Create and manage ALB instances - Server Load Balancer - Alibaba Cloud Documentation Center

Application Load Balancer (ALB) is a load balancing service that operates at the application layer (Layer 7). It provides powerful processing capabilities at the application layer and supports advanced forwarding rules. You can purchase an ALB instance to forward requests from clients to backend servers.

Create an instance

Planning and preparation

Account permissions: When you create an ALB instance for the first time, the system prompts you to create the AliyunServiceRoleForAlb service-linked role. This role authorizes ALB to access cloud resources, such as elastic network interfaces (ENIs), security groups, Elastic IP Addresses (EIPs), and Internet Shared Bandwidth instances.
Network preparation:
- You have created a Virtual Private Cloud (VPC) in the destination region.
- To ensure high availability, deploy the ALB instance in at least two zones if the region supports multiple zones. Ensure that at least one vSwitch is created in each zone that you plan to use.
IP address planning:
- An ALB instance is allocated three IP addresses from each specified vSwitch. This includes one virtual IP address (VIP) for public-facing services and two private IPs for communication with backend servers.
- To ensure that all elastic features of the ALB instance are available, we recommend that you reserve at least eight IP addresses in each vSwitch where the instance resides.
Security planning: To ensure proper communication between the ALB instance and backend services, if security policies, such as Alibaba Cloud security groups or other third-party security policies, are configured in the access path, you must allow traffic from the vSwitch CIDR block of the ALB instance in advance.

Console

Go to the Instances page of the ALB console and click Create ALB.
On the purchase page, complete the following configurations and click Buy Now.
- Region: We recommend that you select the region closest to your clients to reduce latency.
  For more information, see Regions and zones that support ALB features.
- Network Type:
  - Private: Assigns only a private IP address for access within the Alibaba Cloud internal network.
  - Public: Assigns both a public IP address and a private IP address to support access from the Internet and the internal network. By default, ALB uses an EIP to provide public-facing services.
  If you select Public, you are charged configuration fees and data transfer fees for the EIP.
  By default, a public-facing dual-stack instance uses an IPv4 address to provide services over the public network and does not support public network access over IPv6. To enable public network access over IPv6, you can change the network type of the ALB instance. This change incurs IPv6 public network fees.
- VPC: The instance and server groups must be in the same VPC.
- Zone:
  - If the region supports multiple zones, select at least two zones and their corresponding vSwitches.
  - (Only when Network Type is set to Public) You can attach an existing EIP or select Automatically Assign Public IP. If you select the latter, the system creates a pay-as-you-go (pay-by-data-transfer) EIP and attaches it to the ALB instance.
    You can attach only purchased pay-as-you-go (pay-by-data-transfer) EIPs that are not added to an Internet Shared Bandwidth instance. The EIP types attached to different zones of the same ALB instance must be consistent.
- IP Version: To support IPv6 access, select Dual-stack. Otherwise, select IPv4.
  Before you purchase a dual-stack ALB instance, enable IPv6 for the vSwitch where the instance resides.
  You can only create new dual-stack instances. You cannot upgrade an existing IPv4 instance to dual-stack.
- Edition (Instance Fee):
  - Basic: Provides basic ALB features and supports routing based on domain names, URLs, and HTTP headers.
  - Standard: Provides all the features of the Basic edition and also supports advanced features such as custom TLS security policies, Tracing Analysis, redirection, and rewrite.
  - WAF Enabled: Provides all the features of the Standard edition and integrates with Web Application Firewall (WAF) 3.0 to provide application-layer security protection for web services.
    If no WAF instance is activated for your account, a pay-as-you-go WAF 3.0 instance is automatically activated when you purchase a WAF Enabled ALB instance.
    If a subscription WAF 3.0 instance is already activated for your account, no extra WAF fees are incurred when you purchase a WAF Enabled ALB instance.
    If a WAF 2.0 instance is activated for your account, you must first release the WAF 2.0 instance or migrate to WAF 3.0.
    By default, ALB does not enable the X-Forwarded-Proto header. After you release a WAF 2.0 instance, direct access to ALB may cause service exceptions, such as infinite redirection, because the backend service cannot correctly identify the protocol (HTTP or HTTPS). To prevent this issue, you must manually enable the X-Forwarded-Proto request header in the ALB listener configuration.
- (Only when Network Type is set to Public) Add to Shared Bandwidth: The default public bandwidth of a dual-zone ALB instance is 400 Mbps. You can add the instance to an Internet Shared Bandwidth instance to obtain a higher bandwidth limit.
- (Only when Network Type is set to Public and Add to Shared Bandwidth is not selected) Public Bandwidth Billing Method: The default value is Pay-by-data-transfer and cannot be changed.
  In pay-by-data-transfer mode, the bandwidth limit is not a service performance commitment. It is only a reference and an upper limit. If resource contention occurs, the bandwidth may be restricted.
- Instance Name and Resource Group: We recommend that you specify a descriptive instance name and resource group to simplify management. After you purchase an instance, you can modify the instance name and use tags to manage the instance on the Instances page.

API

You can call the CreateLoadBalancer operation to create an ALB instance.

What to do next

Create a server group: Create a group of backend servers to which the ALB instance forwards requests.
Add a listener: Add an entry point to receive requests for the ALB instance. You can create HTTP, HTTPS, and QUIC listeners.
Add a CNAME record: The Server Load Balancer domain name is upgraded. You cannot use the DNS name to directly access a new ALB instance. You must use a custom domain name and map it to the DNS name of the instance by creating a CNAME record.

Release an instance

You are charged instance fees from the time an instance is created until it is released, regardless of whether it is in use. To avoid unnecessary costs, release instances that you no longer need.

When you release a public-facing ALB instance, any associated EIPs or Anycast EIPs are automatically detached and released. This includes EIPs that were associated during instance creation, cloning, zone addition, or when the network type was changed from private to public for IPv4.

Warning

Releasing an instance deletes all its configurations and is irreversible. Proceed with caution.
If the instance is managed by another Alibaba Cloud service, such as Container Service for Kubernetes (ACK), releasing the instance will cause the associated service to become abnormal and unrecoverable.
Before you release an instance, make sure that the business domain name that resolves to the instance points to another address to avoid service interruptions.

Before you release an instance, make sure that deletion protection is disabled for the instance.

Console

Go to the Instances page of the ALB console. In the Actions column of the target instance, choose > Release and Confirm the action.

API

You can call the DisableDeletionProtection operation to disable deletion protection for the instance.
You can call the DeleteLoadBalancer operation to delete the load balancer instance.

Deletion protection and configuration read-only mode

The deletion protection and configuration read-only mode features prevent instances from being accidentally deleted or modified.

Configuration read-only mode is effective only in the console.

Console

Go to the Instances page of the ALB console. Click the ID of the target instance to go to the Instance Details page. In the Instance Information section, you can enable or disable Deletion Protection and Configuration Read-only Mode.

API

You can call the EnableDeletionProtection and DisableDeletionProtection operations to enable and disable deletion protection.
When you call UpdateLoadBalancerAttribute, set the ModificationProtectionConfig field and the Status subfield to enable or disable configuration read-only mode.

Billing

ALB supports pay-as-you-go (post-paid) and resource plans (pre-paid). For more information about billable items, see Billing overview of ALB.

Quotas

For more information, see ALB quotas.