32 votes

Nginx Solution for AWS Amazon ELB Health Checks - return 200 without IF

Just to improve on the above answer, which is correct. The following works great: location /elb-status { access_log off; return 200 'A-OK!'; # because default content-type is application/...
  • 421
23 votes

Endless Redirect Loop with AWS ELB and wordpress site using wordpress https plugin

Try adding this to your httpd.conf or an .htaccess SetEnvIfNoCase X-FORWARDED-PROTO "^https$" HTTPS When using the load balancer + HTTPS, your webserver is unaware that HTTPS is being used on the ...
22 votes

2 ELBs (ALBs) to 1 target group, possible?

I'm not sure if you can point two ALBs to a single TargetGroup. However since you mentioned AutoScaling you can have the ASG instances automatically registered in more than one TargetGroups, therefore ...
  • 24.2k
22 votes
Accepted

AWS recommends 54 t2.nano EC2 instances instead of one m5.xlarge

There's a couple of things to understand: Reserved Instances are just a billing construct. AWS will try to match the purchased reserved instances against your running instances at the billing time. I....
  • 24.2k
18 votes

Nginx set_real_ip_from AWS ELB load balancer address

Today's best practice is to use VPC, so, then, you will know the exact CIDR for your ELB. Then, you can add something like this to your Nginx configuration file: real_ip_header X-Forwarded-For; ...
  • 281
17 votes
Accepted

Possible to log X-FORWARDED-FOR to nginx error_log?

You should be using the real IP module, so that the client's actual IP address is considered the remote IP address, rather than your load balancer's IP address. This way, you won't have to check X-...
16 votes
Accepted

Redirect loop when forcing HTTPS

Thanks to HBruijn's comment, I understood why I was getting the redirect loop. The traffic from the ELB will always be HTTP as it handles the HTTPS traffic to the user but to the server it's HTTP, so ...
  • 1,469
16 votes
Accepted

The site is using outdated security settings that may prevent future versions of Chrome from being able to safely access it

Your certificate is using the outdated SHA-1 algorithm, which because of security risks Google Chrome now warns about. http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html ...
  • 32.7k
15 votes

Redirect all http requests behind Amazon ELB to https without using if

Setup your AWS ELB mapping ELB:80 to instance:80 and ELB:443 to instance:1443. Bind nginx to listen on port 80 and 1443. Forward requests arriving at port 80 to port 443. Health check should be HTTP:...
15 votes

How to redirect HTTP to HTTPS on AWS Application Load Balancer?

As of July 2018, this is supported on application load balancers. Add/Edit your HTTP:80 listener Set the action to Redirect protocol: https port: 443 set the next dropdown to Original host, path, ...
  • 151
14 votes

Setting Up ELB with SSL - What is Backend Authentication?

The previous answer is not 100% accurate. What back-end authentication ACTUALLY does is ensure that the public-key your backend server reports (when ELB is talking to your server over HTTPS/SSL) ...
14 votes

Can't get Network Solutions Certificate chain working with EC2 Elastic Load Balancer

Please make sure that whether your certificate chain contains the intermediate and Root certificates in the proper order. The best way to analyze the problem with the chain certificate I was found ...
14 votes
Accepted

AWS Fargate + Application Load Balancer SSL Termination

Yes it is possible. Create a SSL certificate for your domain in ACM (Amazon Certificate Manager). Create a HTTPS Listener in the ALB that will listen on port 443 and configure it to use the above ...
  • 24.2k
13 votes
Accepted

Can I use the new free SSL/TLS AWS certificates without ELB or Beanstalk on plain EC2?

Q: Can I use certificates on Amazon EC2 instances or on my own servers? No. At this time, certificates provided by ACM can only be used with specific AWS services. Q: With which AWS ...
11 votes

Nginx set_real_ip_from AWS ELB load balancer address

Use the VPC CIDR for set_real_ip_from You can find it in Amazon console under VPC => Your VPC (replace <your VPC CIDR here> with it): real_ip_header X-Forwarded-For; set_real_ip_from <your ...
11 votes

Amazon ELB HTTPS Not working

Don't forget to allow port 443 in the security group. That's what was causing it to timeout for me. If you're using Elastic Beanstalk (EBS), you should tweak SSL settings directly in EBS config and ...
  • 211
10 votes
Accepted

How to set up ELB health checks with multiple applications running on each EC2 instance?

Here are two ways to solve this; First option is to add another health check on the host that validates the health and returns HTTP 200s to the ELB if the logic says that you want to keep the host ...
  • 711
9 votes

Amazon CloudFormation: How to get an ELB's private IP for a specific subnet?

If you want to get the private ip address of an elb, check network interfaces under network and security in you ec2 dashboard.
9 votes

Redirect all http requests behind Amazon ELB to https without using if

This solution uses conditional logic, but as the accepted answer suggests, I also think this is ok. Ref: https://stackoverflow.com/questions/4833238/nginx-conf-redirect-multiple-conditions Also, ...
9 votes
Accepted

Whitelist Elastic Load Balancer based on IP

Is there any common method to provide people the pool of IP addresses my ELB uses? Yes, ELB is is built upon EC2 and AWS publishes a list of all public IP ranges in use by specific regions. It ...
  • 1,849
9 votes
Accepted

Retrieve clients geolocation info from AWS ELB?

ELB does not offer this capability. Cloudfront, however, does. Amazon CloudFront Adds Device Detection, Geo Targeting, Host Header Forwarding, CORS Support, and more! You could use CloudFront in ...
9 votes
Accepted

How to log original value of $remote_addr when using Real-IP

You can get the original client address of the connecting ELB in the variable $realip_remote_addr, but be aware that this variable was only added in nginx 1.9.7, so you'll need to be running a very ...
8 votes

how to forward godaddy domain to ec2 load balancer

In addition to the accepted answer, another option is to create an AWS hosted zone in AWS Route 53 following the steps below: Sign in to the AWS Management Console and open the Amazon Route 53 ...
  • 181
8 votes
Accepted

Can't get Network Solutions Certificate chain working with EC2 Elastic Load Balancer

I just ended up working this out, the correct order for the certificate chain is as follows: OV_NetworkSolutionsOVServerCA2 OV_USERTrustRSACertificationAuthority AddTrustExternalCARoot Good luck!
8 votes
Accepted

How does nginx distribute traffic among IPs associated with an upstream DNS name?

Please note that nginx 1.1.19 is a development version that went out 3+ years ago. As a good sysadmin, nothing of this kind should go live in your business. Let's focus on your actual question now. ...
  • 12.9k
8 votes

Is it possible to show a static page if all ELB registered instances are down?

You have a couple options I can think of: Put AWS's Cloudfront CDN in front of your ELB, and customize the error response for 503 errors. Details on how to do that are in the AWS docs and it can be ...
  • 32.7k
7 votes

How to set up ELB health checks with multiple applications running on each EC2 instance?

Using one ELB per app is the way to go here. First, you may need them anyway if each application is on it's own domain and you need to support SSL. Amazon ELBs currently only allow one SSL ...
7 votes

Get AWS ELB name from an attached instance

If anybody comes here looking for a pure bash solution. Using jq to filter and parse the response of AWS CLI : aws elb describe-load-balancers | jq -r '.LoadBalancerDescriptions[] | select(....
7 votes

Amazon CloudFormation: How to get an ELB's private IP for a specific subnet?

JQ parsing version, just FYI. aws ec2 describe-network-interfaces --filters "Name=description,Values=ELB your-elb-name" --output json | jq ".NetworkInterfaces[].PrivateIpAddresses[].PrivateIpAddress"
7 votes
Accepted

VPC public subnet internet access with ELB hooked up

You're missing a point, here. It a machine has a public IP, it goes in a public subnet and uses the IGW as its default route. If it doesn't have a public IP, it goes in a private subnet and uses a ...

Only top scored, non community-wiki answers of a minimum length are eligible