Elastic Load Balancing (ELB)AuthorCloudBrum editorial teamLast reviewed30 Oct 2026Reading time~12 minLevelBeginner to advanced

# Placeholders: replace the Region, the certificate and the instance with your own. This uses the default VPC; use private subnets for targets in production.
REGION=ap-south-1
CERT_ARN=arn:aws:acm:$REGION:123456789012:certificate/11111111-2222-3333-4444-555555555555
INSTANCE_ID=i-0123456789abcdef0

VPC_ID=$(aws ec2 describe-vpcs --region $REGION --filters Name=is-default,Values=true --query "Vpcs[0].VpcId" --output text)
SUBNETS=$(aws ec2 describe-subnets --region $REGION --filters Name=vpc-id,Values=$VPC_ID --query "Subnets[0:2].SubnetId" --output text)

# 1. Two security groups. The load balancer accepts web traffic from anywhere, and the targets accept it only from the load balancer.
ALB_SG=$(aws ec2 create-security-group --region $REGION --group-name web-alb --description "Load balancer" --vpc-id $VPC_ID --query GroupId --output text)
APP_SG=$(aws ec2 create-security-group --region $REGION --group-name web-app --description "Web servers" --vpc-id $VPC_ID --query GroupId --output text)
aws ec2 authorize-security-group-ingress --region $REGION --group-id $ALB_SG --protocol tcp --port 80 --cidr 0.0.0.0/0
aws ec2 authorize-security-group-ingress --region $REGION --group-id $ALB_SG --protocol tcp --port 443 --cidr 0.0.0.0/0
aws ec2 authorize-security-group-ingress --region $REGION --group-id $APP_SG --protocol tcp --port 8080 --source-group $ALB_SG

# 2. A target group with a health check on /health. Short deregistration delay and least-outstanding-requests routing suit short requests.
TG_ARN=$(aws elbv2 create-target-group --region $REGION --name web --protocol HTTP --port 8080 --vpc-id $VPC_ID --target-type instance \
  --health-check-path /health --health-check-interval-seconds 15 --healthy-threshold-count 3 --unhealthy-threshold-count 2 \
  --matcher HttpCode=200 --query "TargetGroups[0].TargetGroupArn" --output text)
aws elbv2 modify-target-group-attributes --region $REGION --target-group-arn $TG_ARN --attributes \
  Key=deregistration_delay.timeout_seconds,Value=30 Key=load_balancing.algorithm.type,Value=least_outstanding_requests Key=slow_start.duration_seconds,Value=30
aws elbv2 register-targets --region $REGION --target-group-arn $TG_ARN --targets Id=$INSTANCE_ID,Port=8080

# 3. The Application Load Balancer, with deletion protection and invalid HTTP headers dropped.
ALB_ARN=$(aws elbv2 create-load-balancer --region $REGION --name web-alb --type application --scheme internet-facing \
  --subnets $SUBNETS --security-groups $ALB_SG --query "LoadBalancers[0].LoadBalancerArn" --output text)
aws elbv2 modify-load-balancer-attributes --region $REGION --load-balancer-arn $ALB_ARN --attributes \
  Key=deletion_protection.enabled,Value=true Key=routing.http.drop_invalid_header_fields.enabled,Value=true Key=idle_timeout.timeout_seconds,Value=60

# 4. Port 80 only redirects to HTTPS. Port 443 terminates TLS with the certificate and a current security policy, then forwards.
aws elbv2 create-listener --region $REGION --load-balancer-arn $ALB_ARN --protocol HTTP --port 80 \
  --default-actions "Type=redirect,RedirectConfig={Protocol=HTTPS,Port=443,StatusCode=HTTP_301}"
HTTPS_ARN=$(aws elbv2 create-listener --region $REGION --load-balancer-arn $ALB_ARN --protocol HTTPS --port 443 \
  --ssl-policy ELBSecurityPolicy-TLS13-1-2-2021-06 --certificates CertificateArn=$CERT_ARN \
  --default-actions Type=forward,TargetGroupArn=$TG_ARN --query "Listeners[0].ListenerArn" --output text)

# 5. A path rule: /api/* goes to its own target group.
API_TG=$(aws elbv2 create-target-group --region $REGION --name api --protocol HTTP --port 8081 --vpc-id $VPC_ID --target-type instance \
  --health-check-path /health --query "TargetGroups[0].TargetGroupArn" --output text)
aws elbv2 create-rule --region $REGION --listener-arn $HTTPS_ARN --priority 10 \
  --conditions Field=path-pattern,Values=/api/* --actions Type=forward,TargetGroupArn=$API_TG

# 6. Send 10 percent of traffic to a new version by weighting two target groups on the default action. Set the weights back to move on.
CANARY_TG=$(aws elbv2 create-target-group --region $REGION --name web-canary --protocol HTTP --port 8080 --vpc-id $VPC_ID --target-type instance \
  --health-check-path /health --query "TargetGroups[0].TargetGroupArn" --output text)
aws elbv2 modify-listener --region $REGION --listener-arn $HTTPS_ARN --default-actions \
  "Type=forward,ForwardConfig={TargetGroups=[{TargetGroupArn=$TG_ARN,Weight=90},{TargetGroupArn=$CANARY_TG,Weight=10}]}"

# 7. Which targets are healthy, and why not? The reason code points at the problem (for example Target.Timeout or Target.ResponseCodeMismatch).
aws elbv2 describe-target-health --region $REGION --target-group-arn $TG_ARN \
  --query "TargetHealthDescriptions[].{target:Target.Id,state:TargetHealth.State,reason:TargetHealth.Reason}"

# 8. Load balancer errors and unhealthy hosts over the last hour.
LB_DIM=$(echo $ALB_ARN | cut -d/ -f2-)
aws cloudwatch get-metric-statistics --region $REGION --namespace AWS/ApplicationELB --metric-name HTTPCode_ELB_5XX_Count \
  --dimensions Name=LoadBalancer,Value=$LB_DIM --statistics Sum --period 300 \
  --start-time $(date -u -d '-1 hour' +%FT%TZ) --end-time $(date -u +%FT%TZ)

# Placeholders: pass in your own certificate and instance. This uses the default VPC; use private subnets for targets in production.
variable "region" {
  type    = string
  default = "ap-south-1"
}

variable "certificate_arn" {
  type = string
}

variable "instance_id" {
  type = string
}

provider "aws" {
  region = var.region
}

data "aws_vpc" "default" {
  default = true
}

data "aws_subnets" "default" {
  filter {
    name   = "vpc-id"
    values = [data.aws_vpc.default.id]
  }
}

# The load balancer accepts web traffic from anywhere. The targets accept it only from the load balancer.
resource "aws_security_group" "alb" {
  name        = "web-alb"
  description = "Load balancer"
  vpc_id      = data.aws_vpc.default.id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group" "app" {
  name        = "web-app"
  description = "Web servers"
  vpc_id      = data.aws_vpc.default.id

  ingress {
    from_port       = 8080
    to_port         = 8080
    protocol        = "tcp"
    security_groups = [aws_security_group.alb.id]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_lb_target_group" "web" {
  name                          = "web"
  port                          = 8080
  protocol                      = "HTTP"
  vpc_id                        = data.aws_vpc.default.id
  target_type                   = "instance"
  deregistration_delay          = 30
  slow_start                    = 30
  load_balancing_algorithm_type = "least_outstanding_requests"

  health_check {
    path                = "/health"
    interval            = 15
    healthy_threshold   = 3
    unhealthy_threshold = 2
    matcher             = "200"
  }
}

resource "aws_lb_target_group" "api" {
  name        = "api"
  port        = 8081
  protocol    = "HTTP"
  vpc_id      = data.aws_vpc.default.id
  target_type = "instance"

  health_check {
    path = "/health"
  }
}

resource "aws_lb_target_group_attachment" "web" {
  target_group_arn = aws_lb_target_group.web.arn
  target_id        = var.instance_id
  port             = 8080
}

resource "aws_lb" "web" {
  name                       = "web-alb"
  load_balancer_type         = "application"
  internal                   = false
  subnets                    = slice(data.aws_subnets.default.ids, 0, 2)
  security_groups            = [aws_security_group.alb.id]
  enable_deletion_protection = true
  drop_invalid_header_fields = true
  idle_timeout               = 60
}

# Port 80 only redirects to HTTPS.
resource "aws_lb_listener" "http" {
  load_balancer_arn = aws_lb.web.arn
  port              = 80
  protocol          = "HTTP"

  default_action {
    type = "redirect"

    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.web.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  certificate_arn   = var.certificate_arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.web.arn
  }
}

resource "aws_lb_listener_rule" "api" {
  listener_arn = aws_lb_listener.https.arn
  priority     = 10

  action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.api.arn
  }

  condition {
    path_pattern {
      values = ["/api/*"]
    }
  }
}

output "dns_name" {
  value = aws_lb.web.dns_name
}

# pip install boto3
# Moves a share of traffic to a canary target group, lists the targets that are not healthy, and drains an instance before it is stopped.
import boto3

elbv2 = boto3.client("elbv2", region_name="ap-south-1")


def set_canary(listener_arn, stable_arn, canary_arn, percent):
    """Sends `percent` of new requests to the canary target group. percent=0 sends everything back to the stable one."""
    elbv2.modify_listener(ListenerArn=listener_arn, DefaultActions=[{
        "Type": "forward",
        "ForwardConfig": {"TargetGroups": [
            {"TargetGroupArn": stable_arn, "Weight": 100 - percent},
            {"TargetGroupArn": canary_arn, "Weight": percent},
        ]},
    }])


def unhealthy(target_group_arn):
    """Returns (target id, state, reason) for every target that is not healthy. The reason says why, for example Target.Timeout."""
    reply = elbv2.describe_target_health(TargetGroupArn=target_group_arn)
    return [(d["Target"]["Id"], d["TargetHealth"]["State"], d["TargetHealth"].get("Reason", ""))
            for d in reply["TargetHealthDescriptions"] if d["TargetHealth"]["State"] != "healthy"]


def drain(target_group_arn, instance_id, port=8080):
    """Takes the instance out of rotation and waits until in-flight requests have finished (the deregistration delay)."""
    target = {"Id": instance_id, "Port": port}
    elbv2.deregister_targets(TargetGroupArn=target_group_arn, Targets=[target])
    elbv2.get_waiter("target_deregistered").wait(TargetGroupArn=target_group_arn, Targets=[target],
                                                 WaiterConfig={"Delay": 10, "MaxAttempts": 40})


if __name__ == "__main__":
    group = elbv2.describe_target_groups(Names=["web"])["TargetGroups"][0]["TargetGroupArn"]
    print("not healthy:", unhealthy(group) or "none")

// dotnet add package AWSSDK.ElasticLoadBalancingV2
// Audits every load balancer in the Region: deletion protection, dropping invalid headers, access logs,
// HTTP listeners that do not redirect to HTTPS, and old TLS security policies.
using Amazon.ElasticLoadBalancingV2;
using Amazon.ElasticLoadBalancingV2.Model;

using var elb = new AmazonElasticLoadBalancingV2Client();
int problems = 0;
string? marker = null;

do
{
    var page = await elb.DescribeLoadBalancersAsync(new DescribeLoadBalancersRequest { Marker = marker });
    foreach (LoadBalancer lb in page.LoadBalancers)
    {
        var attributes = (await elb.DescribeLoadBalancerAttributesAsync(new DescribeLoadBalancerAttributesRequest { LoadBalancerArn = lb.LoadBalancerArn }))
            .Attributes.ToDictionary(a => a.Key, a => a.Value);

        if (attributes.GetValueOrDefault("deletion_protection.enabled") != "true")
        {
            Console.WriteLine($"{lb.LoadBalancerName}: deletion protection is off");
            problems++;
        }
        if (attributes.GetValueOrDefault("access_logs.s3.enabled") != "true")
        {
            Console.WriteLine($"{lb.LoadBalancerName}: access logs are off");
            problems++;
        }
        if (lb.Type == LoadBalancerTypeEnum.Application && attributes.GetValueOrDefault("routing.http.drop_invalid_header_fields.enabled") != "true")
        {
            Console.WriteLine($"{lb.LoadBalancerName}: invalid HTTP header fields are not dropped");
            problems++;
        }

        var listeners = (await elb.DescribeListenersAsync(new DescribeListenersRequest { LoadBalancerArn = lb.LoadBalancerArn })).Listeners;
        foreach (Listener listener in listeners)
        {
            if (listener.Protocol == ProtocolEnum.HTTP && !listener.DefaultActions.Any(a => a.Type == ActionTypeEnum.Redirect))
            {
                Console.WriteLine($"{lb.LoadBalancerName}:{listener.Port}: HTTP listener does not redirect to HTTPS");
                problems++;
            }
            if (listener.Protocol == ProtocolEnum.HTTPS && !(listener.SslPolicy ?? "").Contains("TLS13"))
            {
                Console.WriteLine($"{lb.LoadBalancerName}:{listener.Port}: security policy {listener.SslPolicy} does not offer TLS 1.3");
                problems++;
            }
        }
    }
    marker = page.NextMarker;
} while (marker != null);

Console.WriteLine(problems == 0 ? "No problems found." : $"{problems} problem(s) found.");
return problems == 0 ? 0 : 1;