Scenarios
To ensure normal communications between the load balancer and backend servers, you need to check the security group rules and firewall rules configured for the backend servers.
- Security group rules must allow traffic from the backend subnet where the load balancer resides to the backend servers. (By default, the backend subnet of a load balancer is the same as the subnet where the load balancer resides.) For details about how to configure security group rules, see Configuring Security Group Rules.
- Firewall rules are optional for subnets. If firewall rules are configured for the backend subnet of the load balancer, the firewall rules must allow traffic from the backend subnet of the load balancer to the backend servers. For details about how to configure rules, see Configuring Firewall Rules.
If Transfer Client IP Address is enabled for TCP or UDP listeners, firewall rules and security group rules will not take effect.
+ If the load balancer has Layer 4 listeners and IP as a Backend is disabled, firewall rules and security group rules will not take effect.
You can use access control to limit which IP addresses are allowed to access the listener. Learn how to configure Access Control.
Access Logging
Scenarios
ELB logs HTTP and HTTPS requests received by load balancers, including the time when the request was sent, client IP address, request path, and server response.
-With Log Tank Service (LTS), you can view logs of requests to load balancers at Layer 7 and analyze response status codes to quickly locate unhealthy backend servers.
- ELB displays operations data, such as access logs, on the LTS console. Do not transmit private or sensitive data through fields in access logs. Encrypt your sensitive data if necessary.
+With Log Tank Service (LTS), you can view logs of requests to load balancers at Layer 7 and analyze response status codes to quickly locate unhealthy backend servers.
+ - ELB displays operations data, such as access logs, on the LTS console. Do not transmit private or sensitive data through fields in access logs. Encrypt your sensitive data if necessary.
- Currently, access logging is not supported in the eu-nl region.
Notes and Constraints
- Access logs can be configured only for application (Layer 7) load balancers.
- The access logs do not contain requests whose return code is 400 Bad Request. This is because such requests do not comply with HTTP specification and cannot be processed properly.