Deploy Elastic Load Balancing in Amazon VPC

If your AWS account comes with a default virtual private cloud (default VPC), your instances are launched within the default VPC, by default, unless you specify a subnet from a nondefault VPC. For more information, see Detecting Your Supported Platforms and Whether You Have a Default VPC.

A default VPC combines the benefits of the advanced networking features provided by Amazon VPC platform (EC2-VPC) with the ease of use of the Amazon Elastic Compute Cloud platform (EC2-Classic).

Your default VPC automatically comes with a default subnet in each Availability Zone, an Internet Gateway connected to your default VPC, and a default security group associated with your default VPC, among other default configurations. For more information on default VPC and Subnets, see Your Default VPC and Subnets.

When you launch your EC2 instances within default VPC without specifying a subnet, it is automatically launched into a default subnet in your default VPC. By default, we select an Availability Zone for you and launch the instance into the corresponding subnet for that Availability Zone. Alternatively, you can select the Availability Zone for your instance by selecting its corresponding default subnet.

To load balance your EC2 instances launched in default VPC, you have to create your load balancers within your default VPC. When you create a load balancer within default VPC, Elastic Load Balancing automatically creates a security group by defining the ports specified for the load balancer to be opened.

If you are using the AWS Management Console to create your load balancer with default VPC, you can choose the default VPC security group associated with your default VPC, choose any other pre-existing security group associated with your AWS account, or modify the existing security group to create a new one. If you choose a non-default pre-existing security group, ensure that it allows ingress to the ports that you configured the load balancer to use. If you choose to create a security group, the console will define these ports to be open for you.

The security group you create using the AWS Management Console is associated with your load balancer. You cannot delete the security group as long as it is associated with a load balancer.

If you are using the Elastic Load Balancing command line interface (CLI) or the Query API to create your load balancer within your default VPC, a default security group; default_elb_special number will be created for 0.0.0.0/0 with the ports specified for the load balancer. Currently, Elastic Load Balancing does not support the option to choose a security group to associate with your load balancer when you use either the CLI or the Query API.

A security group created for your load balancer within default VPC using either the CLI or the Query API is associated with your AWS account. Only one security group will be created per AWS account. Subsequent calls to create new load balancers will re-use the same security group. If you add listeners to an existing load balancer, you will need to review the security groups that are applied to the load balancer; otherwise, traffic may not reach the load balancer. If you create a load balancer that uses this default security group and the new load balancer has a different listener configuration, you will need to review and update the security groups that are applied to the load balancer.

If you are using the CLI to create a load balancer for your EC2 instances in default VPC, you can see the security group associated with your load balancer by using the -show-long option with elb-describe-lbs command. The load balancer security group is listed as SOURCE_SECURITY_GROUP in the CLI output and the query response. This security group can be used to limit ingress to your instance from only the selected security group.

Whether you are using the console, CLI, or the Query API, if you update the listeners of your load balancer within default VPC, the security groups associated with the load balancer will not change. If you delete your load balancer, the security group will not be deleted automatically.

For information on creating a basic load balancer for your EC2 instances within default VPC, see Create a Basic Load Balancer in Default VPC.

You can make your load balancer internal (private) or Internet-facing (public) when creating it within a VPC. When you make your load balancer internal, a DNS name will be created, and it will contain the private IP address of the load balancer. Internal load balancer is not exposed to the internet. When you make your load balancer Internet-facing, a DNS name will be created with the public IP address. The DNS records are publicly resolvable in both cases.

By combining both internal and internet-facing load balancers, you can balance requests between multiple tiers of your application. For example, let us say you have web servers at your front-end that takes requests from the internet and passes it on to your back-end application instances. You can create an internal load balancer in your VPC and then place your back-end application instances behind the internal load balancer. You can create an internet-facing load balancer with the DNS name and public IP address and place it in front of your web server. Your web server will take requests coming from the internet-facing load balancer and will make requests to the internal load balancer, using private IP addresses that are resolved from the internal load balancer’s DNS name. The internal load balancer will route requests to the back-end application instances, which are also using private IP addresses and only accept requests from the internal load balancer. With this multi-tier architecture, all your infrastructure can use private IP addresses and security groups so that the only part of your architecture that has public IP address is the internet-facing load balancer.

For a load balancer to be Internet-facing, the load balancer must reside in a public subnet (with public IP addresses). The application instances behind the load balancer do not need to be in the public subnets.

The following diagram shows Elastic Load Balancing within Amazon VPC combining both Internet-facing and internal load balancers.

To create and use Elastic Load Balancing load balancers within Amazon VPC, you have to first configure your VPC environment. This section provides you with steps you can use to configure your VPC. If you are using default VPC, your VPC environment is automatically configured for you. You can skip this step.

You've now completed creating your VPC environment for your load balancers. Next, click any one of the following sections to create and manage your load balancer within your Amazon VPC.