSL Security Policy for your load balancer using the AWS Management Console,

the command line interface (CLI), the Query API, or the SDKs. For information on choosing a security

policy or creating a custom security policy, see Configure SSL Security Policy (p. 75).

SSL Security Policy Table

The following table lists the predefined security policies, descriptions of each policy, SSL Protocols, SSL

Ciphers, and the Server Order Preference that are enabled for that policy.The SSL Ciphers in the following

table are listed in the order of preference that the load balancer will use to negotiate SSL connections.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

SSL Security Policies

The order of ciphers used by the load balancer cannot be changed. If the policy is enabled for Server

Order Preference, the load balancer will use the order of ciphers specified in the table to negotiate con-

nections between the client and load balancer. If the policy is not enabled for Server Order Preference,

the load balancer will use the order presented by the client to negotiate connection between the client

and the load balancer.

Note

The RSA and DSA based ciphers are specific to the signing algorithm used to create SSL certi-

ficate. Make sure to create your SSL certificate using the signing algorithm that is based on

ciphers enabled for your security policy.

The table does not list the following deprecated predefined security policies:

• ELBSample-ELBDefault Negotiation Policy or ELBSample-ELBDefault Cipher Policy

• ELBSample-OpenSSLDefault Cipher Policy or ELBSample-OpenSSLDefault Negotiation Policy

We recommend that you use the latest version of the predefined security policy. However, if you want to

see the descriptions of the deprecated predefined security policies, use either the DescribeLoadBalancer-

Policies action or the describe-load-balancer-policies command.

The ' ♦' in the following table indicates that the protocol, server order preference, or the cipher is enabled

for the policy.

ELBSecurity

Policy-2011-08

ELBSecurity

Policy-2014-01

ELBSecurity

Policy-2014-10

Security Policy

SSL negotiation

configurations for

SSL/HTTP listeners

as of 2011-08.

SSL negotiation

configurations for

SSL/HTTP listeners

as of 2014-01.

Default configuration.

Recommended.

Policy Description

SSL Protocols

Protocol-SSLv2

♦♦Protocol-SSLv3

♦♦♦Protocol-TLSv1

♦♦Protocol-TLSv1.1

♦♦Protocol-TLSv1.2

SSL Options

♦♦Server Order Preference

SSL Ciphers

♦♦ECDHE-ECDSA-AES128-

GCM-SHA256

♦♦ECDHE-RSA-AES128-

GCM-SHA256

♦♦ECDHE-ECDSA-AES128-SHA256

♦♦ECDHE-RSA-AES128-SHA256

♦♦ECDHE-ECDSA-AES128-SHA

API Version 2012-06-01

Elastic Load Balancing Developer Guide

SSL Security Policy Table

ELBSecurity

Policy-2011-08

ELBSecurity

Policy-2014-01

ELBSecurity

Policy-2014-10

Security Policy

♦♦ECDHE-RSA-AES128-SHA

♦♦♦DHE-RSA-AES128-SHA

♦♦ECDHE-ECDSA-AES256-

GCM-SHA384

♦♦ECDHE-RSA-AES256-

GCM-SHA384

♦♦ECDHE-ECDSA-AES256-SHA384

♦♦ECDHE-RSA-AES256-SHA384

♦♦ECDHE-RSA-AES256-SHA

♦♦ECDHE-ECDSA-AES256-SHA

♦♦AES128-GCM-SHA256

♦♦AES128-SHA256

♦♦♦AES128-SHA

♦♦AES256-GCM-SHA384

♦♦AES256-SHA256

♦♦♦AES256-SHA

♦♦♦DHE-DSS-AES128-SHA

♦CAMELLIA128-SHA

♦EDH-RSA-DES-CBC3-SHA

♦DES-CBC3-SHA

♦♦ECDHE-RSA-RC4-SHA

♦♦♦RC4-SHA

ECDHE-ECDSA-RC4-SHA

DHE-DSS-AES256-GCM-SHA384

DHE-RSA-AES256-GCM-SHA384

DHE-RSA-AES256-SHA256

DHE-DSS-AES256-SHA256

♦DHE-RSA-AES256-SHA

♦DHE-DSS-AES256-SHA

♦DHE-RSA-CAMELLIA256-SHA

♦DHE-DSS-CAMELLIA256-SHA

♦CAMELLIA256-SHA

API Version 2012-06-01

Elastic Load Balancing Developer Guide

SSL Security Policy Table

ELBSecurity

Policy-2011-08

ELBSecurity

Policy-2014-01

ELBSecurity

Policy-2014-10

Security Policy

♦EDH-DSS-DES-CBC3-SHA

DHE-DSS-AES128-GCM-SHA256

DHE-RSA-AES128-GCM-SHA256

DHE-RSA-AES128-SHA256

DHE-DSS-AES128-SHA256

♦DHE-RSA-CAMELLIA128-SHA

♦DHE-DSS-CAMELLIA128-SHA

ADH-AES128-GCM-SHA256

ADH-AES128-SHA

ADH-AES128-SHA256

ADH-AES256-GCM-SHA384

ADH-AES256-SHA

ADH-AES256-SHA256

ADH-CAMELLIA128-SHA

ADH-CAMELLIA256-SHA

ADH-DES-CBC3-SHA

ADH-DES-CBC-SHA

ADH-RC4-MD5

ADH-SEED-SHA

DES-CBC-SHA

DHE-DSS-SEED-SHA

DHE-RSA-SEED-SHA

EDH-DSS-DES-CBC-SHA

EDH-RSA-DES-CBC-SHA

IDEA-CBC-SHA

RC4-MD5

SEED-SHA

DES-CBC3-MD5

DES-CBC-MD5

Deprecated SSL Ciphers

RC2-CBC-MD5

API Version 2012-06-01

Elastic Load Balancing Developer Guide

SSL Security Policy Table

ELBSecurity

Policy-2011-08

ELBSecurity

Policy-2014-01

ELBSecurity

Policy-2014-10

Security Policy

PSK-AES256-CBC-SHA

PSK-3DES-EDE-CBC-SHA

KRB5-DES-CBC3-SHA

KRB5-DES-CBC3-MD5

PSK-AES128-CBC-SHA

PSK-RC4-SHA

KRB5-RC4-SHA

KRB5-RC4-MD5

KRB5-DES-CBC-SHA

KRB5-DES-CBC-MD5

EXP-EDH-RSA-DES-CBC-SHA

EXP-EDH-DSS-DES-CBC-SHA

EXP-ADH-DES-CBC-SHA

EXP-DES-CBC-SHA

EXP-RC2-CBC-MD5

EXP-KRB5-RC2-CBC-SHA

EXP-KRB5-DES-CBC-SHA

EXP-KRB5-RC2-CBC-MD5

EXP-KRB5-DES-CBC-MD5

EXP-ADH-RC4-MD5

EXP-RC4-MD5

EXP-KRB5-RC4-SHA

EXP-KRB5-RC4-MD5

Note

Deprecated SSL Ciphers: If you had previously enabled these ciphers in a custom policy or

the ELBSample-OpenSSLDefaultCipherPolicy, we recommend that you update your security

policy to the latest version.

For procedures for updating the SSL negotiation configuration for your HTTPS/SSL listener, see Update

SSL Negotiation Configuration of Your Load Balancer (p. 151).

API Version 2012-06-01

Elastic Load Balancing Developer Guide

SSL Security Policy Table

SSL Certificate for Elastic Load

Balancing

If you use HTTPS or SSL for your front-end listener, you must install an SSL certificate on your load bal-

ancer.The load balancer uses the certificate to terminate the connection and then decrypt requests from

clients before sending them to the back-end instances.

The SSL protocol uses an X.509 certificate (SSL server certificate) to authenticate both the client and

the back-end application.The X.509 certificate is a digital form of identification issued by a certificate

authority (CA) and contains identification information, a validity period, a public key, a serial number, and

the digital signature of the issuer.

Before you can install the SSL certificate on your load balancer, you must create the certificate, get the

certificate signed by a CA, and then upload the certificate using the AWS Identity and Access Management

(IAM) service.

The SSL certificate comes with a validity period.You must replace the certificate before its validity period

ends.To replace the certificate you must create and upload the new certificate by following the same

steps you used when you created your certificate for the first time.

All your SSL certificates are managed by IAM. By default, IAM allows 10 SSL server certificates per AWS

account. If you try to upload a new server certificate after reaching this limit, you'll get an error.You can

request for more certificates using this form - IAM Limit Increase Contact Us Form.

In this section we walk you through the following steps for creating SSL server certificate and then uploading

the SSL certificate using the AWS IAM service. By the end of this section your SSL certificate will be

ready to be installed on your load balancer.

Topics

• Prerequisite: Install and Configure OpenSSL (p. 62)

• Generate Private Key and Certificate Signing Request (p. 63)

• Upload the Signed Certificate (p. 65)

• Verify Server Certificate (p. 67)

• Sample Certificates (p. 68)

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Prerequisite: Install and Configure OpenSSL

Creating and uploading a certificate requires a tool that supports the SSL and TLS protocols. OpenSSL

is an open-source tool that provides extensive cryptographis functions. For more information, go to

OpenSSL. If you don't already have OpenSSL installed, follow the instructions in this section. If you

already have OpenSSL installed, skip this step and go to Generate Private Key and Certificate Signing

Request (p. 63).

To install and configure OpenSSL on LINUX and UNIX

1. Go to OpenSSL: Source, Tarballs (http://www.openssl.org/source/).

2. Download the latest source and build the package. At the command line use the commands as in

the following example:

$ wget https://www.openssl.org/source/openssl-1.0.1i.tar.gz

$ ./config -prefix=/etc/openssl -openssldir=/etc/openssl

$ make

$ sudo make install

3. Before you use OpenSSL commands, you must configure the operating system so that it has inform-

ation about the location of the OpenSSL install point.

At the command line, set the OpenSSL_HOME variable to the location of the OpenSSL installation:

export OpenSSL_HOME = path-to-your-OpenSSL-installation

4. Set the path to the OpenSSL installation:

export PATH=$PATH:$OpenSSL_HOME/bin

To install and configure OpenSSL on Windows

1. Go to OpenSSL: Binary Distributions (http://www.openssl.org/related/binaries.html).

2. Click OpenSSL for Windows.

A new page displays with links to the Windows downloads.

3. If it is not already installed on your system, select the Microsoft Visual C++ 2008 Redistributables

link appropriate for your environment and click Download. Follow the instructions provided by the

Microsoft Visual C++ 2008 Redistributable Setup Wizard.

4. After you have installed the Microsoft Visual C++ 2008 Redistributables, select the appropriate version

of the OpenSSL binaries for your environment and save the file locally.The OpenSSL Setup Wizard

launches.

5. Follow the instructions described in the OpenSSL Setup Wizard. Save the OpenSSL binaries to a

folder in your working directory.

6. Before you use OpenSSL commands, you must configure the operating system so that it has inform-

ation about the location of the OpenSSL install point.

Open a Command Prompt window.

7. Set the OpenSSL_HOME variable to the location of the OpenSSL installation:

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Prerequisite: Install and Configure OpenSSL

set OpenSSL_HOME=path-to-your-OpenSSL-installation

8. Set the OpenSSL_CONF variable to the location of the configuration file in your OpenSSL installation:

set OpenSSL_CONF=path-to-your-OpenSSL-installation\bin\openssl.cfg

9. Set the path to the OpenSSL installation:

set Path=%Path%;%OpenSSL_HOME%\bin

Note

Any changes you make to Windows environment variables in a Command Prompt window

are valid only for the current command line session.You can make persistent changes to

the environment variables by setting them as system properties.The exact procedures de-

pend on what version of Windows you're using. (For example, in Windows 7, open Control

Panel > System and Security > System. Then choose Advanced system settings >

Advanced tab > Environment Variables). For more information, see the Windows docu-

mentation.

Generate Private Key and Certificate Signing

Request

This section walks you through the steps for creating a private key, creating a certificate signing request

(CSR), and for submitting the CSR to a Certificate Authority (CA).

If you are using Internet Information Service version 7 (IIS7), you have an option to use the IIS7 built-in

tool to generate a CSR. For more information, see Configuring Internet Server Certificates (IIS7). If you

use the IIS7 built-in tool to generate your CSR, skip the following steps and go to Submit CSR to Certificate

Authority (p. 65).

Create a Private Key

You need a unique private key to create your Certificate Signing Request (CSR). Private keys are created

using standard key algorithms.You must choose the algorithm based on the ciphers you plan to use for

negotiating SSL connections from the client to your load balancer. For example, if you plan to use RSA

based ciphers, make sure to use the algorithm specific to creating RSA based key.

To create a private key

1. For RSA based ciphers

Use the genrsa command and the following syntax:

openssl genrsa 2048 -out your-private-key-filename.pem

For private-key-filename, specify your own file name.The default RSA key length for OpenSSL

is 512 bits. In the example, 2048 represents 2048-bit RSA key length. AWS also supports 1024-bit

and 4096-bit key lengths.We recommend you create an RSA key that is 2048 bits.

For ECDHE-ECDSA based ciphers

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Generate Private Key and Certificate Signing Request

Use the ecparam command and the following syntax:

openssl ecparam -name primev256v1 -out your-private-key-filename.pem -

genkey

For private-key-filename, specify your own file name.

2. Save the private key in a secure place. There is no way to get back your private key if it is lost.

Create a Certificate Signing Request

The next step is to create a Certificate Signing Request (CSR).This is a file that you send to a certificate

authority (CA) to apply for a server certificate.

To create a CSR

Use the openssl req command to create a CSR and the following syntax:

openssl req -sha256 -new -key your-private-key-filename.pem -out csr.pem

The output will look similar to the following example:

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank.

For some fields there will be a default value.

If you enter '.', the field will be left blank.

The following table can help you create your certificate request.

ExampleDescriptionName

US = United StatesThe two-letter ISO abbreviation

for your country.

Country Name

WashingtonThe name of the state or

province where your organization

is located.This name cannot be

abbreviated.

State or Province

SeattleThe name of the city where your

organization is located.

Locality Name

Example CorpThe full legal name of your

organization. Do not abbreviate

your organization name.

Organization Name

MarketingOptional, for additional

organization information.

Organizational Unit

www.yourdomain.comThe fully qualified domain name

for your CNAME.You will receive

a certificate name check warning

if this is not an exact match.

Common Name

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Create a Certificate Signing Request

ExampleDescriptionName

[email protected]The server administrator's email

address

Email address

Note

The Common Name field is often misunderstood and is completed incorrectly.The common

name is typically your host plus domain name. It will look like "www.company.com" or "com-

pany.com".You need to create a CSR using your correct common name.

Use the following command to verify that the information provided in the CSR file is correct:

openssl> req -text -in csr.pem -noout

Submit CSR to Certificate Authority

Your CSR contains information identifying you.To apply for a server certificate, send your CSR to a cer-

tificate authority (CA). The CA might require other credentials or proofs of identity.

If the request for a certificate is successful, the CA returns a public (identity) certificate and possibly a

chain certificate that is digitally signed.

AWS does not recommend a specific CA. For a partial listing of available CAs, see Third-Party Certificate

Authorities.

Upload the Signed Certificate

When you receive your server certificate from the certificate authority (CA), it might be in a format that is

not supported by IAM.Typically you receive a public certificate, one or more intermediate certificates and

a root certificate.The intermediate certificates and the root certificate can come bundled in a file or as

separate files.The file names may vary depending on the type of SSL certificate you purchase and the

certificate authority.

To upload your certificate using AWS IAM, you need the following three files in the PEM format. For more

information about pem format, go to pem DESCRIPTION.

Use the following command for converting private key generated for RSA based ciphers:

openssl rsa -in your-private-key-filename -outform PEM

Use the following command for converting private key generated for ECDSA-ECDHE based ciphers:

openssl ecparam -in your-private-key-filename -outform PEM

Your PEM formatted private key must look similar to the sample private key in Sample Certificates (p.68).

2. Public certificate in PEM format

This is the certificate you receive from the CA.Your public certificate is the domain-specific file.Your

public certificate also must be in PEM format. If it is not, use the following OpenSSL command to convert

your public certificate to PEM format:

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Submit CSR to Certificate Authority

openssl x509 -inform PEM -in your-public-certificate-filename

Your PEM formatted public certificate must look similar to the sample public certificate in Sample Certific-

ates (p. 68).

3. Certificate chain in PEM Format

This file is a concatenation of all the intermediate certificates and the root certificate one after the other.

The certificate chain lets an end user's browser build a certificate chain to a root certificate it trusts. As a

result, the browser can implicitly trust your certificate.

If you are uploading a self-signed certificate and it's not important that browsers implicitly accept the

certificate, you can skip this step and upload just the public certificate and private key.

Typically, both intermediate and root certificates are provided by a CA in a bundled file with the proper

chained order. If a certificate bundle is not available or not available in the required order, you can create

your own certificate chain file.

To create your own certificate chain file, include the intermediate certificates and optionally, the root cer-

tificate, one after the other without any blank lines. If you are including the root certificate, your certificate

chain must start with intermediate certificates and end with the root certificate. Use the intermediate cer-

tificates that were provided by your CA. Any intermediaries that are not involved in the chain of trust path

must not be included.

Your certificate chain must be in PEM format. If it is not, use the following OpenSSL command to convert

your certificate chain to PEM format:

openssl x509 -inform PEM -in your-certificate-chain-filename

Your PEM formatted certificate chain must look similar to the sample certificate chain in Sample Certific-

ates (p. 68).

After you have all your files in the X.509 PEM format, you use the AWS command line interface for IAM

to upload it. For more information, see the AWS Command Line Interface User Guide.

To upload a server certificate

• Use the aws iam upload-server-certificate command by specifying the following options:

• server-certificate-name = name-of-your-server-certificate

You cannot use the name of an expired certificate.

• certificate-body = encoded-certificate-body

The contents of the public certificate in PEM-encoded format

• private-key = encoded-private-key

The contents of the private key in PEM-encoded format.

Note

The private key cannot be retrieved after you are finished uploading it.

• [optional] certificate-chain = concatenation of the intermediate and root cer-

tificates

The contents of the certificate chain in PEM-encoded format.

• [optional] path = /

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Upload the Signed Certificate

Note

The path is optional. If it is not included, the path defaults to /. For more information about

paths, go to Identifiers for IAM Entities in Using IAM.

Your command looks similar to the following example:

aws iam upload-server-certificate --server-certificate-name >name-of-your-

server-certificate --certificate-body file://encoded-public-certificate

file --private-key file://encoded-private-key file --certificate-chain

file://encoded-certificate-chain

Note

When you specify a file as a parameter (for example, for the certificate-body, private-

key, and the certificate-chain parameters), you must include file:// as part of the

file name.

When you upload your certificates, IAM validates the certificates with the following criteria:

• Certificates must follow the X.509 PEM format.

• The current date must be between the certificate’s start and end date.

• Public and private certificate files must contain only a single certificate.

• The private key must match the public key that is in the certificate.

• The private key must be an RSA private key in PEM format, where the PEM header is BEGIN RSA

PRIVATE KEY and the footer is END RSA PRIVATE KEY (as shown in Sample Certificates (p. 68)

• The private key cannot be encrypted with a password.

• The certificate chain must include all of your CA’s intermediary certificates that lead to the root

certificate, and optionally ends with your CA’s root certificate.Typically, both intermediary and root

certificates are provided by a CA in a bundled file with the proper chained order. If a certificate

bundle is not available or not available in the required order, you can create your own file similar

to the sample certificate chain in Sample Certificates (p. 68). Use the intermediary certificates that

were provided by your CA. Any intermediaries that are not involved in the chain of trust path must

not be included.

After you upload your certificate chain to AWS, you can use SSL Checker to verify it.

Note

o The order of intermediate certificates should be documented by the CA. AWS does not

recommend any one CA. For a listing of some CAs, see Third-Party Certificate Authorities.

o Although the root certificate is optional, you can include it so that you can run full chain

of trust verifications, such as SSL Checker.

If you have certificates that result in an error when you upload them, ensure that they meet the criteria,

and then try uploading them again.

Verify Server Certificate

After the server certificate is uploaded, you can verify that the information is stored in IAM. Each certificate

object has a unique Amazon Resource Name (ARN) and ID.You can request these details for a specific

certificate object by referencing the name of the certificate object.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Verify Server Certificate

To view the certificate object's ARN and ID

Use the aws iam get-server-certificate command to verify the certificate object:

aws iam get-server-certificate --server-certificate-name name-of-your-server-

certificate

The response includes the server certificate Amazon Resource Name (ARN) and GUID.

arn:aws:iam::55555555555:server-certificate/production/myCert

ASCACexampleKEZUQ4K

The first line is the Amazon Resource Name (ARN) and the second line is the GUID. Make a note of the

ARN.You need it to install the certificate on your load balancer.

Next Step

• To install SSL certificate on your new load balancer using the AWS Management Console, see Configure

Listeners (p. 73).

• To install SSL certificate on your new load balancer using the AWS Command Line Interface, see

Configure Listeners (p. 82).

• To update SSL certificate on your existing load balancer, see Update an SSL Certificate for a Load

Balancer (p. 147).

Sample Certificates

The following certificates show the valid format that IAM accepts for server certificates and their associated

private key and certificate chain.

The server certificate associates your public key with your identity. When you submit your Certificate

Signing Request (CSR) to a certificate authority (CA), a server certificate is returned to you by the CA.

The following is a sample server certificate:

Sample server certificate

-----BEGIN CERTIFICATE-----

MIIE+TCCA+GgAwIBAgIQU306HIX4KsioTW1s2A2krTANBgkqhkiG9w0BAQUFADCB

tTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL

ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2Ug

YXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSoAYykwOTEvMC0GA1UEAxMm

VmVyaVNpZ24gQ2xhc3MgMyBTZWN1cmUgU2VydmVyIENBIC0gRzIwHhcNMTAxMDA4

MDAwMDAwWhcNMTMxMDA3MjM1OTU5WjBqMQswCQYDVQQGEwJVUzETMBEGA1UECBMK

V2FzaGluZ3RvbjEQMA4GA1UEBxQHU2VhdHRsZTEYMBYGA1UEChQPQW1hem9uLmNv

bSBJbmMuMRowGAYDVQQDFBFpYW0uYW1hem9uYXdzLmNvbTCBnzANBgkqhkiG9w0B

AQEFAAOBjQAwgYkCgYEA3Xb0EGea2dB8QGEUwLcEpwvGawEkUdLZmGL1rQJZdeeN

3vaF+ZTm8Qw5Adk2Gr/RwYXtpx04xvQXmNm+9YmksHmCZdruCrW1eN/P9wBfqMMZ

X964CjVov3NrF5AuxU8jgtw0yu//C3hWnOuIVGdg76626ggOoJSaj48R2n0MnVcC

AwEAAaOCAdEwggHNMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgWgMEUGA1UdHwQ+MDww

OqA4oDaGNGh0dHA6Ly9TVlJTZWN1cmUtRzItY3JsLnZlcmlzaWduLmNvbS9TVlJT

ZWN1cmVHMi5jcmwwRAYDVR0gBD0wOzA5BgtghkgBhvhFAQcXAzAqMCgGCCsGAQUF

BwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhMB0GA1UdJQQWMBQGCCsG

AQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBSl7wsRzsBBA6NKZZBIshzgVy19

RzB2BggrBgEFBQcBAQRqMGgwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnZlcmlz

aWduLmNvbTBABggrBgEFBQcwAoY0aHR0cDovL1NWUlNlY3VyZS1HMi1haWEudmVy

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Sample Certificates

aXNpZ24uY29tL1NWUlNlY3VyZUcyLmNlcjBuBggrBgEFBQcBDARiMGChXqBcMFow

WDBWFglpbWFnZS9naWYwITAfMAcGBSsOAwIaBBRLa7kolgYMu9BSOJsprEsHiyEF

GDAmFiRodHRwOi8vbG9nby52ZXJpc2lnbi5jb20vdnNsb2dvMS5naWYwDQYJKoZI

hvcNAQEFBQADggEBALpFBXeG782QsTtGwEE9zBcVCuKjrsl3dWK1dFiq3OP4y/Bi

ZBYEywBt8zNuYFUE25Ub/zmvmpe7p0G76tmQ8bRp/4qkJoiSesHJvFgJ1mksr3IQ

3gaE1aN2BSUIHxGLn9N4F09hYwwbeEZaCxfgBiLdEIodNwzcvGJ+2LlDWGJOGrNI

NM856xjqhJCPxYzk9buuCl1B4Kzu0CTbexz/iEgYV+DiuTxcfA4uhwMDSe0nynbn

1qiwRk450mCOnqH4ly4P4lXo02t4A/DI1I8ZNct/Qfl69a2Lf6vc9rF7BELT0e5Y

R7CKx7fc5xRaeQdyGj/dJevm9BF/mSdnclS5vas=

-----END CERTIFICATE-----

The private key allows you to decrypt messages that are encrypted with your public key.The following

figure is a sample private key:

Sample private key

Sample certificate chain

The certificate chain includes all intermediary certificates that lead to the root certificate, as shown in the

following example. Intermediaries that are not involved in the trust path must not be included. If included,

the chain must end with your CA’s root certificate.Typically, both intermediary and root certificates are

provided by a CA in a bundled file with the proper chained order.

-----BEGIN CERTIFICATE-----

Intermediate certificate 2

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

Intermediate certificate 1

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

Optional: Root certificate

-----END CERTIFICATE-----

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Sample Certificates

Elastic Load Balancing in Amazon

EC2-Classic

Amazon Web Services (AWS) lets you launch your instances in either Amazon EC2-Classic or Amazon

Virtual Private Cloud (Amazon VPC). If want to load balance your EC2 instances launched in EC2-Classic,

you must create your load balancer in EC2-classic platform.

This section covers information that is specific to your instances and load balancers launched in EC2-

Classic and provides procedural instruction and examples. For information on your load balancers and

instances created within Amazon VPC, see Elastic Load Balancing in Amazon VPC (p. 113).

Before you can start using a load balancer, you must create one.You create your load balancer by con-

figuring listeners, configuring the health check, and by registering your back-end instances with your load

balancer.You configure a listener by specifying the protocol and the port number for front-end (client to

load balancer) and back-end (load balancer to back-end instances) connections.You can configure

multiple listeners for your load balancer. For more information about the listener configurations supported

by Elastic Load balancing, see Listener Configurations for Elastic Load Balancing (p. 49).

When you create your load balancer, by default, your load balancer is set to use the HTTP protocol with

port 80 for the front-end connection and the back-end connection. If you want to create a load balancer

using the default setting, see Create a Basic Load Balancer in EC2-Classic (p. 23).

Elastic Load Balancing provides Secure Sockets Layer (SSL) negotiation configurations, known as Se-

curity Policy, to negotiate connections between the clients and the load balancer. If you choose HTTPS/SSL

for your front-end connection, you can either use the predefined security policy or use custom security

policy.When you use HTTPS or SSL for your front-end connection, you must install SSL certificate on

your load balancer. The load balancer uses the certificate to terminate the connection and then decrypt

requests from clients before sending them to the back-end instances.You can optionally choose to enable

authentication on your back-end instance. For detailed instructions on creating a HTTPS/SSL load balancer

in Amazon EC2, see Create a HTTPS/SSL Load Balancer (p. 72).

As the traffic to your instances increases, you might consider expanding your EC2 instances to run in an

additional Availability Zone. For detailed instructions on expanding to additional Availability Zones, see

Add Availability Zone (p. 96).

When the traffic to your instances decreases, you might consider scaling down the availability of your

instances by disabling some Availability Zones. For detailed instructions on disabling your Availability

Zones, see Remove Availability Zone (p. 99).

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Elastic Load Balancing provides a special Amazon EC2 source security group that you can use to ensure

that a back-end Amazon EC2 instance receives traffic only from Elastic Load Balancing. For information

on locking the incoming traffic between your load balancer and your back-end instances , see Manage

Security Groups in Amazon EC2-Classic (p. 101).

After you create your load balancer, Elastic Load Balancing returns a public DNS name that combines

your load balancer's name and region.This base public DNS name returns only IPv4 records.

Elastic Load Balancing supports both Internet Protocol version 6 (IPv6) and Internet Protocol version 4

(IPv4).

Note

IPv6 support is currently not available for load balancers in Amazon VPC (EC2-VPC).

Clients can connect to your load balancer using either IPv4 or IPv6 (in EC2-Classic). However, commu-

nication between the load balancer and its back-end instances uses only IPv4.You might want to use

the dualstack-prefixed DNS name to enable IPv6 support for communications between client and the

load balancers so that clients are able to access the load balancer using either IPv4 or IPv6 as their indi-

vidual connectivity needs dictate. For more information on enabling IPv6 support, see Use IPv6 with

Elastic Load Balancing (p. 111).

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Create a HTTPS/SSL Load Balancer

This example walks you through the process of creating a HTTPS load balancer with SSL negotiation

configurations and with back-end application instance authentication.You can optionally add tags.

Before you get started, be sure you've met the following preconditions:

• Sign up for Amazon Web Services (AWS). If you haven't signed up for AWS yet, complete the steps

listed in Sign Up for Amazon Web Services(AWS) (p. 18).

• For this example, we use Availability Zone us-east-1a. In Availability Zone us-east-1a, launch the in-

stances you intend to register with your load balancer. For more information about launching Amazon

EC2 instances, see Launching and Using Instances.

• The instances that you intend to register with your load balancer must be configured to receive requests

from the Internet.

• The instances to be registered with your load balancer must respond to the target of the health check

with an HTTP status code 200. For information about Elastic Load Balancing health check, see Health

Check (p. 7).

• If you plan to enable the keep-alive option on your EC2 instances, we recommend that you set the

keep-alive settings to at least the idle timeout settings of your load balancer. If you want to ensure that

the load balancer is responsible for closing the connections to your back-end instance, make sure that

the value set on your instance for the keep-alive time is greater than the idle timeout setting on your

load balancer. For information about load balancer idle timeout, see Idle Connection Timeout (p. 10).

• To enable HTTPS support for our listeners, you must first create an SSL certificate and then install it

on your load balancer. The load balancer uses the certificate to terminate and then decrypt requests

before sending them to the back-end instances. For information on how to create an SSL certificate,

see SSL Certificate for Elastic Load Balancing (p. 61).

All your SSL server certificates are managed by IAM. By default, IAM allows 10 SSL server certificates

per AWS account. If you try to upload a new server certificate after reaching this limit, you'll get an error.

You can request for more certificates using this form - IAM Limit Increase Contact Us Form.

The following sections include instructions for creating an HTTPS/SSL load balancer using the AWS

Management Console or the AWS Command Line Interface (AWS CLI).

• Using the AWS Management Console (p. 72)

• Using the AWS Command Line Interface (p. 82)

Important: Elastic Load Balancing CLI has been replaced by AWS Command Line Interface (AWS

CLI), a unified tool to manage multiple AWS services. New features released after ELB CLI version

1.0.35.0 (dated 7/24/14) will be included in the AWS CLI only. We recommend that you start using the

AWS CLI.

For a list of the functionality supported in previous ELB CLI versions, see Elastic Load Balancing API

Tools.

Using the AWS Management Console

The following step-by-step instructions will help you create an HTTPS/SSL load balancer using the AWS

Management Console. Before you begin, make sure to:

aws.cn/ec2/.

Topics

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Create HTTPS/SSL Load Balancer

• Step 1: Configure Listeners (p. 73)

• Step 2: Configure SSL Security Policy (p. 75)

• Step 3: Configure Back-end Server Authentication (p. 77)

• Step 4: Configure Health Check Settings (p. 78)

• Step 5: Register Amazon EC2 Instances (p. 78)

• Step 6: Add Tags (p. 79)

• Step 7: Verify the Details of Your Load Balancer (p. 80)

Step 1: Configure Listeners

A listener is a process that listens for connection requests. It is configured with a protocol and a port

number for front-end (client to load balancer) and back-end (load balancer to back-end instance) connec-

tions. For information about the ports, protocols and the listener configurations supported by Elastic Load

Balancing, see Listener Configurations for Elastic Load Balancing (p. 49).

In this example, you configure two listeners for your load balancer by specifying the ports and protocols

to use for front-end connection (client to load balancer) and back-end connection (load balancer to back-

end instance).The first listener accepts HTTP requests on port 80 and sends the request to the back-

end application instances on port 80 using HTTP.The second listener accepts HTTPS requests on port

443 and sends the request to back-end application instances using HTTPS on port 443.

Since the second listener uses HTTPS for the front-end connection, you will have to install SSL sever

certificate on your load balancer. The load balancer uses the certificate to terminate and then decrypt

requests before sending them to the back-end instances. Before you can install the SSL certificate on

your load balancer, you must create the certificate, get the certificate signed by a Certificate Authority

(CA), and then upload the certificate using the AWS Identity and Access Management (AWS IAM) service.

For information about creating and uploading SSL certificates, see SSL Certificate for Elastic Load Bal-

ancing (p. 61)

To configure listeners for your load balancer

1. Start the Create Load Balancer wizard:

a. On the Amazon EC2 console Resources page, in the EC2 Dashboard pane, under NETWORK

& SECURITY, click Load Balancers.

b. On the Load Balancers page, click Create Load Balancer.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Using the AWS Management Console

2. On the Define Load Balancer page, enter a name for your load balancer (e.g., my-test-loadbal-

ancer).

The load balancer name you choose must be unique within your set of load balancers, must have a

maximum of 32 characters, and must only contain alphanumeric characters or hyphens.

3. Leave the Listener Configuration set to the default value for the first listener.

4. Leave the Create LB Inside: box set to EC2-Classic for this tutorial.

5. Click Add to add a second listener.

6. Select HTTPS (Secure HTTP) from the drop-down box in the Load Balancer Protocol box. This

populates the Load Balancer Port box. Select HTTPS (Secure HTTP) from the drop-down box in

the Instance Protocol box.This populates the Instance Port box.

7. Click Continue to upload your SSL certificate.

8. To use a previously uploaded certificate

a. On the Select Certificate page, in the Certificate Type: field, select Choose from an existing

SSL Certificate.

b. Click the Certificate Name: dialog box and select your certificate.

c. Click Continue.

d. Skip the next step and see Step 2: Configure SSL Security Policy (p. 75) for instructions on

configuring SSL ciphers.

9. To upload a signed certificate

On the Select Certificate page, in the Certificate Type: field, select Upload a new SSL Certificate.

Before you upload, check if your certificate meets the criteria described in Upload the Signed Certi-

ficate (p. 65)

Note

If your certificate does not meet the criteria, you might get an error when you upload it.

Create a new SSL certificate and upload the certificate using IAM. For instructions on creating

and uploading the SSL certificate, see SSL Certificate for Elastic Load Balancing (p. 61).

If your certificate meets the criteria, step through the following instructions to continue uploading your

SSL certificate.

a. Enter the name of the certificate to upload.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Using the AWS Management Console

b. Copy and paste the contents of the private key file (PEM-encoded) in the Private Key box.

Note

The private key cannot be retrieved after you are finished uploading it.

c. Copy and paste the contents of the public key certificate file (PEM-encoded) in the Public Key

Certificate box.

d. Copy and paste the contents of the certificate chain file (PEM-encoded) in the Certificate Chain

box.

Note

You can skip this step if you are using a self-signed certificate and it's not important

that browsers implicitly accept the certificate.

10. Click Continue to configure SSL ciphers for the HTTPS/SSL listeners.

11. See Step 2: Configure SSL Security Policy (p. 75) for instructions on configuring SSL ciphers.

Step 2: Configure SSL Security Policy

Elastic Load Balancing provides you with security policies that have predefined SSL negotiation configur-

ations you can use for your load balancer.You can either select one of the predefined security policies,

or you can create your own custom security policy by specifying the SSL protocols, ciphers, and, optionally,

enabling the server order preference.

Note

If you do not associate any security policy with your load balancer, Elastic Load Balancing will,

by default, associate the latest version of the predefined security policy with your load balancer.

For more information about the security policies, see SSL Negotiation Configurations for Elastic Load

Balancing (p.55). For information about the current configuration for all security policies, see SSL Security

Policy Table (p. 56).

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Using the AWS Management Console

On the Select a Cipher page, the predefined security policy ELBSecurityPolicy-2014-10 is selected by

default for your SSL/HTTPS listener.This is the recommended setting. This policy uses server order

preference (the order listed in the SSL Security Policy Table (p. 56)) to negotiate SSL connections.

To keep the recommended predefined security policy

• On the Select a Cipher page, make sure that ELBSecurity-Policy-2014-10 is selected, and click

Continue to configure back-end server authentication.

To select a different policy from the predefined security policy list

1. On the Select a Cipher page, select Predefined Security Policy.

2. In the security policy drop-down list, select a policy.

3. Click Continue to configure back-end server authentication.

To create your own security policy

1. On the Select a Cipher page, select Custom Security Policy.

2. Under SSL Protocols, select one or more protocols to enable.

3. Under SSL Options, select Server Order Preference if you want to use the order listed in the SSL

Security Policy Table (p. 56) for SSL negotiation.

4. Under SSL Ciphers, select one or more ciphers to enable.

Note

You must enable at least one protocol and one cipher for SSL negotiation to take place.

The DSA and RSA ciphers are specific to the signing algorithm and are used to create the

SSL certificate. If you already have your SSL certificate, make sure to enable the cipher

that was used to create your certificate.

The following screen shot shows a custom configuration with Server Order Preference enabled.

5. Click Continue to configure back-end server authentication.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Using the AWS Management Console

6. See Step 3: Configure Back-end Server Authentication (p. 77) for instructions on configuring back-

end server authentication.

Step 3: Configure Back-end Server Authentication

If you have HTTPS/SSL on the back-end connection, you can choose to enable authentication on your

back-end instance. This authentication can be used to ensure that back-end instances accept only en-

crypted communication and to ensure that the back-end instance has the correct certificates.

On the Backend Certificate page, select from the following options:

To not configure back-end server authentication

• Select Proceed without backend authentication and go to step 2.

To configure back-end server authentication

1. Select Enable backend authentication.

a. Enter the name of the public key certificate in the Certificate Name box, and then copy and

paste the contents of the certificate (PEM-encoded) in the Certificate body box.

b. Click Add another Backend Certificate to add multiple certificates.

2. Click Continue to configure health check for your backend server.

3. See Step 4: Configure Health Check Settings (p. 78) for instructions on configuring health check for

your back-end servers.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Using the AWS Management Console

Step 4: Configure Health Check Settings

Elastic Load Balancing routinely checks the health of each registered Amazon EC2 instance based on

the configurations that you specify. If Elastic Load Balancing finds an unhealthy instance, it stops sending

traffic to the instance and reroutes traffic to healthy instances. For more information on configuring health

check, see Health Check (p. 7).

To configure the health check

1. On the Configure Health Check page, configure the health check settings that your application re-

quires.

Elastic Load Balancing sends health check queries to the specified ping port and the ping path. Make

sure that your EC2 instances accept traffic on the ping port you specify here.

This example uses a single forward slash in the ping path field so that Elastic Load Balancing sends

the query to your webserver's default home page, whether that default page is named index.html,

default.html, or a different name.

2. Click Continue to register your Amazon EC2 instances.

3. See Step 5: Register Amazon EC2 Instances (p. 78) for instructions to register your EC2 instances.

Step 5: Register Amazon EC2 Instances

After you create your load balancer, you have to register your EC2 instances with the load balancer.Your

EC2 instances can be within a single Availability Zone or span multiple Availability Zones within a region.

For more information on configuring EC2 instances you plan to register with your load balancer, see

Configuring EC2 Instances for Load Balancing (p. 7).

When you register EC2 instances using the console, the cross-zone load balancing and connection

draining options are enabled by default. If you do not want either or both the options for your load balancer,

you can disable them. If you are using the CLI or the Query API to register your instances, and you want

to enable either or both these options, you must explicitly do so.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Using the AWS Management Console

If cross-zone load balancing is enabled for your load balancer, Elastic Load Balancing routes the traffic

evenly across all your registered EC2 instances. If connection draining is enabled for your load balancer,

the load balancer allows all in-flight requests to instances to complete while the instances are deregistering.

For more information about cross-zone load balancing see Request Routing (p. 6). For more information

about connection draining, see Connection Draining (p. 9).

To add Amazon EC2 instances

1. On the Add EC2 Instances page, in the Add Instances to Load Balancer table, select the boxes

in the Instance column to register instances with your load balancer.

2. Click the Enable Cross-Zone Load Balancing box if you want to change the default setting.

3. Click the Enable Connection Draining box if you want to change the default setting.

4. Click Continue to add tags.

5. See Step 6: Add Tags (p. 79) for instructions on adding tags.

Step 6: Add Tags

You can optionally set tags for your load balancer.Tags help you to categorize your load balancers in

different ways, for example, by purpose, owner, or environment. For more information, see Tagging (p.12).

To add tags

If you do not want to assign tags to your load balancer at this time, click Continue to skip this step and

go to step 4.

1. On the Add Tags page, specify a key and a value for the tag.

2. To add multiple tags, click Create Tag and continue to specify a key and a value for each tag.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Using the AWS Management Console

3. When you are done, click Continue to review the details of your load balancer.

4. On the Review page, check your settings.You can make changes by clicking the edit link for each

setting. After you've reviewed your load balancer settings, click Create to create your load balancer.

5. The Create Load Balancer wizard displays the status of your newly created load balancer. Click

Close after confirming that your load balancer was successfully created.

6. See Step 7: Verify the Details of Your Load Balancer (p. 80) to verify that the load balancer is

launched.

Step 7:Verify the Details of Your Load Balancer

Your newly created load balancer now appears in the load balancer page.

To verify the details of your load balancer,

1. Select the check box next to your load balancer.

The bottom pane displays the description of your load balancer.Verify that the descriptions match

your specifications.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Using the AWS Management Console

If the description in the Status row indicates that some of your instances are not in service, it's

probably because your instances are still registering. For more information, see Troubleshooting

Elastic Load Balancing: Registering Instances (p. 262).

2. You can test your load balancer after you've verified that at least one of your EC2 instances is InSer-

vice.To test your load balancer, copy the DNS Name value that is listed in the Description tab and

paste it into the address field of an Internet-connected web browser. If your load balancer is working,

you will see the default page of your HTTP server.

API Version 2012-06-01

Elastic Load Balancing Developer Guide

Using the AWS Management Console

Using the AWS Command Line Interface

The following step-by-step instructions will help you create an HTTPS/SSL load balancer using the AWS

Command line Interface (AWS CLI).

Important

Elastic Load Balancing CLI has been replaced by AWS Command Line Interface (AWS CLI), a

unified tool to manage multiple AWS services. New features released after ELB CLI version

1.0.35.0 (dated 7/24/14) will be included in the AWS CLI only. We recommend that you start

using the AWS CLI.

For a list of the functionality supported in previous ELB CLI versions, see Elastic Load Balancing

API Tools.

Before you get started make sure that you have installed and configured your AWS CLI environment. For

more information, see Getting Set Up with the AWS Command Line Interface.

Topics

• Step 1: Configure Listeners (p. 82)

• Step 2: Configure SSL Security Policy (p. 85)

• Step 3: Configure Backend Server Authentication (p. 91)

• Step 4: Configure Health Check (p. 93)

• Step 5: Register EC2 Instances (p. 94)

• Step 6: Verify Instances (p. 95)