Menu
Elastic Load Balancing
Application Load Balancers

Security Groups for Your Application Load Balancer

You must ensure that your load balancer can communicate with registered targets on both the listener port and the health check port. Whenever you add a listener to your load balancer or update the health check port for a target group used by the load balancer to route requests, you must verify that the security groups associated with the load balancer allow traffic on the new port in both directions. If they do not, you can edit the rules for the currently associated security groups or associate different security groups with the load balancer.

The recommended rules depend on the type of load balancer (Internet-facing or internal).

Internet-facing Load Balancer

Inbound
Source Port Range Comment

0.0.0.0/0

listener

Allow all inbound traffic on the load balancer listener port

Outbound

Destination Port Range Comment

instance security group

instance listener

Allow outbound traffic to instances on the instance listener port

instance security group

health check

Allow outbound traffic to instances on the health check port

Internal Load Balancer

Inbound
Source Port Range Comment

VPC CIDR

listener

Allow inbound traffic from the VPC CIDR on the load balancer listener port

Outbound

Destination Port Range Comment

instance security group

instance listener

Allow outbound traffic to instances on the instance listener port

instance security group

health check

Allow outbound traffic to instances on the health check port

We also recommend that you allow inbound ICMP traffic to support Path MTU Discovery. For more information, see Path MTU Discovery in the Amazon EC2 User Guide for Linux Instances.

Update the Associated Security Groups

You can update the security groups associated with your load balancer at any time.

To update security groups using the console

  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

  2. On the navigation pane, under LOAD BALANCING, choose Load Balancers.

  3. Select the load balancer.

  4. On the Description tab, under Security, choose Edit security groups.

  5. To associate a security group with your load balancer, select it. To remove a security group from your load balancer, clear it.

  6. Choose Save.

To update security groups using the AWS CLI

Use the set-security-groups command.