Application Load Balancer

Sign in and load saat-vpc:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json

1Launch web-a and web-b in two zones

The servers use Python’s built-in web server on port 8080, so they need no packages and no internet access.

Paste this whole block:

$ud = @'
#!/bin/bash
mkdir -p /srv/www/health
TOKEN=$(curl -s -X PUT http://169.254.169.254/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 300")
AZ=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/placement/availability-zone)
echo "<h1>saat-web from $(hostname) in $AZ</h1>" > /srv/www/index.html
echo ok > /srv/www/health/index.html
cat > /etc/systemd/system/saat-web.service <<'UNIT'
[Unit]
Description=saat web test server
After=network-online.target
[Service]
ExecStart=/usr/bin/python3 -m http.server 8080 --directory /srv/www
Restart=always
[Install]
WantedBy=multi-user.target
UNIT
systemctl daemon-reload
systemctl enable --now saat-web
'@
[IO.File]::WriteAllText('C:\aws-lab\web-userdata.sh', ($ud -replace "`r`n", "`n"))
$base = aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query Parameter.Value --output text
$ids = foreach ($s in @(@('web-a', $v.PrivateA), @('web-b', $v.PrivateB))) {
  aws ec2 run-instances --image-id $base --instance-type t3.micro --subnet-id $s[1] --security-group-ids $v.AppSg --metadata-options HttpTokens=required --user-data file://web-userdata.sh --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=$($s[0])},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=20}]" --query "Instances[0].InstanceId" --output text
}
$ids

You should see two instance IDs, something like this:

i-0a1b2c3d4e5f60001
i-0a1b2c3d4e5f60002

2Create the target group and register the servers

Paste this whole block:

$tg = aws elbv2 create-target-group --name saat-web-tg --protocol HTTP --port 8080 --vpc-id $v.VpcId --target-type instance --health-check-path /health/ --health-check-interval-seconds 10 --healthy-threshold-count 2 --unhealthy-threshold-count 2 --tags Key=course,Value=saatvedha-aws Key=lesson,Value=20 --query "TargetGroups[0].TargetGroupArn" --output text
aws elbv2 modify-target-group-attributes --target-group-arn $tg --attributes Key=deregistration_delay.timeout_seconds,Value=30 | Out-Null
aws ec2 wait instance-running --instance-ids $ids
aws elbv2 register-targets --target-group-arn $tg --targets Id=$($ids[0]) Id=$($ids[1])
aws elbv2 describe-target-health --target-group-arn $tg --query "TargetHealthDescriptions[].[Target.Id,TargetHealth.State,TargetHealth.Reason]" --output text

You should see something like this (no load balancer uses the group yet):

i-0a1b2c3d4e5f60001      unused  Target.NotInUse
i-0a1b2c3d4e5f60002      unused  Target.NotInUse

A 30-second deregistration delay keeps lab cleanup quick. Production usually keeps the default 300 seconds or tunes it to the longest request.

3Create the load balancer and listener

Paste this whole block (the wait takes about three minutes):

$alb, $dns = (aws elbv2 create-load-balancer --name saat-web-alb --type application --scheme internet-facing --subnets $v.PublicA $v.PublicB --security-groups $v.WebSg --tags Key=course,Value=saatvedha-aws Key=lesson,Value=20 --query "LoadBalancers[0].[LoadBalancerArn,DNSName]" --output text) -split '\s+'
aws elbv2 wait load-balancer-available --load-balancer-arns $alb
$listener = aws elbv2 create-listener --load-balancer-arn $alb --protocol HTTP --port 80 --default-actions "Type=forward,TargetGroupArn=$tg" --query "Listeners[0].ListenerArn" --output text
aws elbv2 wait target-in-service --target-group-arn $tg
aws elbv2 describe-target-health --target-group-arn $tg --query "TargetHealthDescriptions[].[Target.Id,TargetHealth.State]" --output text
$dns

You should see something like this:

i-0a1b2c3d4e5f60001      healthy
i-0a1b2c3d4e5f60002      healthy
saat-web-alb-1234567890.ap-south-1.elb.amazonaws.com

4Send traffic and add a listener rule

Paste this whole block:

do { Start-Sleep 10 } until (Resolve-DnsName $dns -ErrorAction SilentlyContinue)
1..4 | ForEach-Object { (Invoke-WebRequest -UseBasicParsing "http://$dns/").Content }
'[ { "Field": "path-pattern", "PathPatternConfig": { "Values": [ "/admin*" ] } } ]' | Set-Content rule-conditions.json
'[ { "Type": "fixed-response", "FixedResponseConfig": { "StatusCode": "403", "ContentType": "text/plain", "MessageBody": "Admins only. Use the VPN." } } ]' | Set-Content rule-actions.json
aws elbv2 create-rule --listener-arn $listener --priority 10 --conditions file://rule-conditions.json --actions file://rule-actions.json | Out-Null
try { Invoke-WebRequest -UseBasicParsing "http://$dns/admin" } catch { [int]$_.Exception.Response.StatusCode }

You should see something like this:

<h1>saat-web from ip-10-20-11-37.ap-south-1.compute.internal in ap-south-1a</h1>
<h1>saat-web from ip-10-20-12-84.ap-south-1.compute.internal in ap-south-1b</h1>
<h1>saat-web from ip-10-20-11-37.ap-south-1.compute.internal in ap-south-1a</h1>
<h1>saat-web from ip-10-20-12-84.ap-south-1.compute.internal in ap-south-1b</h1>
403

Requests take turns between the two zones. The /admin request never reached a server; the ALB answered it from rule 10. A new ALB name can take a minute or two to resolve, which is what the first line waits for.

✅ Checkpoint: Both targets are healthy, responses alternate between ap-south-1a and ap-south-1b, and /admin returns 403. Keep everything for the break lab.