AWS.ELBv2 reference

DeregisterTargets

Source: src/AWS/ELBv2/DeregisterTargets.ts

Runtime binding for the DeregisterTargets operation (IAM action elasticloadbalancing:DeregisterTargets scoped to the target-group ARN).

Deregisters targets from the bound target group at runtime — the target enters draining and is removed once in-flight requests complete. Pairs with RegisterTargets for custom blue/green orchestration or graceful self-removal on shutdown. Provide the implementation with Effect.provide(AWS.ELBv2.DeregisterTargetsHttp).

DeregisterTargets: Dynamic Target Management

// init — bind the operation to the target group
const deregisterTargets = yield* AWS.ELBv2.DeregisterTargets(targetGroup);

// runtime — start draining the target
yield* deregisterTargets({
  Targets: [{ Id: "10.0.1.15", Port: 8080 }],
});

DescribeCapacityReservation

Source: src/AWS/ELBv2/DescribeCapacityReservation.ts

Runtime binding for the DescribeCapacityReservation operation (IAM action elasticloadbalancing:DescribeCapacityReservation; ELBv2 Describe* actions do not support resource-level permissions, so the grant is on *).

Reads the bound load balancer’s LCU capacity reservation status — pairs with ModifyCapacityReservation to confirm a reservation is provisioned before a known traffic spike. Provide the implementation with Effect.provide(AWS.ELBv2.DescribeCapacityReservationHttp).

DescribeCapacityReservation: Capacity Reservation

// init — bind the operation to the load balancer
const describeCapacityReservation =
  yield* AWS.ELBv2.DescribeCapacityReservation(loadBalancer);

// runtime — read reservation state per Availability Zone
const reservation = yield* describeCapacityReservation();
const states = reservation.CapacityReservationState?.map((s) => s.State);

DescribeTargetHealth

Source: src/AWS/ELBv2/DescribeTargetHealth.ts

Runtime binding for the DescribeTargetHealth operation (IAM action elasticloadbalancing:DescribeTargetHealth; ELBv2 Describe* actions do not support resource-level permissions, so the grant is on *).

Reads the live health state of the bound target group’s targets — e.g. a readiness gate that waits for a freshly registered target to turn healthy before shifting traffic, or an ops endpoint surfacing fleet health. Provide the implementation with Effect.provide(AWS.ELBv2.DescribeTargetHealthHttp).

DescribeTargetHealth: Target Health

// init — bind the operation to the target group
const describeTargetHealth = yield* AWS.ELBv2.DescribeTargetHealth(targetGroup);

// runtime — read health states
const health = yield* describeTargetHealth({});
const states = health.TargetHealthDescriptions?.map(
  (d) => d.TargetHealth?.State,
);

GetTrustStoreCaCertificatesBundle

Source: src/AWS/ELBv2/GetTrustStoreCaCertificatesBundle.ts

Runtime binding for the GetTrustStoreCaCertificatesBundle operation (IAM action elasticloadbalancing:GetTrustStoreCaCertificatesBundle scoped to the trust-store ARN).

Returns a pre-signed S3 URI (active for ten minutes) for the bound TrustStore’s CA certificate bundle — e.g. an ops endpoint that serves or audits the mTLS CA bundle currently in force. The trust-store ARN is injected from the binding. Provide the implementation with Effect.provide(AWS.ELBv2.GetTrustStoreCaCertificatesBundleHttp).

GetTrustStoreCaCertificatesBundle: Trust Store Content

// init — bind the operation to the trust store
const getCaBundle = yield* AWS.ELBv2.GetTrustStoreCaCertificatesBundle(trustStore);

// runtime — Location is a presigned S3 URL valid for ten minutes
const { Location } = yield* getCaBundle();

GetTrustStoreRevocationContent

Source: src/AWS/ELBv2/GetTrustStoreRevocationContent.ts

Runtime binding for the GetTrustStoreRevocationContent operation (IAM action elasticloadbalancing:GetTrustStoreRevocationContent scoped to the trust-store ARN).

Returns a pre-signed S3 URI (active for ten minutes) for a certificate revocation list (CRL) previously added to the bound TrustStore — e.g. an ops endpoint auditing which client certificates are currently revoked. A missing revocation id surfaces as the typed RevocationIdNotFoundException. Provide the implementation with Effect.provide(AWS.ELBv2.GetTrustStoreRevocationContentHttp).

GetTrustStoreRevocationContent: Trust Store Content

// init — bind the operation to the trust store
const getRevocation = yield* AWS.ELBv2.GetTrustStoreRevocationContent(trustStore);

// runtime
const { Location } = yield* getRevocation({ RevocationId: 1 });

Listener

Source: src/AWS/ELBv2/Listener.ts

An ELBv2 (Application/Network) Load Balancer listener. A listener checks for connection requests using its configured protocol and port, then routes them to target groups via its default actions (and any attached ListenerRules).

Listener: Creating a Listener

Basic HTTP forward listener

const listener = yield* Listener("http", {
  loadBalancerArn: lb.loadBalancerArn,
  targetGroupArn: tg.targetGroupArn,
  port: 80,
  protocol: "HTTP",
});

HTTPS listener with certificate and SSL policy

const listener = yield* Listener("https", {
  loadBalancerArn: lb.loadBalancerArn,
  defaultActions: [
    { type: "forward", targetGroups: [{ targetGroupArn: tg.targetGroupArn }] },
  ],
  port: 443,
  protocol: "HTTPS",
  certificates: [primaryCertArn, sniCertArn],
  sslPolicy: "ELBSecurityPolicy-TLS13-1-2-2021-06",
});

Listener: Default Actions

Redirect HTTP to HTTPS

const redirect = yield* Listener("redirect", {
  loadBalancerArn: lb.loadBalancerArn,
  defaultActions: [
    { type: "redirect", statusCode: "HTTP_301", protocol: "HTTPS", port: "443" },
  ],
  port: 80,
  protocol: "HTTP",
});

Fixed response

const maintenance = yield* Listener("maintenance", {
  loadBalancerArn: lb.loadBalancerArn,
  defaultActions: [
    { type: "fixedResponse", statusCode: "503", contentType: "text/plain", messageBody: "down" },
  ],
  port: 80,
});

Weighted forward with stickiness

const weighted = yield* Listener("weighted", {
  loadBalancerArn: lb.loadBalancerArn,
  defaultActions: [
    {
      type: "forward",
      targetGroups: [
        { targetGroupArn: blue.targetGroupArn, weight: 90 },
        { targetGroupArn: green.targetGroupArn, weight: 10 },
      ],
      stickiness: { enabled: true, duration: "1 hour" },
    },
  ],
  port: 80,
});

Listener: Mutual TLS

const mtls = yield* Listener("mtls", {
  loadBalancerArn: lb.loadBalancerArn,
  defaultActions: [
    { type: "forward", targetGroups: [{ targetGroupArn: tg.targetGroupArn }] },
  ],
  port: 443,
  protocol: "HTTPS",
  certificates: [certArn],
  mutualAuthentication: { mode: "verify", trustStoreArn: trustStore.trustStoreArn },
});

ListenerCertificate

Source: src/AWS/ELBv2/ListenerCertificate.ts

Attaches an additional SNI certificate to an ELBv2 HTTPS/TLS listener. The listener’s default certificate is configured on the Listener itself; ListenerCertificate adds extra certificates that the load balancer selects via Server Name Indication (SNI) based on the requested hostname.

Use this resource when the certificates are managed independently of the listener (e.g. one certificate per tenant domain). When the full certificate list is known up front, prefer the listener’s certificates prop, which declaratively syncs the whole set.

ListenerCertificate: Attaching Certificates

const listener = yield* Listener("https", {
  loadBalancerArn: lb.loadBalancerArn,
  targetGroupArn: tg.targetGroupArn,
  port: 443,
  protocol: "HTTPS",
  certificateArn: defaultCertArn,
});
yield* ListenerCertificate("tenant-cert", {
  listenerArn: listener.listenerArn,
  certificateArn: tenantCertArn,
});

ListenerRule

Source: src/AWS/ELBv2/ListenerRule.ts

An ELBv2 listener rule. Rules attach to an Application Load Balancer listener and route requests to target groups (or other actions) based on conditions such as host header, path pattern, HTTP header, query string, request method, and source IP.

ListenerRule: Creating a Rule

Path-based routing

const rule = yield* ListenerRule("api", {
  listenerArn: listener.listenerArn,
  priority: 10,
  conditions: [{ pathPattern: { values: ["/api/*"] } }],
  actions: [
    { type: "forward", targetGroups: [{ targetGroupArn: apiTg.targetGroupArn }] },
  ],
});

Host-header routing

const rule = yield* ListenerRule("admin", {
  listenerArn: listener.listenerArn,
  priority: 20,
  conditions: [{ hostHeader: { values: ["admin.example.com"] } }],
  actions: [
    { type: "forward", targetGroups: [{ targetGroupArn: adminTg.targetGroupArn }] },
  ],
});

ListenerRule: Conditions

const rule = yield* ListenerRule("beta", {
  listenerArn: listener.listenerArn,
  priority: 30,
  conditions: [
    { queryString: { values: [{ key: "version", value: "beta" }] } },
    { httpHeader: { name: "X-Channel", values: ["internal"] } },
  ],
  actions: [{ type: "fixedResponse", statusCode: "200", messageBody: "beta" }],
});

LoadBalancer

Source: src/AWS/ELBv2/LoadBalancer.ts

An ELBv2 (Application / Network / Gateway) load balancer.

LoadBalancer: Creating a Load Balancer

Internet-facing Application Load Balancer

const lb = yield* LoadBalancer("web", {
  type: "application",
  scheme: "internet-facing",
  subnets: [subnet1.subnetId, subnet2.subnetId],
  securityGroups: [sg.groupId],
});

Network Load Balancer with static EIPs

const nlb = yield* LoadBalancer("edge", {
  type: "network",
  scheme: "internet-facing",
  subnetMappings: [
    { subnetId: subnet1.subnetId, allocationId: eip1.allocationId },
    { subnetId: subnet2.subnetId, allocationId: eip2.allocationId },
  ],
});

LoadBalancer: Attributes

const lb = yield* LoadBalancer("web", {
  type: "application",
  subnets: [subnet1.subnetId, subnet2.subnetId],
  attributes: {
    "idle_timeout.timeout_seconds": "120",
    "deletion_protection.enabled": "true",
  },
});

ModifyCapacityReservation

Source: src/AWS/ELBv2/ModifyCapacityReservation.ts

Runtime binding for the ModifyCapacityReservation operation (IAM action elasticloadbalancing:ModifyCapacityReservation scoped to the load-balancer ARN).

Sets or resets the bound load balancer’s minimum LCU capacity reservation at runtime — e.g. a Lambda that pre-provisions capacity ahead of a known traffic spike (product launch, ticket sale) and resets it afterwards, the ELBv2 analogue of Auto Scaling’s SetDesiredCapacity. Provide the implementation with Effect.provide(AWS.ELBv2.ModifyCapacityReservationHttp).

ModifyCapacityReservation: Capacity Reservation

// init — bind the operation to the load balancer
const modifyCapacityReservation =
  yield* AWS.ELBv2.ModifyCapacityReservation(loadBalancer);

// runtime — reserve 100 LCUs per Availability Zone
yield* modifyCapacityReservation({
  MinimumLoadBalancerCapacity: { CapacityUnits: 100 },
});

// later — release the reservation
yield* modifyCapacityReservation({ ResetCapacityReservation: true });

RegisterTargets

Source: src/AWS/ELBv2/RegisterTargets.ts

Runtime binding for the RegisterTargets operation (IAM action elasticloadbalancing:RegisterTargets scoped to the target-group ARN).

Registers targets (instances, IPs, Lambda functions, or an ALB) with the bound target group at runtime — e.g. custom blue/green orchestration, or compute that registers itself into a target group at boot. Provide the implementation with Effect.provide(AWS.ELBv2.RegisterTargetsHttp).

RegisterTargets: Dynamic Target Management

// init — bind the operation to the target group
const registerTargets = yield* AWS.ELBv2.RegisterTargets(targetGroup);

// runtime — register a target by IP and port
yield* registerTargets({
  Targets: [{ Id: "10.0.1.15", Port: 8080 }],
});

TargetGroup

Source: src/AWS/ELBv2/TargetGroup.ts

An ELBv2 target group. A target group routes requests to one or more registered targets (instances, IPs, Lambda functions, or another ALB) using the configured protocol and port, and runs health checks against them.

TargetGroup: Creating a Target Group

HTTP target group

const tg = yield* TargetGroup("web", {
  vpcId: vpc.vpcId,
  port: 80,
  protocol: "HTTP",
  targetType: "ip",
});

Lambda target group

// No vpc/port/protocol — the target is a Lambda function.
const tg = yield* TargetGroup("fn", {
  targetType: "lambda",
});

gRPC target group

const tg = yield* TargetGroup("grpc", {
  vpcId: vpc.vpcId,
  port: 50051,
  protocol: "HTTP",
  protocolVersion: "GRPC",
  matcher: { GrpcCode: "0" },
});

TargetGroup: Health Checks

const tg = yield* TargetGroup("api", {
  vpcId: vpc.vpcId,
  port: 8080,
  protocol: "HTTP",
  healthCheckPath: "/healthz",
  healthCheckInterval: "15 seconds",
  healthyThresholdCount: 3,
  unhealthyThresholdCount: 3,
});

TargetGroupAttachment

Source: src/AWS/ELBv2/TargetGroupAttachment.ts

Registers a single target (instance, IP address, Lambda function, or ALB) with an ELBv2 target group. ECS services register their own tasks, so this resource matters for Lambda-behind-ALB, EC2 instances, and static IPs.

For lambda targets, the Lambda function’s resource policy must allow elasticloadbalancing.amazonaws.com to invoke it, scoped to the target group ARN — create a Permission first. The provider retries the registration briefly while that permission propagates.

TargetGroupAttachment: Registering Targets

Lambda function target

const tg = yield* TargetGroup("fn", { targetType: "lambda" });
yield* Lambda.Permission("AlbInvoke", {
  action: "lambda:InvokeFunction",
  functionName: fn.functionArn.as<string>(),
  principal: "elasticloadbalancing.amazonaws.com",
  sourceArn: tg.targetGroupArn.as<string>(),
});
yield* TargetGroupAttachment("fn-target", {
  targetGroupArn: tg.targetGroupArn,
  targetId: fn.functionArn.as<string>(),
});

IP address target

yield* TargetGroupAttachment("ip-target", {
  targetGroupArn: tg.targetGroupArn,
  targetId: "10.0.1.15",
  port: 8080,
});

EC2 instance target

yield* TargetGroupAttachment("instance-target", {
  targetGroupArn: tg.targetGroupArn,
  targetId: instance.instanceId,
  port: 80,
});

TrustStore

Source: src/AWS/ELBv2/TrustStore.ts

An ELBv2 trust store. A trust store holds the CA certificate bundle used by an HTTPS listener configured for mutual TLS (mTLS) verify mode to validate client certificates.

TrustStore: Creating a Trust Store

Basic trust store from an S3 CA bundle

const trustStore = yield* TrustStore("mtls", {
  caCertificatesBundleS3Bucket: "my-ca-bundles",
  caCertificatesBundleS3Key: "ca-bundle.pem",
});

Using a trust store on an mTLS listener

const listener = yield* Listener("https", {
  loadBalancerArn: lb.loadBalancerArn,
  port: 443,
  protocol: "HTTPS",
  certificates: [certArn],
  mutualAuthentication: {
    mode: "verify",
    trustStoreArn: trustStore.trustStoreArn,
  },
  defaultActions: [
    { type: "forward", targetGroups: [{ targetGroupArn: tg.targetGroupArn }] },
  ],
});