A Load Balancer
| Table of Contents |
|---|
General Considerations
A load balancer is a resource that can enable Internet and Yale-network-only web traffic to one or more EC2 VMs or ECS container replicas, while enabling HTTPS certificatesreplica(s). The load balancer holds the HTTPS certificate and serves as an encryption endpoint.
Selecting a Load Balancer changes depending load balancer depends on your Data Classification. Read more about how to identify the risk of your data: Data Classification Policy.
For web apps with Low Risk Data will , you may use a an AWS Application Load Balancer (“ALB”) in your AWS account
For web apps with High Risk and Moderate Risk Data will you must use an ITS LTM Load Balancer-managed F5 LTM load balancer in Yale’s on-prem data center.
Web Application Firewall (“WAF”)
...
...
We recommend a WAF to protect ALBs
Using a WAF is recommended for Low Risk Data and required for Moderate and High Risk Data. An AWS WAF may be used with your AWS ALB for low risk data. The implementation of a WAF for Moderate or High Risk data is up to you to research and configure.
Access Logging
It is important and required to log HTTP access logs - AWS ALB supports this via S3. Working examples are detailed in terraform below.
AWS Network Load Balancers (“NLB”)
An advanced Boad Balancer NLB is an advanced load balancer - useful for complex configurations. It follows the same rules mentioned for Low Risk and High and Moderate Risk Data, plus WAF, and Access Logging. Configuration is left to the AWS account Sysadmin.
...
You can create public (and private) load balancers inside your AWS account for your low-risk web apps, with little help from ITS. You still need to request:
Domain Approval for your domain name validation and website content verification of from either ITS YaleSites or Yale School of Medicine (“YSM”) (ysm.editor@yale.edu).
A TLS certificate created via AWS , and separately, approval validation for the certificate from ITS YaleSitesfor your approved domain name. How to create an AWS ACM Certificate
DNS configuration from ITS for the website friendly name, e.g., example.yale.edu. This can be requested through ServiceNow of the IP and DNS Support team. After you create an ALB, you will need to create a DNS CNAME in Yale DNS to point to the ALB DNS record.
Moderate and High
...
Risk - ITS F5 LTM Load Balancer
ITS F5 LTM/BigIP Load Balancers will can be requested through ServiceNow of the Load Balancing Team. You have to do the following work before you request a Load Balancer. Be prepared with ticket numbers, and/or, email threads supporting these actions:
...
Name of the website or application
Desired Fully Qualified Domain Name (“FQDN”)
Brief description of the site or application.
NetId Netid information for the site, /application owner, COA for billing
IP address/AWS DNS Alias record of resource to be Load Balanced - i.e., EC2 IP address.
High Level Steps to Create an AWS ALB
This is a technical multi-step process which is to be performed by a technical resource whom who administers the AWS account, not ITS. A high level overview:
AWS ALB is applicable to low-risk data classification , web-apps.
Review of domain name selection and website content by with YaleSites, or Yale School of Medicine (“YSM”)
Backend load balancing target must use HTTPS, e.g., IIS, nginxNginx, apache Apache with self-signed certificate
yale.edu HTTPS SSL Certificates certificates can use AWS Certificate Manager (“ACM”) - for the public facing load balancer
ALB can be setup manually, using AWS command line, or with terraform Terraform as illustrated below
DNS requests for Request yale.edu domain name requested of “DNS” group through “IP and DNS support” team in ServiceNow
...
Prerequisite Information Gathering
Only create AWS ALBs for low-risk data web applications
How to verify Verify that data is a low risk and perform data classification - . See Data Classification Policy
Moderate risk and high risk data classification services cannot use AWS ALB, and must load balance through ITS F5 LTM load balancing. Please open a support Incident in ServiceNow for Load Balancing for non-low-risk data-driven web apps.
Verify approval from YaleSites, and/or Obtain approval for the domain name and website content from YaleSites or, for med.yale.edu domain names, from Yale School of Medicine ("YSM") med.yale.edu domain names, for the domain name and website content
For Yalesites approval - *.yale.edu - email webmaster@yale.edu
For med.yale.edu domain names, email the YSM, ysm.editor@yale.edu
Enter useful tag information for accounting purposes
Technical Documentation
Creating AWS ALBs with terraform
https://github.com/YaleUniversity/yalecloud-terraform-examples
Backend targets
Create an HTTPS listener on the backend web app
E.g., nginx Nginx self-signed certificate listening on port 443/HTTPS
Configure the access logging to an S3 bucket in your account.
Optionally, configure a WAF
AWS Certificate Manager (“ACM”)
You will need valid HTTPS/TLS certificates for AWS ALBs.
...
Follow-up with an email to the YaleSites team
To: Lutinski, Robert robert.lutinski@yalewebmaster@yale.edu; Johnson, J'Vaughn jvaughn.johnson@yale.eduCc: Cloud Engineering cloudeng@yale.edu; webmaster@yale.edu webmaster@yalehostmaster@yale.eduSubject: AWSCertificate AWS Certificate Validation for - example.yale.edu
...
FYI, a request for domain name owner validation is incoming: example.yale.edu. This is for the ${my-webapp-namedservice}, for use in the AWS Certificate Manager ("ACM"). Thank you,
Best,<your name>
DNS Requests
Request Public/Private DNS CNAME requests through the "IP & DNS support" group via a ServiceNow Incidentincident.
Use the following template to create a DNS record and assign a ticket to the DNS group in ServiceNow (“SNOW”).
Create an Incident incident in Service Now ServiceNow assigned to the “Business service:” Infrastructure & Internet > Network Services > IP & DNS Support
Get tagging/metadata for the DNS team as show below:
Short description:Create Private/Public DNS record for an AWS ALB: example.yale.edu
...