Lecture 188: Hands On: ALB X-Forwarded Headers
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：07:14
- 来源：Udemy Lecture 28555999
- Slide 数量：6
- 画面切换：00:54、03:04、04:12、05:43、07:01
扫描说明
逐条读取了 Udemy 页面中的 160 条英文 Transcript cue，并按时间轴扫描全长约 07:14 的 Hands-on。依据 Web Server 启动、ALB/Security Group/Target Group 配置、直连与 ALB 访问验证、Apache LogFormat 修改、Header 日志对比与资源清理划分为 6 个小节。截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 用 User Data 启动 Amazon Linux Web Server
时间范围：00:00–00:54
总结 / Summary
中文
实验先启动名为 My Web Server 的 Amazon Linux 2023 t2.micro Instance，不要求特定 Key Pair，并建立允许 SSH 的 Security Group。User Data 安装并启动 httpd、设置开机自启，再把包含 Hostname 的 Hello World 写入 /var/www/html/index.html，使 Instance 启动后直接成为 Web Server。
English
The lab launches an Amazon Linux 2023 t2.micro instance named My Web Server, without requiring a specific key pair, and creates a security group that allows SSH. User data installs and starts httpd, enables it at boot, and writes a Hello World page containing the hostname to /var/www/html/index.html so the instance becomes a web server automatically.
Transcript
00:00 So let's go ahead and do a quick hands-on
00:02 to have a look at the X-Forwarded-For headers
00:06 that are happening between our load balancer
00:08 and our EC2 instance.
00:09 So first of all, I'm going to launch an instance,
00:12 I'll call this one My Web Server,
00:15 and then I'm going to use Amazon Linux 2023
00:19 and I will use t2.micro.
00:20 I don't need a specific Key Pair.
00:23 I'm going to create a security group
00:25 that allows SSH traffic.
00:27 So this is good,
00:28 eight gigabytes of gp3 storage.
00:30 This is good as well.
00:31 And then in terms of Advanced Details,
00:34 I'm going to scroll all the way down
00:36 and use a User data file.
00:38 And that user file is going to be right here.
00:40 I'm going to copy it and paste it.
00:42 So what this does is that it installs httpd
00:46 and then it just creates an index.html file.
00:49 So this will make our server a web server.
00:52 So let's launch this instance.
2. 创建 Internet-facing ALB、Security Group 与 Target Group
时间范围：00:54–03:04
总结 / Summary
中文
创建 Internet-facing IPv4 ALB demo-alb，选择 VPC 的三个 Subnet。为 ALB 新建 Security Group，允许来自任意 IPv4 的 HTTP/80；Listener 使用 HTTP/80，并创建 Instance 类型 Target Group demo-tg-alb，以 HTTP/80、IPv4、默认根路径 Health Check 注册 My Web Server。随后把 Target Group 绑定到 Listener 并创建 ALB。
English
Create an internet-facing IPv4 ALB named demo-alb across three VPC subnets. Give it a new security group allowing HTTP/80 from any IPv4 address. The listener uses HTTP/80 and forwards to an instance-type target group named demo-tg-alb, configured for HTTP/80, IPv4, and the default root health check, with My Web Server registered as the target.
Transcript
00:54 And while this is launching, let's go ahead
00:57 and also launch an application Load Balancer.
01:00 So on the left hand side,
01:02 let's click on Load Balancers,
01:03 and then I'm going to create a load balancer.
01:05 It will be an Application Load Balancer called demo-alb.
01:10 It's going to be Internet-facing with IPv4.
01:14 I'm going to launch it into my VPC.
01:16 So one, two, three subnets is perfect.
01:20 And then for Security Groups,
01:21 I'm going to have to create a security group.
01:24 So I'll use one of my security groups that I need to create.
01:28 So let's go real quick and create one.
01:30 So security groups.
01:33 And we're going to create a one called
01:36 Demo ALBASG, ALBSG.
01:40 And so we're going to have an Inbound rule in here,
01:43 which is going to allow all HTP traffic from anywhere.
01:49 So this is going to allow us to access our load balancer
01:53 by using this security group.
01:54 So let's go ahead
01:56 and going back to our security group set up
02:01 for our load balancer.
02:02 We're going to find our ALB Security Group.
02:05 And here we go, it has been selected.
02:08 Now for listeners, we're going to have HTTP on port 80
02:12 and we need to select at target group.
02:14 So let's create at target group for instances,
02:18 and then I'm going to call one this one demo-tg-alb
02:24 on port, HTTP, port 80, IPv4.
02:28 This is perfect, HTTP-1 is good.
02:32 And then we have HTTP.
02:33 The check path is perfect and let's click on Next.
02:37 So I need to just name it differently.
02:40 Here we go, Next.
02:41 And we're going to register my web server,
02:44 click on include as pending below
02:47 and then create this target group.
02:49 So now we're good.
02:51 I'm going to go back into my Load Balancer,
02:54 refresh this and choose the target group I just created.
02:58 And finally, we're good to go.
03:00 We let's create this load balancer.
3. 分别验证 EC2 公网地址与 ALB DNS 名称
时间范围：03:04–04:12
总结 / Summary
中文
直接打开 EC2 Public IPv4 初次失败，是因为 Instance Security Group 尚未允许 HTTP；加入 HTTP from Anywhere IPv4 后，页面返回 Instance 的内部 Hostname。等待 ALB 进入 Active，再访问其 DNS Name，也应返回同一 Hello World，证明 Listener、Target Group、Health Check 与后端链路已工作。
English
Opening the EC2 public IPv4 address initially fails because the instance security group does not yet allow HTTP. After adding HTTP from anywhere IPv4, the page returns the instance internal hostname. Once the ALB becomes active, its DNS name returns the same Hello World page, confirming the listener, target group, health check, and backend path are working.
Transcript
03:04 So while this is being created,
03:06 let's go back into our EC2 Instance.
03:09 I'm going to click on it,
03:11 look at the public IPv4 address, which is right here.
03:14 I'm going to copy and paste it,
03:16 open it in my web browser,
03:20 and of course it's not going to work
03:21 because I'm missing a security group.
03:23 So back into Security,
03:25 let's go into the Security Group Rule.
03:28 And I'm going to edit the Inbound rule to also add HTTP
03:32 so that we allow HTTP traffic coming from anywhere IPv4.
03:37 Okay, so let's try again.
03:38 We can stop this and try again, and here we go.
03:43 So what we get out of it is a Hello World from,
03:46 and this is the internal IP,
03:48 (indistinct) name of my EC2 Instance.
03:50 So this is perfect.
03:51 We have this web server working.
03:54 And now for load balancer,
03:56 if it has been provisioned, I need to wait a little bit.
04:00 Okay, so my load balancer is now active
04:02 and here's the DNS name that I'm going to copy and paste.
04:05 And as expected, we also get the Hello World here.
04:08 Okay, so now let's have a look at the Forwarded headers.
4. 修改 Apache LogFormat 记录三个 X-Forwarded 字段
时间范围：04:12–05:43
总结 / Summary
中文
通过 EC2 Instance Connect 进入服务器，用管理员权限编辑 /etc/httpd/conf/httpd.conf。在 combined LogFormat 前加入 %{X-Forwarded-For}i、%{X-Forwarded-Proto}i 与 %{X-Forwarded-Port}i，保存后执行 systemctl reload httpd，让 Apache 重新加载配置；随后 tail -f /var/log/httpd/access_log 实时观察请求。
English
Connect with EC2 Instance Connect and edit /etc/httpd/conf/httpd.conf with administrative privileges. Add %{X-Forwarded-For}i, %{X-Forwarded-Proto}i, and %{X-Forwarded-Port}i to the combined LogFormat, save the file, and run systemctl reload httpd so Apache loads the change. Then tail -f /var/log/httpd/access_log to watch requests live.
Transcript
04:12 So to do so, let's go into our EC2 instance
04:16 and I'm going to connect to it.
04:17 So let's connect using EC2 Instance Connect
04:21 and then click on Connect.
04:23 So this is going to open a terminal window into my instance.
04:26 And now I'm going to go into steps.md
04:29 to actually run the steps that will allow us
04:31 to see these Forwarded-For Forwarded-Proto headers.
04:35 So first I need to edit this file name httpd.conf
04:40 at this path,
04:42 and I will edit the LogFormat setting.
04:45 So I'm doing sudo nano,
04:47 and then I pass in the file name to allow me
04:51 to edit this file with administrative access.
04:54 So press Enter, and then I'm going
04:56 to scroll down in here, LogFormats.
05:02 Okay, so LogFormat is right here
05:04 and I need to edit this first line.
05:06 So I'm going to add a few spaces.
05:09 And in here I'm going to just add
05:11 everything from here up until the i.
05:14 So I'm going to paste this in.
05:17 And now what's going to happen is that
05:19 in the log I'm going to get the X-Forwarded-For headers
05:24 For for Proto and for Ports.
05:27 So let's save this file.
05:29 So Control + X + Y, Enter,
05:32 and now my file has been edited
05:34 and now I need to just reload my Apache server
05:38 to take this configuration file into accounts.
05:42 So this has been reloaded
5. 直连时字段为空，经 ALB 时显示 IP、HTTP 与 80
时间范围：05:43–07:01
总结 / Summary
中文
刷新 EC2 Public IP 时，三个新增字段为空，因为请求没有经过 ALB。刷新 ALB DNS 页面后，日志出现真实客户端 Public IP、协议 http 与端口 80；连续多次访问仍正确填充。这一对比证明 X-Forwarded Header 是 ALB 在转发时注入，而不是 EC2/Apache 自行推断。
English
When the EC2 public IP is refreshed directly, the three new fields are empty because the request did not pass through the ALB. After refreshing the ALB DNS page, the log contains the real client public IP, protocol http, and port 80, consistently across repeated requests. This proves that the ALB injects the X-Forwarded headers during forwarding rather than EC2 or Apache inferring them.
Transcript
05:43 and now I'm going to tell
05:45 the access log and see what happens.
05:48 So if I tell the access log right now,
05:50 and I'm going to go onto my EC2 Instance,
05:53 so this IP address and refresh.
05:56 So this still works,
05:57 and if I go into EC2 Instance Connect, as you can see,
06:00 I get new log lines about Mozilla.
06:03 So it's my web browser, and as you can see,
06:05 the first three lines are just empty.
06:07 So this is empty lines
06:10 and this means that the headers are currently empty.
06:13 That makes sense because I'm going directly
06:15 onto the instance.
06:16 But if I now make a request
06:18 onto my application Load Balancer,
06:21 and refresh this page, I just did it once
06:24 and go back to my EC2 Instance Connect.
06:26 As you can see right here, there is an IP address.
06:30 This is my own personal IP address.
06:32 Then we have http.
06:33 That's the protocol I've used
06:36 and 80, which is the port I used.
06:38 So when we go through the ALB,
06:40 I'm going to refresh it several times so you see.
06:43 So when I go through the ALB, as you can see,
06:46 my three headers right here are set correctly
06:50 to what the values should be.
06:52 So this is the whole power
06:53 of the X-Forwarded-For Forwarded-Proto type of headers.
06:57 And you've seen right now a demo of how this works.
07:00 So this is pretty cool.
6. 实验结束后终止 EC2 并删除 ALB
时间范围：07:01–07:14
总结 / Summary
中文
Hands-on 创建了会持续占用或计费的 EC2 与 ALB。验证完成后应 Terminate My Web Server，并删除 demo-alb（连同不再需要的 Target Group 与 Security Group），避免遗留资源和后续费用。
English
The hands-on creates EC2 and ALB resources that continue running or incurring cost. After verification, terminate My Web Server and delete demo-alb, along with the target group and security groups if no longer needed, to avoid orphaned resources and ongoing charges.
Transcript
07:01 Now to finish this hands-on
07:03 of course, because we've started some stuff,
07:04 please make sure to terminate your EC2 instance
07:07 as well as deleting your ALB.
07:10 Alright, that's it, I hope you liked it
07:12 and I will see you in the next lecture.
整讲总结 / Overall Summary
中文
本实验用 Amazon Linux/httpd 构建 Web Server，通过 Internet-facing ALB、HTTP Listener 与 Target Group 转发访问，并在 Apache LogFormat 中加入 X-Forwarded-For、Proto、Port。直连 EC2 时三个字段为空，经 ALB 时分别显示客户端 IP、http 和 80，直观验证了 Header 注入行为；结束后务必清理 EC2 与 ALB。
English
This lab builds an Amazon Linux/httpd web server, publishes it through an internet-facing ALB with an HTTP listener and target group, and adds X-Forwarded-For, Proto, and Port to Apache LogFormat. Direct EC2 access leaves the fields empty, while ALB access shows the client IP, http, and port 80, directly verifying header injection. Clean up EC2 and ALB resources afterward.
返回顶部 ↑