Create and manage ALB instances

Application Load Balancer (ALB) is a Layer 7 load balancing service that provides application-layer processing capabilities and a wide range of advanced forwarding rules. By creating an ALB instance, you can forward requests from clients to backend servers.

Create an instance

Prerequisites

Account permissions: When you create an ALB instance for the first time, the system prompts you to create theAliyunServiceRoleForAlb service-linked role. This role authorizes ALB to access cloud resources such as elastic network interfaces, security groups, Elastic IP addresses (EIPs), and shared bandwidth.
Account balance: ALB instances use the pay-as-you-go billing method. You cannot create an instance if your account has an overdue payment. Before you create an instance, ensure your account has a sufficient balance.
Network preparation:
- You have created a Virtual Private Cloud (VPC) in the target region.
- For high availability, if the region supports multiple availability zones, you must deploy the ALB instance in at least two availability zones. Ensure you have created at least one vSwitch in each availability zone that you plan to use.
IP address planning:
- An ALB instance allocates three IP addresses from each specified vSwitch: one virtual IP address (VIP) for external services and two local IP addresses for communication with backend servers.
- To ensure full elastic capabilities, reserve at least eight IP addresses in each vSwitch where the ALB instance is deployed. The first and last three IP addresses of an IPv4 vSwitch are reserved by the system. Therefore, the prefix length of the IPv4 CIDR block for the vSwitch must be /28 or shorter, such as /27.
Security planning: If you use security policies like iptables, allow traffic from the vSwitch CIDR block of the ALB instance to ensure proper connectivity with backend services.

Console

Go to the Instances page of the ALB console and click Create ALB.
On the purchase page, specify the following parameters and click Create Now.
- Region: Select the region that is closest to your clients to reduce access latency.
  See Regions and availability zones that support ALB features.
- Instance network type:
  - Internal: Assigns only a private IP address. The instance is only accessible from within the Alibaba Cloud private network.
  - Internet: Assigns both a public IP address and a private IP address. The instance is accessible from the internet and from within the private network. By default, ALB uses an EIP for public network access.
  If you select Internet, you are charged configuration fees and data transfer fees for the EIP.
  A dual-stack instance with an Internet network type uses an IPv4 address for public access by default and does not have public IPv6 capabilities. To enable public IPv6 access, change the network type of the ALB instance. This action incurs IPv6 public network fees.
- VPC: The instance and its server groups must be in the same VPC. You cannot change the VPC of an ALB instance after creation.
- Availability zone:
  - If the region supports multiple availability zones, select at least two availability zones and their corresponding vSwitches.
  - (This parameter is available only when Instance network type is set to Internet) You can bind an existing EIP or select Auto-assign Public IP. If you select Auto-assign Public IP, the system creates a pay-as-you-go (pay-by-data-transfer) EIP and binds it to the ALB instance.
    You can bind only existing pay-as-you-go (pay-by-data-transfer) EIPs not associated with a shared bandwidth instance. All EIPs bound to the ALB instance must be of the same type.
- IP version: To support IPv6 access, select Dual-stack. Otherwise, select IPv4.
  Before you create a dual-stack ALB instance, you must enable IPv6 for the vSwitch where the instance is to be deployed.
  You can only create dual-stack instances. You cannot upgrade existing IPv4 instances to dual-stack.
- Edition (Instance Fee):
  - Basic Edition: Provides basic application load balancing features, including routing based on domain names, URLs, and HTTP headers.
  - Standard Edition: Includes all features of the Basic Edition, and adds advanced features such as custom TLS security policies, trace analysis, and advanced routing functions like redirection and rewrite.
  - WAF-enhanced Edition: Includes all features of the Standard Edition and integrates Web Application Firewall (WAF) 3.0 for application-layer web security.
    If you have not activated a WAF instance, creating a WAF-enhanced Edition ALB instance automatically activates a pay-as-you-go WAF 3.0 instance.
    If you have an active subscription-based WAF 3.0 instance, you do not incur additional WAF fees after you create a WAF-enhanced Edition ALB instance.
    If you have an active WAF 2.0 instance, you must first release the WAF 2.0 instance or migrate to WAF 3.0.
    By default, ALB does not enable the X-Forwarded-Proto header. After you release a WAF 2.0 instance, direct access to the ALB instance may cause service issues such as infinite redirects because the backend service cannot correctly identify the protocol (HTTP or HTTPS). To prevent this issue, manually enable the X-Forwarded-Proto request header in the ALB listener configuration.
- (This parameter is available only when Instance network type is set to Internet) Add to shared bandwidth: By default, an ALB instance deployed in two availability zones has a public bandwidth limit of 400 Mbit/s. You can add the instance to a shared bandwidth instance to obtain a higher bandwidth limit.
- (This parameter is available only when Instance network type is set to Internet and you do not select Add to shared bandwidth) Public IP billing method: The default billing method is Pay-by-data-transfer, and you cannot change it.
  In pay-by-data-transfer mode, the bandwidth limit represents a maximum threshold, not a guaranteed commitment. Actual bandwidth may be lower during periods of resource contention.
- Instance name and resource group: Specify a descriptive name and select a resource group to simplify management. After creation, you can modify its name on the Instances page or use tags for management.

API

Call the CreateLoadBalancer operation to create an Application Load Balancer instance.

Next steps

Create a server group: Create a group of target servers to receive requests forwarded by the ALB instance.
Add a listener: Add a listener to the ALB instance to define how it receives incoming requests. You can create HTTP, HTTPS, and QUIC listeners.
Add a CNAME record: The domain name system for load balancers has been upgraded. You cannot directly access a newly created ALB instance by using its DNS name. You must use your own domain name and create a CNAME record that maps your domain name to the DNS name of the instance.

Release an instance

You are charged an instance fee from the moment an instance is created until it is released, regardless of whether the instance is in use. To avoid unnecessary costs, release instances you no longer need.

When you release an Internet-facing ALB instance, you can choose to keep the EIP that ALB automatically created and bound. Anycast EIPs cannot be retained. Retained EIPs are billed on a pay-as-you-go basis. EIPs that you manually bind are automatically retained.

Warning

Releasing an instance is an irreversible action that deletes all its configurations. Proceed with caution.
If the instance is managed by another cloud service, such as Container Service for Kubernetes (ACK), releasing it will cause the associated service to fail. This action is irreversible.
Before releasing the instance, point any associated domain names to a different address to prevent service disruptions.

Before you release an instance, ensure that Deletion Protection is disabled for the instance.

Console

Go to the Instances page of the ALB console. In the Actions column of the target instance, choose > Release and then click Confirm.

API

Call the DisableDeletionProtection operation to disable deletion protection for the instance.
Call the DeleteLoadBalancer operation to delete the load balancer instance.

Deletion protection and modification protection

The deletion protection and modification protection features prevent you from accidentally deleting or modifying an instance.

Modification protection only prevents changes made through the console.

Console

Go to the Instances page of the ALB console. Click the ID of the target instance to go to the Instance Details page. In the Instance Information section, you can enable or disable Deletion Protection and Configuration Read-only Mode.

API

Call the EnableDeletionProtection and DisableDeletionProtection operations to enable and disable deletion protection.
When you call the UpdateLoadBalancerAttribute operation, set the Status parameter of ModificationProtectionConfig to enable or disable modification protection.

Billing

ALB supports two billing methods: pay-as-you-go and resource plans. For details on billable items, see ALB billing overview.

Quotas

For more information, see ALB quotas.