AWS Elastic Load Balancer (ELB) Tutorial How-To

[@Beachcasts]

Check out more development related videos at: kzbin.info/aero/PL6_nF0awZMoNvi0QLmcv4qY5kfbnHrqg_

[@Beachcasts]

Or to see how to create a REST API with Expressive, see: kzbin.info/aero/PL6_nF0awZMoMol4RPLf99WIZuoJ3l87oG

[@sabirahmed6191]

Thanks a lot! For people having issues with 502 redirects try the following 1. Check if http only is working (incognito) 2. If http works but https gives a 502, just add the same forwarding of http to https in your Target groups. 3. Now after the above step both http and https will work. 4. If you want to redirect http to https then remove the forwarding from http and make it redirect to 443 port in Target groups.

[@Beachcasts]

Thank you for contributing.

[@rathore354]

again i am saying this only video i found which the production level environment required don't believe my word check any video no one explained like you ... Many thanks you save my reputation at perfect time

[@Beachcasts]

Thank you.

[@antonionovak7639]

For anyone having ERR_TOO_MANY_REDIRECTS error. You need to have additional Security Group for instance with inbound rules to allow traffic only from Load Balancer group. And Load Balancer Group to which is Load Balancer assigned need to be open to anyone. Beside that; Great tutorial! It saved me lot of time. Thanks!

[@Beachcasts]

Thanks for sharing.

[@orlandogunman509]

Just wanted y'all to know I used this tutorial to help with my set-up with several EC2 servers and their load balancer service over by Amazon. I used the SSL they provided though. This tutorial was helpful!

[@Beachcasts]

Glad I could help

[@dimef_]

You saved my sleep. I wasn't specifying the 443 target. I usually don't comment ever, but that god I clicked your video. Thank you!

[@Beachcasts]

Thank you for the comment. So happy it saved you some troubles.

[@rlee431]

Thank you for this tutorial. It's one of the most thorough tutorials on the subject, at least that I have seen.

[@Beachcasts]

So happy it helped you. Thank you for letting me know.

[@sillycoder9690]

Man, your explanations are awesome. Great clip, thanks a lot!!!

[@pkiekens]

Great video. Thx for sharing! One question though. At 12:38 , why did you copy the ID of the SgWebSvrBasicOpen security group to the inbound of the public loadbalancer. What is the connection here? What would be wrong with just leaving it open to listen on 80 en 443? After all, it's a public ELB.

[@sbuckle1171]

At 3:45 he says that SgBeachcasts Lb will be used by target instances - not LB.

[@sbuckle1171]

3:40, sorry

[@Beachcasts]

I hope you found the video helpful, and have succeeded in what you needed to do.

[@Tomsonx232]

THANK YOU!!!!!!! Not only did this solve my problem but it was incredibly easy to follow. Even though I came for one problem to get solved I HAD to subscribe

[@Beachcasts]

Thank you. I hope you find many other problems to solve with my videos.

[@sam683or]

it helped me a lot to setup SSL for our services, Awesome.

[@Beachcasts]

That's terrific! Did you do the entire load balancer setup as well?

[@jiahaotang1924]

Thanks. But if you can test the load balancer at the end of this video by hitting the ec2 endpoint, that would be better!

[@Beachcasts]

Great point! Perhaps I will recreate this with more details. I've also learned more since creating this video.

[@Yermid]

Thanks so much for a very clear and focused and very professional video

[@Beachcasts]

Glad you liked it.

[@Drivez1]

Great work Adam.Nice sunny 🌞 video. Really liked the AWS topic

[@Beachcasts]

Thanks Marius. The topic was hot on my mind as this past week I had to implement this to help a client overcome a DDoS attack. However, learning this was painful because the docs were a little lacking and didn't smoothly cover how each step was required and linked.

[@Drivez1]

Beachcasts Tech Videos that is true. There’s steps you need to do before enabling the service. Great explanation on the. Learned from this 👍

[@spotlessthoughful]

You can automate the process using lambda functions, look at the boto3 documentation for ACM, or even use the CLI commands and set up a cron job possibly.

[@Beachcasts]

Thanks Nate. I certainly will look at that. Much appreciated.

[@findbrownie]

Awsome, i want to know how the waf will be configured in front of elb, will it be pass through?, does the elb do ssl offload, do we need the ec2 server to also have a cert.

[@Beachcasts]

It's been awhile since I've looked at that (WAF and ELB), but I think I remember setting up the WAF then associating it with the resource in the Web ACL Rules. Hope that helps.

[@mvjrao123]

Nice one. I have a quick question. If I have more than one EC2 server behind the ALB should I use a separate SSL certificate for each server? what should these certificates contain in Common Name and Subject Alter Names? thanks.

[@Beachcasts]

If I understand correct, the load balancer will have the publicly used cert. Servers don't really matter.

[@hazzaldo]

Great tutorial and explanation. One question. You mentioned at 14:50 that as well as port 443, port 80 is also redirecting to 443 with 301 redirect. I didn't understand this point. Where did you set port 80 to redirect to 443. Is it in the HTTP 80 listener that you set it to redirect to Target Group 443? I couldn't tell because I didn't see the rules fo listener HTTP 80. Also how would you fix the issue of 301 redirect in this case? Thanks

[@Beachcasts]

I did this in the Load Balancers area of EC2. I added/set the port 80 listener of a Load Balancer to redirect as the Default action. Hope that helps you.

[@hazzaldo]

​@@Beachcasts Thank you for your response. Apologies, but I didn't see that in the video. I saw you edit the rule for Listener HTTPS:443 where the action forward to Target Group 'beachcast443' at 11:50, but I didn't see you edit the rule on Listener HTTP:80 to redirect to Target Group 'beachcast443' as well. Was that meant to be the idea? Or am I missing something? Thanks

[@Beachcasts]

You're correct. I didn't do that in the video. I learned it afterward. Give it a try in AWS. In the port 80 listener, delete the current action, and add a new action that redirects port 80 to the 443 listener.

[@AlexkinSkywalker26]

You are the best buddy!!, you really helped me creating a Load Balancer for a web site I have and finally it's working. Thank you so much, you earned a new suscriptor. :) ...

[@Beachcasts]

Thank you. Happy it worked for you.

[@JesusArriagaBarron]

that helped me a lot ... thank you for sharing it !

[@Beachcasts]

Awesome. Thank you.

[@dannymason3970]

Great video, but I am just trying to understand , if I follow this video up to 16:15, does this add ssl to my site i.e. make it accessible via and add the green padlock?

[@dannymason3970]

Well, as a beginner to AWS and its intricacies, I followed this guide and although it appears my website is SSL certified, when I try and access it using , I get 502 bad gateway error :(

[@Beachcasts]

No, this video does not cover how to fully set up the SSL. It only covers how to send http and https through the load balancer. I recommend you set up the SSL first, then add the certificates to the AWS Security Manager, to be used by the Elastic Load Balancer.

[@iliketocode6986]

so confused i followed along but we didnt create the beachcastOPENlb we just walked through how to do the secure one

[@Beachcasts]

Hope you figured this out.

[@TheSigil]

i’ve got it working for one of my sites but can’t figure out how to do it again. My cert is issuers but i’m having it trouble applying it. Can’t figure out were i went wrong

[@Beachcasts]

Likely the security groups. I stumble on them every time. Good luck.

[@TheSigil]

@@Beachcasts sounds about right. I still haven't fixed it. Do i set the security group to the cert manager certificate? Or the load balencer?

[@er.ashishjetawat3201]

My site has custom port like 54301, how I can configure SSL with it. Target group showing bad health. Please help

[@Beachcasts]

I found it helpful to look at the server logs to see if AWS was hitting it.

[@truepinoy75]

Thank you for the useful video. Keep it up!

[@Beachcasts]

Thanks, will do!

[@jameshack5966]

Thanks, brilliant. Massively helpful.

[@Beachcasts]

Glad it helped!

[@danc4268]

Can this be done across instances in different regions? For example, I have a load balancer configured in Ohio region and it points to an instance in Ohio and also an instance in N. California. Is this possible to do?

[@Beachcasts]

ELB is able to balance across availability zones, but not regions, as far as I know.

[@yahhboyDrewskii]

If you are allowing all traffic in the open sg then referencing it in the lb sg then the lb sg is allowing all traffic. Thus, defeating the point of the elb. right? Thanks for the video btw!

[@Beachcasts]

Thanks for the comment. Yes, the policy allows all traffic on given ports. (example: port 80 and 443) But also insulates the actual IP of the server from being known. Plus, allows additional rules and policies to be put in place prior to passing traffic to the server. (Example: only allow specific IP to hit port 22) This video was a very basic example to get it set up.

[@yahhboyDrewskii]

@@Beachcasts Ideally, we would want to make the EC2 only allow access via port 80 and 443 from the IP of the ALB. Also, I ran into an annoying issue of my target groups failing the health check without a reason code being shown. For anyone else watching and having this issue, I had to install IIS and bind port 80 and 443 to the site then set the default document for the site. I then referenced the index.htm in the health check path in the target group. I confirmed access to the default file by accessing it from another server on the same network to ensure it was accessible and the target group health check wouldn't get a 404 error. Thanks again for the video and i look forward to your next one!

[@Beachcasts]

Thanks Andrew. I think you misunderstood. In the video I show exactly that. Making it so only the traffic coming from the ELB makes it to the EC2 instance via internal IP. Also in the video, I show how I added '/index.php' to the targets so the health checks passed. Both valid points covered in the video.

[@kenlang1070]

Very good video! One thought though is with the health checks on redirect codes. Did you try putting it into the "Success codes" field, in the "Advanced health check settings" group, in the step 4 "Configure Routing" when making a new load balancer?

[@Beachcasts]

Great idea. Yes, the expected results are important.

[@sudhansharikatla8862]

As I am new to aws, iam confusing about, we have only created listener 80 in routing, but in listeners section of loadbalancer , it is showing https: 443 also, here iam confusing, how it is showing https:443

[@Beachcasts]

Unfortunately, I'd need to know more of your setup. Typically, though I didn't show this in the video, I set up everything to https:443. Then I set up port 80 as a redirect to 443. Hope that helps.

[@arunnandgadi4348]

I Have a query related to ALB, as my website is already having 3rd party SSL certificate and it's an HTTPS site, if I want to use and place ALB to handle traffic, should I generate a new certificate in AWS ACM and associate the same with ALB or can I use the same 3rd party certificate on ALB. Please clarify my confusion.

[@Beachcasts]

Yes, in Certificate Manager you can add 3rd Party certs, and then use them. But honestly, easier to use a cert generated by AWS instead, and let the renewals get handled. Otherwise, you will need to re-upload the cert for every renewal.

[@arunnandgadi4348]

Hi, will be there any problem if both the certificates are running, say AWS certificate running on my ALB and 3rd part certificate running on the application server, will there be any conflict or complication of using both certificates.

[@DiegoRFGonz88]

why not leave the LB & EC2 open if is still poiting to an open SG? is the same thing :S what's the point?

[@Beachcasts]

By implementing the ELB it gave me access to also use WAF to protect against common attacks. Not to mention removing the need for public IP on EC2 instances.

[@comarkmaloba]

If you are using a debian OS in the EC2 instance, you can run a cronjob for LetsEncrypt to run every 3 months, needs some terminal intervention.

[@Beachcasts]

That is exactly what I need. Any resources you can point me to?

[@moonferoc7098]

I did, but it's not enabling port 443 for my instance. The link to my instance is still unsecured. Please help!

[@Beachcasts]

Hope you've figured this out since then. Thanks for watching.

[@chrisjordanaliac8026]

Great and Informative video. I have a question: how do you tie in autoscaling with the load balancer? im a newbie at this

[@Beachcasts]

Great question. I'll hold onto this for future content. Thank you.

[@sabuein]

Thank you very much.

[@Beachcasts]

You're welcome. Thanks for watching.

[@MrSSRao22]

Hi, Thank you for the tutorial. Was very helpgul. I am new to web hosting and trying to learn it. I setup my SSL and Load Balancer in the same as shown in the tutorial, I get a 502 Bad Gateway error. When I try without the load balancer it works fine without https. I saw in the comments that you had mentioned to look at server logs. By server logs do you mean I have to setup server access logs. Thanks in advance.

[@rathore354]

put / only

[@Beachcasts]

Server logs (like Apache) will show the responses, so you can see how your server is reacting to the health checks. Maybe it is sending 302 redirects, or something else. You can also customize the health check to look for a specific file "/index.html" for instance.

[@fvdstone]

Why do you use a Let's Encrypt certificate? Aren't public certificates in ACM free? And why do you encrypt the traffic between the load balancer and your server instance? Woudn't it be enough to just let the load balancer terminate HTTPS and reach your backend server via http/80?

[@Beachcasts]

Thanks for sharing. Yes, you are correct, no need in most cases to encrypt traffic between the load balancer than server. I have a project where I use Let's Encrypt for other things, so wanted to carry it over to the load balancer. Othewise, not really needed.

[@sasogeek]

If I'm not using Route53, how do I point my dns to the load balancer correctly? (can't set it as an A record)

[@hamiltonvera4151]

every load balancer creates an endpoint, you have to use CNAME in your DNS

[@Beachcasts]

There are other DNS providers that also allow ALIAS types, but I don't know of any. I see another commenter mentioned CNAME, but I'm not sure if that will work for zone roots.

[@sasogeek]

Beachcasts Programming Videos The CNAME worked, turns out the reason the routing didn't appear to work was because I had set the lb and instance to have the same security group, but I had to give them different security groups and allow traffic to the instance only from the security group that the load balancer had since I didn't want to expose the instance itself to the world.

[@Beachcasts]

@@sasogeek Thanks for sharing!

[@annaishmukhametova]

instrad of A record use CNAME?

[@CoolBishop1997]

thank you for the video sir

[@Beachcasts]

Most welcome

[@orrlevinger]

im totaly confused with the Security groups allocations once you call it the load balancer SG and a second later you call it the instance security group.. you name it LBsecurity group but assign it to the load balancer.. every thing else is amazing but i lost you at the security grouping :(

[@Beachcasts]

Sorry about that. I was also struggling with it at the time. I should do a follow-up video to more thoroughly explain that portion. I've added it to my pending video list. ;-)

[@cultclassic999]

Great tutorial! Thanks!

[@Beachcasts]

Glad you found it helpful. Thank you.

[@jpsaroud]

Thank you very much!

[@Beachcasts]

You're welcome!

[@Tux0xFF]

That t-shirt is awesome

[@Beachcasts]

Thanks for that. I need to add it to the merch merch.streamelements.com/beachcasts

[@info662]

Thank you for the informative video. Is it possible to also redirect from www.domain.com to domain.com? I have a Fargate Setup, Loadbalancer, etc.

[@info662]

I found out how, thank you anyways :)

[@Beachcasts]

Thank you for the added question.

[@Beachcasts]

Glad you figured it out. Thank you.

[@dashcamspotted887]

Please make a tutorial of ALB and NLB so that I would get a static IP address. Because ELB is dynamic IP address.

[@Beachcasts]

Great ideas! Thank you.

[@emax83]

Thank for your video, you did many trick that other tutorials skip. Thanks, but.. i still cannot use SSL, i followed any step but nothing to do.. I have EC2 Windows with IIS, configured loadbalancer, listners, sec group but still nothing HTTPS, the TargetGroup for 443 it's unhealthy.. i really don't know what to do with AWS.. many other provideres need only one click to enable ssl/https.. amazon aws need hours of configuration...

[@Beachcasts]

Try looking in the server logs of your EC2 instance. Often you can find the reason there. Often it is a bad route, or some small missing thing in the checks. Good luck.

[@paulhanrahan6728]

Very helpful. Just have to fix the 503 error now.

[@Beachcasts]

Thanks for watching. Did you figure out the issue? I found that 503 happened most times from routing issues. I had to specify 'index.php' in my case for the app to resolve in quality tests.

[@paulhanrahan6728]

@@Beachcasts I did. A simple error on my part.

[@Beachcasts]

@@paulhanrahan6728 Thanks for the update.

[@exalandconcept]

Thanks for this tutorial :) i like it

[@Beachcasts]

Happy you found it useful. Thank you for watching.

[@Constantine769]

Thank you!

[@Beachcasts]

Very welcome.

[@TheSkipinder]

Thank a lot! This helped immensely.

[@Beachcasts]

Glad it helped!

[@rmuchala]

I did everything in the video, but I cannot get to my site at the end of it. - I get 502 Bad gateway

[@Beachcasts]

Take a look at your website logs and see if the checks are hitting it. Might shed light on the fails.

[@rmuchala]

no It is not even hitting it. I get bad gateway. 502.

[@dannymason3970]

@@rmuchala Did you resolve this issue? I have just followed the guide and have the same problem :/ There is nothing complex about my EC2 instance. It is a simple website created in Elastic Beanstalk and dns for the friendly domain managed in Route53.

[@rlee431]

@@rmuchala I would go through the checklist. Try another browser and/or clear your cache and try reloading. I hope this helps.

[@orlandogunman509]

I was expecting you to test the access and show that it was blocked e.g., to see if what you did worked.

[@Beachcasts]

Originally I did do that while recording, but removed it because the quality of the section was not as expected. Decided not to re-record. ;-)

[@LordLazaruss]

I got to the point of creating a certificate and then got stuck because i don't have my domain.

[@Beachcasts]

Yes, a domain is needed for the cert.

[@TheBanker1710]

Hi, thanks a lot for this very helpful video. After configuring my Load Balancer, I got a 504 error to reach my web application under IIS turning on port 1004. I create a target group on port 1004 and I made a rule to redirect my domain devtf.profilegroup.com (which is redirected by CNAME to my load balancer) to my specific target group 1004, why did I make wrong? Thanks for your help. :-)

[@Beachcasts]

The load balancer doesn't really care what web server you are using. It simply forwards the port based on the Target you set up in the load balancer. Make sure your security groups are configured correctly.

[@TheBanker1710]

@@Beachcasts Thanks a lot for your answer. I finnaly found the issue, I had to open the ports on the server in the Windows firewall. :-)

[@annaishmukhametova]

@@Beachcasts can you explain why we in security group load balancer added another sg-..52e ID sg ?

[@ezequiel_lopez]

thanks a lot!

[@Beachcasts]

You're welcome! Thank you for watching.

[@rameshkhadka5681]

Sweet. Thnx

[@Beachcasts]

You bet!

[@zzSoloo]

Just lol at fresh getting finessed

[@Beachcasts]

Glad you found it helpful.

[@zabagar]

Would prefer to see a load balancer setup to 2 endpoints not a single machine. There’s no load balancing if you only have 1 machine in the pool.

[@Beachcasts]

Fully agree. It was a missed opportunity to include that in the video. However, I hope folks watching go the next step.

[@rathore354]

Dear Sir AWS load balancer i watched 100 time from different tutor but what deep things you explain no one had explained . request you at least come with one video per month for AWS

[@Beachcasts]

I like this idea. Thank you. Stay tuned.

[@luckeyzlion]

It lucks demo. The tutorial would be completed if you show us what the end result is.

[@Beachcasts]

Thank you. I agree, this video could have been more complete. I'm thinking of creating a new one with what I've learned since then, as well.

[@barronanderson7867]

I had a hard time following this instructional video. Perhaps providing a summary of the activities before starting would be helpful. I felt like we bounced around and I couldn't keep track of what we were trying to achieve. It's clear you know what you are doing and what you want to achieve. The challenge is translating that to people who are unfamiliar with the topic.

[@Beachcasts]

Thank you Barron. It was indeed a challenging topic I'd leaned mere hours before creating the video. Thanks for the feedback.

[@markcuello5]

HELP

[@achraffahmi7083]

😃😃😃

[@Beachcasts]

Thanks.

[@Broadberryinc]

Too confusing

[@Beachcasts]

It can be. I've thought about creating a newer version of this, that is a little more simple. I've learned much more since creating this video.