2

I'm confused how the AWS load balancers work. I have a pretty simple setup...

I have a rest based API that needs to be exposed to the internet (port 80) via my load balancer. I only want the load balancer exposed to the internet traffic. I have a security group setup for my instance that restricts direct access to only my ipaddress for testing purposes.

The load balancer is not ip restricted on http, it just has port 80 open (with a listener to my api service on port 3001). The problem is that the load balancer cannot see my instance if I setup any ip restrictions on the instances in question. Once I remove those restrictions on my instances, the health checks start working and I can access the service through the load balancer. The problem with that is my instances now have ports open to the internet that I don't want.

Is there something additional I need to do to allow the load balancer to access my instances when using ip restrictions?

One final note, my health checks work fine until I add the instance-level ip restrictions so I know the health check is not the problem. I think if I added the load balancer's IP to my whitelist, it would work, but that ip is dynamic and not viable for this purpose.

4

1 回答 1

4

不要使用 IP 限制。

1) 选择您的 LB，选择Security选项卡并记下安全组 ID（类似于 sg-5555abb）。单击该 ID 进行编辑

2）当您编辑您的负载均衡器安全组时，仅添加一个允许规则：（HTTP TCP 80 0.0.0.0/0和/或 443，如果您需要它，但您明白了）。

3) 接下来转到您的实例的安全组。仅允许负载均衡器的安全组访问您在端口 3001: 上的实例Custom TCP Rule TCP 3001 sg-5555abb (my-load-balancer)。请注意，在Source字段中您没有输入 IP 地址/掩码，而是从步骤 1 输入的安全组 ID）

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html#security-group-rules

于 2016-07-25T18:30:37.627 回答