The problem is two of my EC2 instances (ha proxy) need to bind a single virtual IP if I want to use keepalived, but they are not possible in EC2 as only a single instance can use a elastic IP at a given time, so it is not possible, right?


No. This is what Elastic Load Balancer is for, anyway.


Update 2021. You can use it. But you probably shouldn't. There is very little justification to do so now. The Elastic Load Balancer should do most of what most people would need.

The accepted answer is no longer true.

In general you should use the ELB. However you may find a rare need that the ELB can't fulfil and you'd prefer to use keepalived even though it goes against best practice.

Keepalived & VRRP works within an Amazon VPC. It does not work with ec2-classic.

With keepalived you use the notify or notify_master commands in keepalived.conf.

The notify script then calls the aws cli with disassociate-address and associate-address options to unbind and then bind the address, rather than through the VIP mechanism of keepalived itself. It works OK.

Here is an example notify script:


function die
    echo "${1-Died} at ${BASH_SOURCE[1]}:${FUNCNAME[1]} line ${BASH_LINENO[0]}."
    exit 1

function master
    # Check if an elastic IP is defined
    test -n "$EC2_EIP" || die 'elastic ip not defined'

    # Attempt to read the instance-id
    EC2_INSTANCE_ID="`wget -q -O - http://instance-data/latest/meta-data/instance-id || die \"wget instance-id has failed: $?\"`"
    test -n "$EC2_INSTANCE_ID" || die 'cannot obtain instance-id'

    if [ -z $EC2_REGION ]; then
        # Get the region if not set
        EC2_AVAIL_ZONE=`wget -q -O - http://instance-data/latest/meta-data/placement/availability-zone`
      EC2_REGION="`echo \"$EC2_AVAIL_ZONE\" | sed -e 's:\([0-9][0-9]*\)[a-z]*\$:\\1:'`"

    # Call into ec2. Make sure ec2 output
    echo "aws ec2 disassociate-address --public-ip $EC2_EIP --region=$EC2_REGION"
    /usr/bin/aws ec2 disassociate-address --public-ip $EC2_EIP --region=$EC2_REGION
    if [ $? -eq 0 ]; then
        echo "disassocate-address: success"

    echo "aws ec2 associate-address --public-ip $EC2_EIP --instance-id $EC2_INSTANCE_ID --region=$EC2_REGION"
    /usr/bin/aws ec2 associate-address --public-ip $EC2_EIP --instance-id $EC2_INSTANCE_ID --region=$EC2_REGION
    if [ $? -eq 0 ]; then
        echo "associate-address: success"

case $STATE in
        "MASTER") master
                  exit 0
        "BACKUP") exit 0
        "FAULT")  exit 0
        *)        echo "unknown state"
                  exit 1

For more detailed information and working examples visit the following links:

  • It's probably possible to hook it up on EC2, but the accepted answer is still correct that it's usually better to let the ELB handle this. – ceejayoz Feb 25 '16 at 2:46
  • There are some instances where the ELB is not the preferred choice. It is in most cases, but not in every situation. – hookenz Feb 25 '16 at 3:05
  • For example, ELB doesn't support the SPDY protocol. The point of my answer here is to show that it is now possible to use keepalived. Not that you should use it. – hookenz Feb 25 '16 at 22:20
  • Fair enough, have an upvote. :) – ceejayoz Feb 25 '16 at 22:21
  • In fact, SPDY is now supported. There would be little justification for using this. – hookenz Mar 26 '18 at 22:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.