Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Edit attributes for your Network Load Balancer

After you create a Network Load Balancer, you can edit its attributes.

Deletion protection

To prevent your Network Load Balancer from being deleted accidentally, you can enable deletion protection. By default, deletion protection is disabled for your Network Load Balancer.

If you enable deletion protection for your Network Load Balancer, you must disable it before you can delete the Network Load Balancer.

Console

To enable or disable deletion protection

1. Open the Amazon EC2 console at https://console.amazonaws.cn/ec2/.

2. In the navigation pane, choose Load Balancers.

3. Select the name of the Network Load Balancer to open its details page.

4. On the Attributes tab, choose Edit.

5. Under Protection, enable or disable Deletion protection.

6. Choose Save changes.

Amazon CLI

To enable or disable deletion protection

Use the modify-load-balancer-attributes command with the deletion_protection.enabled attribute.

aws elbv2 modify-load-balancer-attributes \
    --load-balancer-arn load-balancer-arn \
    --attributes "Key=deletion_protection.enabled,Value=true"

CloudFormation

To enable or disable deletion protection

Update the AWS::ElasticLoadBalancingV2::LoadBalancer resource to include the deletion_protection.enabled attribute.

Resources:
  myLoadBalancer:
    Type: 'AWS::ElasticLoadBalancingV2::LoadBalancer'
    Properties:
      Name: my-nlb
      Type: network
      Scheme: internal
      Subnets: 
        - !Ref subnet-AZ1
        - !Ref subnet-AZ2
      SecurityGroups: 
        - !Ref mySecurityGroup
      LoadBalancerAttributes: 
        - Key: "deletion_protection.enabled"
          Value: "true"

Cross-zone load balancing

With Network Load Balancers, cross-zone load balancing is off by default at the load balancer level, but you can turn it on at any time. For target groups, the default is to use the load balancer setting, but you can override the default by explicitly turning cross-zone load balancing on or off at the target group level. For more information, see Cross-zone load balancing for target groups.

Console

To enable or disable cross-zone load balancing for a load balancer

1. Open the Amazon EC2 console at https://console.amazonaws.cn/ec2/.

2. In the navigation pane, under Load Balancing, choose Load Balancers.

3. Select the name of the load balancer to open its details page.

4. On the Attributes tab, choose Edit.

5. On the Edit load balancer attributes page, turn Cross-zone load balancing on or off.

6. Choose Save changes.

Amazon CLI

To enable or disable cross-zone load balancing for a load balancer

Use the modify-load-balancer-attributes command with the load_balancing.cross_zone.enabled attribute.

aws elbv2 modify-load-balancer-attributes \
    --load-balancer-arn load-balancer-arn \
    --attributes "Key=load_balancing.cross_zone.enabled,Value=true"

CloudFormation

To enable or disable cross-zone load balancing for a load balancer

Update the AWS::ElasticLoadBalancingV2::LoadBalancer resource to include the load_balancing.cross_zone.enabled attribute.

Resources:
  myLoadBalancer:
    Type: 'AWS::ElasticLoadBalancingV2::LoadBalancer'
    Properties:
      Name: my-nlb
      Type: network
      Scheme: internal
      Subnets: 
        - !Ref subnet-AZ1
        - !Ref subnet-AZ2
      SecurityGroups: 
        - !Ref mySecurityGroup
      LoadBalancerAttributes: 
        - Key: "load_balancing.cross_zone.enabled"
          Value: "true"

Availability Zone DNS affinity

When using the default client routing policy, requests sent to your Network Load Balancers DNS name will receive any healthy Network Load Balancer IP addresses. This leads to the distribution of client connections across the Network Load Balancer's Availability Zones. With the Availability Zone affinity routing policies, client DNS queries favor Network Load Balancer IP addresses in their own Availability Zone. This helps improve both latency and resiliency, as clients do not need to cross Availability Zone boundaries when connecting to targets.

Availability Zone affinity routing policies only apply to clients resolving the Network Load Balancers DNS name using Route 53 Resolver. For more information, see What is Amazon Route 53 Resolver? in the Amazon Route 53 Developer Guide

Availability Zone affinity helps route requests from the client to the Network Load Balancer, while cross-zone load balancing is used to help route requests from the Network Load Balancer to the targets. When using Availability Zone affinity, cross-zone load balancing should be turned off, this ensures the Network Load Balancer traffic from clients to targets remains within the same Availability Zone. With this configuration, client traffic is sent to the same Network Load Balancer Availability Zone, so it's recommended to configure your application to scale independently in each Availability Zone. This is an important consideration when the number of clients per Availability zone, or the traffic per Availability Zone are not the same. For more information, see Cross-zone load balancing for target groups.

When an Availability Zone is considered unhealthy, or when a zonal shift is started, the zonal IP address will be considered unhealthy and not returned to clients unless fail open is in effect. Availability Zone affinity is maintained when the DNS record fails open. This helps keep Availability Zones independent and prevent potential cross zone failures.

When using Availability Zone affinity, times of imbalance between Availability Zones are expected. It's recommended ensuring your targets are scaling at the zonal level, to support each Availability Zones workload. In cases where these imbalances are significant, it's recommended turning off Availability Zone affinity. This allows even distribution of client connections between all the Network Load Balancer's Availability Zones within 60 seconds, or the DNS TTL.

Monitoring

It is recommended to track the distribution of connections between Availability Zones, using the zonal Network Load Balancer metrics. You can use metrics to view the number of new and active connections per zone.

We recommend tracking the following:

For more information, see CloudWatch metrics for your Network Load Balancer

Enable Availability Zone affinity

Console

To enable Availability Zone affinity

1. Open the Amazon EC2 console at https://console.amazonaws.cn/ec2/.

2. In the navigation pane, choose Load Balancers.

3. Select the name of the Network Load Balancer to open its details page.

4. On the Attributes tab, choose Edit.

5. Under Availability Zone routing configuration, Client routing policy (DNS record), select Availability Zone affinity or Partial Availability Zone affinity.

6. Choose Save changes.

Amazon CLI

To enable Availability Zone affinity

Use the modify-load-balancer-attributes command with the dns_record.client_routing_policy attribute.

aws elbv2 modify-load-balancer-attributes \
    --load-balancer-arn load-balancer-arn \
    --attributes "Key=dns_record.client_routing_policy,Value=partial_availability_zone_affinity"

CloudFormation

To enable Availability Zone affinity

Update the AWS::ElasticLoadBalancingV2::LoadBalancer resource to include the dns_record.client_routing_policy attribute.

Resources:
  myLoadBalancer:
    Type: 'AWS::ElasticLoadBalancingV2::LoadBalancer'
    Properties:
      Name: my-nlb
      Type: network
      Scheme: internal
      Subnets: 
        - !Ref subnet-AZ1
        - !Ref subnet-AZ2
      SecurityGroups: 
        - !Ref mySecurityGroup
      LoadBalancerAttributes: 
        - Key: "dns_record.client_routing_policy"
          Value: "partial_availability_zone_affinity"

Secondary IP addresses

If you experience port allocation errors and you can't add targets to the target group to resolve them, you can add secondary IP addresses to the load balancer network interfaces. For each zone where the load balancer is enabled, we select IPv4 addresses from the load balancer subnet and assign them to the corresponding network interface. These secondary IP addresses are used to establish connections with targets. They are also used for health check traffic. We recommend that you add one secondary IP address to start with, monitor the PortAllocationErrors metric, and add another secondary IP address only if the port allocation errors are not resolved.

Console

To add a secondary IP address

1. Open the Amazon EC2 console at https://console.amazonaws.cn/ec2/.

2. In the navigation pane, choose Load Balancers.

3. Select the name of the Network Load Balancer to open its details page.

4. On the Attributes tab, choose Edit.

5. Expand Special case attributes, unlock the Secondary IP addresses auto assigned per subnet attribute, and choose the number of secondary IP addresses.

6. Choose Save changes.

Amazon CLI

To add a secondary IP address

Use the modify-load-balancer-attributes command with the secondary_ips.auto_assigned.per_subnet attribute.

aws elbv2 modify-load-balancer-attributes \
    --load-balancer-arn load-balancer-arn \
    --attributes "Key=secondary_ips.auto_assigned.per_subnet,Value=1"

You can use the describe-network-interfaces command to get the IPv4 addresses for the load balancer network interfaces. The --filters parameter scopes the results to the network interfaces for Network Load Balancers and the --query parameter further scopes the results to the load balancer with the specified name and displays only the specified fields. You can include additional fields as needed.

aws elbv2 describe-network-interfaces \
    --filters "Name=interface-type,Values=network_load_balancer" \
    --query "NetworkInterfaces[?contains(Description,'my-nlb')].{ID:NetworkInterfaceId,AZ:AvailabilityZone,Addresses:PrivateIpAddresses[*]}"

CloudFormation

To add a secondary IP address

Update the AWS::ElasticLoadBalancingV2::LoadBalancer resource to include the secondary_ips.auto_assigned.per_subnet attribute.

Resources:
  myLoadBalancer:
    Type: 'AWS::ElasticLoadBalancingV2::LoadBalancer'
    Properties:
      Name: my-nlb
      Type: network
      Scheme: internal
      Subnets: 
        - !Ref subnet-AZ1
        - !Ref subnet-AZ2
      SecurityGroups: 
        - !Ref mySecurityGroup
      LoadBalancerAttributes: 
        - Key: "secondary_ips.auto_assigned.per_subnet"
          Value: "1"