20191029 AWS Black Belt Online Seminar Elastic Load Balancing (ELB)
34 likes•72,070 views
This document provides an overview of Elastic Load Balancing (ELB) on AWS. It discusses the different types of ELBs (Application Load Balancer, Network Load Balancer, Classic Load Balancer), their key features and how they can be used to build scalable and highly available systems by distributing traffic across multiple Availability Zones and targets like EC2 instances or ECS containers. It also covers topics like listener configurations, routing, health checks, access logs and integration with other AWS services.
![© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Webinar
https://amzn.to/JPWebinar https://amzn.to/JPArchive
Solutions Architect
2019/10/29
Elastic Load Balancing (ELB)
[AWS Black Belt Online Seminar]](https://image.slidesharecdn.com/20191029aws-blackbeltelb-191101012340/85/20191029-AWS-Black-Belt-Online-Seminar-Elastic-Load-Balancing-ELB-1-320.jpg)
![© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ELB自体も負荷の増減に応じて自動でスケール
（キャパシティが自動で増加する）
[注意]
NLB以外のELB(ALB/CLB)がスケールするときには、IPアドレス
が変化します。
ELBへアクセスするときには必ずDNS名で！
DNSへ登録することで独自ドメインでのアクセスも可能。](https://image.slidesharecdn.com/20191029aws-blackbeltelb-191101012340/85/20191029-AWS-Black-Belt-Online-Seminar-Elastic-Load-Balancing-ELB-10-320.jpg)
20191029 AWS Black Belt Online Seminar Elastic Load Balancing (ELB)
- 1. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Webinar https://amzn.to/JPWebinar https://amzn.to/JPArchive Solutions Architect 2019/10/29 Elastic Load Balancing (ELB) [AWS Black Belt Online Seminar]
- 2. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. 保里 善太(ほり ぜんた) • 所属 アマゾン ウェブ サービス ジャパン 株式会社 技術統括本部 ソリューションアーキテクト ゲーム業界のお客様を中心にご支援中 最近の関心事： 統計や機械学習を用いた不正検知やチート検出などのセキュリティの異 常検知技術
- 3. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • ① 吹き出しをクリック ② 質問を入力 ③ Sendをクリック Twitter #awsblackbelt
- 4. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • 2019 10 29 AWS (http://aws.amazon.com) • AWS AWS • • AWS does not offer binding price quotes. AWS pricing is publicly available and is subject to change in accordance with the AWS Customer Agreement available at http://aws.amazon.com/agreement/. Any pricing information included in this document is provided only as an estimate of usage charges for AWS services based on certain information that you have provided. Monthly charges will be based on your actual use of AWS services, and may vary from the estimates provided.
- 5. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • • • • • •
- 6. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • • • • • •
- 7. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. LBLB LBLB LB LB
- 8. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. 〜 AWSクラウド上のロードバランシングサービス 〜 ELBで実現できるシステム スケーラブル : 複数のEC2インスタンス/ECSコンテナ..etc（ターゲット）に負 荷分散 高い可用性 : 複数のアベイラビリティゾーンにある複数のターゲット の中から正常なターゲットにのみ振り分け ELB自体の特徴 スケーラブル : ELB自体も負荷に応じてキャパシティを自動増減 安価な従量課金 : 従量課金で利用可能 運用管理が楽 : マネージドサービスなので管理が不要 豊富な連携機能 : Auto Scaling, Route 53, Cloud Formation… などと連携
- 9. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. 新サーバ追加！ 過負荷 過負荷 Elastic Load Balancing
- 10. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. ELB自体も負荷の増減に応じて自動でスケール （キャパシティが自動で増加する） [注意] NLB以外のELB(ALB/CLB)がスケールするときには、IPアドレス が変化します。 ELBへアクセスするときには必ずDNS名で！ DNSへ登録することで独自ドメインでのアクセスも可能。
- 11. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
- 12. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. HTTP, HTTPS, HTTP/2 TCP, UDP, TLS HTTP, HTTPS, TCP VPC EC2-Classic, VPCVPC
- 13. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. TCP, UDP, TLS HTTP, HTTPS, TCP VPC EC2-Classic, VPCVPC ALB NLB HTTP, HTTPS, HTTP/2
- 14. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • ユーザー マネージメント コンソール 開発・管理者
- 15. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. ユーザー https://aws.amazon.com/jp/premiumsupport/knowledge-center/security-group-load-balancer/ • • • • • • •
- 16. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. ユーザー https://docs.aws.amazon.com/ja_jp/elasticloadbalancing/latest/classic/elb-listener-config.html • • • • • •
- 17. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • • • ユーザー
- 18. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • • • • • •
- 19. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • • • • • • • • • • • • • •
- 20. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
- 21. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. ALB NLB CLB
- 22. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AZ-b 良くない例：AZ間でキャパシティが不均等 AZ-a 50% 50% もう一方より 負荷が高くなる クロスゾーン負荷分散が有効であれば 50% 50% AZ-b AZ-a 負荷を基に 均等に http://docs.aws.amazon.com/ja_jp/ElasticLoadBalancing/latest/DeveloperGuide/enable-disable-crosszone-lb.html ALB NLB CLB • • • •
- 23. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • EC2 • 1 • ( ) • ECS ( ) ALB NLB
- 24. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Target Group ALB NLB Corporate data center DC ロードバランサ
- 25. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • – – – • – – •
- 26. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
- 27. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. ALB NLB CLB • • •
- 28. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. 参照 • • ALB NLB CLB
- 29. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. https://docs.aws.amazon.com/ja_jp/elasticloadbalancing/latest/network/load-balancer-access-logs.html • • • ALB NLB CLB [
- 30. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
- 31. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • ALB/CLB 60 • NLB 350 ( ) ALB/CLB • 1 4,000 • NLB 350 • ※ ALB NLB CLB
- 32. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • – ALB NLB CLB
- 33. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. ALB CLB • • • • • • • • •
- 34. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
- 35. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.参照 http://docs.aws.amazon.com/ja_jp/ElasticLoadBalancing/latest/DeveloperGuide/elb-listener- config.html#using-elb-listenerconfig-quickref • • ALB NLB CLB
- 36. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. https://docs.aws.amazon.com/ja_jp/ElasticLoadBalancing/latest/DeveloperGuide/ssl-config-update.html • • • • • • • • ALB NLB CLB
- 37. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • 参照 http://docs.aws.amazon.com/ja_jp/ElasticLoadBalancing/latest/DeveloperGuide/ssl-server-cert.html ALB NLB CLB
- 38. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • 複数のTLS証明書を1つのALB/NLBのListenerに設定可能に • SNIをサポートするクライアントには、適切な証明書を選択してTLSで 通信をできる • SNI非サポートのクライアントにはデフォルト証明書が使われる • ドメインはもちろんサポートする鍵交換方式や暗号、署名アルゴリズ ムを元に証明書を選択するスマートセレクション • ALB毎に最大25証明書まで (デフォルト証明書を除く) • ACMまたはIAMの全ての証明書が利用可能 https://aws.amazon.com/jp/blogs/news/new-application-load-balancer-sni/ https://aws.amazon.com/about-aws/whats-new/2017/10/elastic-load-balancing-application-load-balancers-now-support-multiple-ssl-certificates-and- smart-certificate-selection-using-server-name-indication-sni/ ALB NLB
- 39. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • • • • • •
- 40. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • • • • • • • •
- 41. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Target GroupTarget Group example.com /order /products HTTP:80 HTTPS:443 • • • •
- 42. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
- 43. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. example.com Target GroupTarget Group example.com http://example.com/products /order /products http://products.example.com Target GroupTarget Group order.example.com products.example.com
- 44. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
- 45. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. 1 (THEN)YES Rule 1 Rule 2 Default 2 (THEN)YES ELSE ELSE
- 46. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
- 47. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon CognitoALB Amazon EC2 1 2 3 4 OIDC IdP ALB 1 2 3 4 Amazon EC2
- 48. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. X-Forwarded-For: 203.0.113.7, 10.12.33.44, 10.12.23.88 Client IP address 送信元 経由するルート https://aws.amazon.com/jp/premiumsupport/knowledge-center/elb-capture-client-ip-addresses/ • • • •
- 49. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • HTTP/2 • HTTP 1.1 1 HTTP/2 128 • ALB HTTP/1.1 • HTTP/2 • Lambda • • Websocket
- 50. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • • • • • •
- 51. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • TCP(L4)のバランサとして機能 • 固定IPアドレス: AZ毎に1つ、既に持っているEIPも利用可能 • 送信元IPアドレスの保持: X-Forwarded-ForやProxy Protocolが不要 • 暖機なしに急激なスパイクにも対応可能 • • https://aws.amazon.com/jp/blogs/news/new-network-load-balancer-effortless-scaling-to-millions-of-requests-per-second/ https://aws.amazon.com/about-aws/whats-new/2017/09/announcing-network-load-balancer-for-elastic-load-balancing/ 1. 高可用性、高スループット、低レイテンシ 2. Source IP/Portがターゲットまで保持される 3. 固定IP
- 52. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • 高い可用性を実現 • DNS名なら、UnhealthyなAZのIPアドレスが自動削除される • 長時間セッションも維持が可能 • 暖機不要で突発的な数百万リクエスト/秒のトラフィックも捌ける • ELBは動的にキャパシティが拡張されるが、突発的なアクセス上昇の場 合、ALB/CLBの拡張が間に合わないことがある。その場合は暖機申請が 必要 • 固定IPのまま動的にスケールする • TCP負荷分散を同一AZ内で行うので、レイテンシが小さい • 単一AZ構成も可能 (ALBは複数AZ構成が必須)
- 53. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • クライアントのSource IPとPortが、そのままTargetまで届く • Targetはクライアントと直接通信しているかの様に見える • 実際は、行きも帰りもNLBを通っている (DSRではない) • IP Target（後述）やPrivateLink経由の場合は保持されず、NLBからの通信とな る • Direct Connectは接続されているVPCからのみ通信可能なので、こちらで回避 • TargetのSecurity GroupでクライアントIPの接続を許可する必要あり • インターネット向けに広く公開する場合は0.0.0.0/0で公開が必要 • ある程度制限をする場合は加えて、Health checkのためにVPC CIDRかNLB ENIからのアク セスも許可する必要あり • VPC内からのアクセスの場合でもターゲットへのアクセス許可はセキュリティグループ ID の指定ではなくクライアントIPの指定が必要 • Targetの選択は5-tupleなのでStickyになる • src ip, src port, dst ip, dst port, protocol
- 54. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • Internet-facing、Internal共にIPアドレスが固定 • AZ毎に1つのIPアドレスを利用、DNSはAレコードでも設定可能 • ALB, CLBではIPアドレスは不定（DNSで同定可能） • NLB作成時に自動割当されたIPアドレス、又はNLB作成時に指定し た自分が持っているElastic IPのいずれか • 自動割り当てされたIPアドレス以外の自前のElastic IPを使う際にはNLB作成 前にあらかじめElastic IPを用意しておく必要あり（重要） • NLB作成後に変更は不可能 • よくあるユースケース • Firewallの制約等で、ELBのIPアドレスの固定が必要な時
- 55. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • Instance Targetには一部古い世代が利用不可 • C1, CC1, CC2, CG1, CG2, CR1, CS1, G1, G2, HI1, HS1, M1, M2, M3, T1 • まとめるとI2,C3を除く2013年以前のインスタンスタイプ • Idle Connection Timeoutは350秒固定 • アイドルタイムアウト期間の経過後にクライアントまたはターゲットがデータを送信した場 合、TCP RST パケットが返されて接続が無効になったことを示す • Health Checkの設定に、あまり柔軟性がない • Timeoutは固定(TCPとHTTPSは10秒、HTTPは6秒) • Intervalは10秒または30秒のみで、後から変更不可 • TLSリスナーではアクセスログが取得可能だが、TCPの場合はVPC Flow Logで代替 • NLB自体にセキュリティーグループの設定はない
- 56. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • • • • •
- 57. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • • • • • •
- 58. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. ALB NLB CLB • EC2-Classic • TCP SSL • •
- 59. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • • • • • •
- 60. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • – – ALB NLB CLB
- 61. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. ALB NLB
- 62. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • • • • •
- 63. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • •
- 64. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS WAF • • • • • • ALB
- 65. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. ALB NLB ALB NLB Region ap-northeast-1 AWS Global Accelerator example.com Region us-east-1 • Global Accelerator ALB, NLB ( Elastic IP) • Amazon Global Network • IP • ALB IP ….. etc
- 66. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Target Group BTarget Group A example.com ALB • Lambda • Lambda JSON Lambda • VPC ALB Lambda EC2 ECS
- 67. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • • • • • •
- 68. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • • • • • • • •
- 69. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • • • • NLB/ALB CLB • • • • • • • • • • • • https://aws.amazon.com/jp/elasticloadbalancing/pricing/
- 70. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • • • • • •
- 71. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • https://docs.aws.amazon.com/ja_jp/elasticloadbalancing/latest/classic/elb-cloudwatch-metrics.html
- 72. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. https://docs.aws.amazon.com/ja_jp/elasticloadbalancing/latest/userguide/migrate-to-application-load-balancer.html
- 73. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
- 74. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • • • •
- 75. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • • – – – • – – 時間 負 荷
- 76. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • – – • • • – • – • –
- 77. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
- 78. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
- 79. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
- 80. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Japan Blog https://aws.amazon.com/jp/blogs/news/
- 81. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. https://amzn.to/JPArchive
- 82. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. • •
- 83. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Webinar https://amzn.to/JPWebinar https://amzn.to/JPArchive