如何通过脚本自动化创建AWS Application Load Balancer？

Absolutely doable! You’re spot on that the create-load-balancer CLI command doesn’t directly link to target groups — that’s intentional because ALBs, target groups, and listeners are separate resources that work together as a stack. Let me break down the full automation flow and share a working script example.

You need to create resources in this specific order (since each depends on the previous):

1. Target Group: First, because your ALB listener needs a target group to route traffic to.
2. Application Load Balancer: With your specified subnets, security groups, and network configuration.
3. Listener: Acts as the bridge to forward incoming ALB traffic to your target group.

Here’s a complete, reusable script that ties all three steps together. Just replace the placeholder values with your actual details:

#!/bin/bash

# --------------------------
# Configuration - Update Me!
# --------------------------
ALB_NAME="my-production-app-alb"
TARGET_GROUP_NAME="my-api-target-group"
VPC_ID="vpc-0a1b2c3d4e5f6g7h8"
SUBNETS="subnet-0123abc subnet-456def" # Space-separated list (min 2 for high availability)
SECURITY_GROUPS="sg-0987fedcba" # Space-separated list of ALB security groups
PROTOCOL="HTTP" # Or HTTPS if you need SSL
ALB_PORT=80
TARGET_PORT=3000 # Port your application listens on
TARGET_TYPE="instance" # Use "ip" for ECS tasks or non-EC2 targets
HEALTH_CHECK_PATH="/healthz" # Your app's health check endpoint

# --------------------------
# 1. Create Target Group
# --------------------------
echo "🔧 Creating target group..."
aws elbv2 create-target-group \
  --name $TARGET_GROUP_NAME \
  --protocol $PROTOCOL \
  --port $TARGET_PORT \
  --vpc-id $VPC_ID \
  --target-type $TARGET_TYPE \
  --health-check-path $HEALTH_CHECK_PATH \
  --health-check-interval-seconds 30 \
  --healthy-threshold-count 2

# Capture the Target Group ARN for later use
TARGET_GROUP_ARN=$(aws elbv2 describe-target-groups \
  --names $TARGET_GROUP_NAME \
  --query 'TargetGroups[0].TargetGroupArn' \
  --output text)

# --------------------------
# 2. Create Application Load Balancer
# --------------------------
echo "🔧 Creating Application Load Balancer..."
aws elbv2 create-load-balancer \
  --name $ALB_NAME \
  --subnets $SUBNETS \
  --security-groups $SECURITY_GROUPS \
  --scheme internet-facing # Use "internal" for private ALBs

# Capture the ALB ARN for the listener
ALB_ARN=$(aws elbv2 describe-load-balancers \
  --names $ALB_NAME \
  --query 'LoadBalancers[0].LoadBalancerArn' \
  --output text)

# --------------------------
# 3. Create Listener (Link ALB to Target Group)
# --------------------------
echo "🔧 Creating listener to route traffic..."
aws elbv2 create-listener \
  --load-balancer-arn $ALB_ARN \
  --protocol $PROTOCOL \
  --port $ALB_PORT \
  --default-actions Type=forward,TargetGroupArn=$TARGET_GROUP_ARN

echo "✅ ALB setup complete! ALB DNS Name: $(aws elbv2 describe-load-balancers --names $ALB_NAME --query 'LoadBalancers[0].DNSName' --output text)"

• Error Handling: Add checks for each command’s exit code (e.g., if [ $? -ne 0 ]; then echo "Failed to create target group"; exit 1; fi) to stop the script if something breaks.
• Idempotency: Add logic to check if resources already exist before creating them (use describe-target-groups or describe-load-balancers to avoid duplicates).
• IAM Permissions: Ensure your CLI user/role has these permissions:
  • elasticloadbalancing:CreateTargetGroup
  • elasticloadbalancing:CreateLoadBalancer
  • elasticloadbalancing:CreateListener
  • elasticloadbalancing:DescribeTargetGroups
  • elasticloadbalancing:DescribeLoadBalancers
• IaC Alternatives: For more scalable, version-controlled deployments, use AWS CloudFormation or Terraform. These tools handle resource dependencies automatically and let you define your entire ALB stack in a single config file.

• Make sure your subnets are in different AWS Availability Zones (required for ALB high availability).
• Verify the target group’s VPC matches the ALB’s subnets’ VPC — they must be in the same VPC.
• If using HTTPS, you’ll need to add an SSL certificate ARN to the listener with --certificates CertificateArn=arn:aws:acm:....

内容的提问来源于stack exchange，提问作者Sunil Agarwal