Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Edit target group attributes for your Network Load Balancer

After you create a target group for you Network Load Balancer, you can edit its target group attributes.

Client IP preservation

Network Load Balancers can preserve the source IP address of clients when routing requests to backend targets. When you disable client IP preservation, the source IP address is the private IP address of the Network Load Balancer.

By default, client IP preservation is enabled (and can't be disabled) for instance and IP type target groups with UDP and TCP_UDP protocols. However, you can enable or disable client IP preservation for TCP and TLS target groups using the preserve_client_ip.enabled target group attribute.

To enable or disable client IP preservation using the Amazon CLI

Use the modify-target-group-attributes command with the preserve_client_ip.enabled attribute.

For example, use the following command to disable client IP preservation.

aws elbv2 modify-target-group-attributes --attributes Key=preserve_client_ip.enabled,Value=false --target-group-arn ARN

Your output should be similar to the following example.

{
    "Attributes": [
      {
        "Key": "proxy_protocol_v2.enabled", 
        "Value": "false"
      }, 
      {
        "Key": "preserve_client_ip.enabled", 
        "Value": "false" 
      },
      {
        "Key": "deregistration_delay.timeout_seconds", 
        "Value": "300"
      } 
    ]
}

Deregistration delay

When a target is deregistered, the load balancer stops creating new connections to the target. The load balancer uses connection draining to ensure that in-flight traffic completes on the existing connections. If the deregistered target stays healthy and an existing connection is not idle, the load balancer can continue to send traffic to the target. To ensure that existing connections are closed, you can do one of the following: enable the target group attribute for connection termination, ensure that the instance is unhealthy before you deregister it, or periodically close client connections.

The initial state of a deregistering target is draining, during which the target will continue to receive new connections. By default, the load balancer changes the state of a deregistering target to unused after 300 seconds. To change the amount of time that the load balancer waits before changing the state of a deregistering target to unused, update the deregistration delay value. We recommend that you specify a value of at least 120 seconds to ensure that requests are completed.

If you enable the target group attribute for connection termination, connections to deregistered targets are closed shortly after the end of the deregistration timeout.

To update the deregistration attributes using the Amazon CLI

Use the modify-target-group-attributes command.

Proxy protocol

Network Load Balancers use proxy protocol version 2 to send additional connection information such as the source and destination. Proxy protocol version 2 provides a binary encoding of the proxy protocol header. With TCP listeners, the load balancer prepends a proxy protocol header to the TCP data. It does not discard or overwrite any existing data, including any incoming proxy protocol headers sent by the client or any other proxies, load balancers, or servers in the network path. Therefore, it is possible to receive more than one proxy protocol header. Also, if there is another network path to your targets outside of your Network Load Balancer, the first proxy protocol header might not be the one from your Network Load Balancer.

If you specify targets by IP address, the source IP addresses provided to your applications depend on the protocol of the target group as follows:

If you specify targets by instance ID, the source IP addresses provided to your applications are the client IP addresses. However, if you prefer, you can enable proxy protocol and get the client IP addresses from the proxy protocol header.

Health check connections

After you enable proxy protocol, the proxy protocol header is also included in health check connections from the load balancer. However, with health check connections, the client connection information is not sent in the proxy protocol header.

VPC endpoint services

For traffic coming from service consumers through a VPC endpoint service, the source IP addresses provided to your applications are the private IP addresses of the load balancer nodes. If your applications need the IP addresses of the service consumers, enable proxy protocol and get them from the proxy protocol header.

The proxy protocol header also includes the ID of the endpoint. This information is encoded using a custom Type-Length-Value (TLV) vector as follows.

For an example that parses TLV type 0xEA, see https://github.com/aws/elastic-load-balancing-tools/tree/master/proprot.

Enable proxy protocol

Before you enable proxy protocol on a target group, make sure that your applications expect and can parse the proxy protocol v2 header, otherwise, they might fail. For more information, see PROXY protocol versions 1 and 2.

To enable proxy protocol v2 using the Amazon CLI

Use the modify-target-group-attributes command.

Sticky sessions

Sticky sessions are a mechanism to route client traffic to the same target in a target group. This is useful for servers that maintain state information in order to provide a continuous experience to clients.

To enable sticky sessions using the Amazon CLI

Use the modify-target-group-attributes command with the stickiness.enabled attribute.

Cross-zone load balancing for target groups

The nodes for your load balancer distribute requests from clients to registered targets. When cross-zone load balancing is on, each load balancer node distributes traffic across the registered targets in all registered Availability Zones. When cross-zone load balancing is off, each load balancer node distributes traffic across only the registered targets in its Availability Zone. This could be used if zonal failure domains are preferred over regional, ensuring that a healthy zone isn't impacted by an unhealthy zone, or for overall latency improvements.

With Network Load Balancers, cross-zone load balancing is off by default at the load balancer level, but you can turn it on at any time. For target groups, the default is to use the load balancer setting, but you can override the default by explicitly turning cross-zone load balancing on or off at the target group level.

Modify cross-zone load balancing for a load balancer

You can turn cross-zone load balancing on or off at the load balancer level at any time.

To modify cross-zone load balancing for your load balancer using the Amazon CLI

Use the modify-load-balancer-attributes command with the load_balancing.cross_zone.enabled attribute.

Modify cross-zone load balancing for a target group

The cross-zone load balancing setting at the target group level overrides the setting at the load balancer level.

You can turn cross-zone load balancing on or off at the target group level if the target group type is instance or ip. If the target group type is alb, the target group always inherits the cross-zone load balancing setting from the load balancer.

To modify cross-zone load balancing for a target group using the Amazon CLI

Use the modify-target-group-attributes command with the load_balancing.cross_zone.enabled attribute.

Connection termination for unhealthy targets

Connection termination is enabled by default. When the target of a Network Load Balancer fails the configured health checks and is deemed unhealthy, the load balancer terminates established connections and stops routing new connections to the target. With connection termination disabled the target is still considered unhealthy and won't receive new connections, but established connections are kept active, allowing them to gracefully close.

Connection termination for unhealthy targets can be set individually for each target group.

To modify the connection termination setting using the Amazon CLI

Use the modify-target-group-attributes command with the target_health_state.unhealthy.connection_termination.enabled attribute.

Unhealthy draining interval

Targets in the unhealthy.draining state are considered unhealthy, do not receive new connections, but retain established connections for the configured interval. The unhealthy connection interval determines the amount of time the target remains in the unhealthy.draining state before it's state becomes unhealthy. If the target passes health checks during the unhealthy connection interval, it's state becomes healthy again. If a deregistration is triggered, the targets state becomes draining and the deregistration delay timeout begins.

The unhealthy draining interval can be set individually for each target group.

To modify the unhealthy draining interval using the Amazon CLI

Use the modify-target-group-attributes command with the target_health_state.unhealthy.draining_interval_seconds attribute.