Purpose of This Lesson

This hands-on lesson builds a working EC2 web tier using only the AWS Command Line Interface from AWS CloudShell. The workflow creates a security group, launch template, Auto Scaling group (ASG), target group, Application Load Balancer (ALB), listener, and ASG-to-target-group integration.

The lab is especially useful for AWS Certified CloudOps Engineer Associate (SOA-C03) preparation because it connects individual AWS resources into an operationally useful, highly available service. The important skill is recognizing the creation order, required identifiers, and the relationship between the ASG, target group, and load balancer.

Key Concepts

• Launch template: Defines how EC2 instances are launched, including the AMI, security group, and user data.
• User data: A shell script supplied to instances during launch. In this lab, the script installs or configures the web service used to verify the deployment.
• Base64 encoding: The user-data script is Base64 encoded because that is the format required when it is supplied in the launch template creation workflow.
• Auto Scaling group: Uses the launch template to maintain two instances across selected subnets in the default VPC.
• Application Load Balancer: Receives HTTP traffic and distributes it to registered, healthy targets.
• Target group: Defines the backend targets and health-check context for the ALB. This lab uses HTTP on port 80.
• Listener: Accepts client traffic on the ALB. The lab creates an HTTP listener on port 80 whose default action forwards requests to the target group.
• Amazon Resource Names (ARNs): The listener workflow requires the ALB ARN and target group ARN.
• Subnet IDs and Availability Zones: The ASG and ALB require subnet placement. The lab retrieves subnet IDs for US East 1A and US East 1B from the default VPC.

AWS CLI Deployment Workflow

1. Open AWS CloudShell and prepare the security group

Run the AWS CLI from CloudShell. Create a security group with aws ec2 create-security-group, supplying its name, description, and region.

Then add inbound rules with aws ec2 authorize-security-group-ingress:

• TCP port 22 for SSH from any source address.
• TCP port 80 for HTTP from any source address.

The lab uses broad source addresses to make testing straightforward. This is convenient for a demonstration, but it is not a restrictive production security design.

2. Create and encode the user-data script

Create a file such as userdata.sh in CloudShell. The script is passed to each new EC2 instance through the launch template.

Encode the script with Base64 before using it in the launch-template command. The encoded value is assigned to a user-data variable and then supplied when the launch template is created.

3. Retrieve the latest AMI ID

Use the Systems Manager Parameter Store lookup through the AWS CLI ssm get-parameters command to retrieve the latest AMI ID required by the lab. The resulting AMI ID becomes an input to the launch template.

The important operational point is that the launch template needs a concrete AMI ID. The lab retrieves that value rather than manually browsing for an image in the EC2 console.

4. Create the launch template

Use aws ec2 create-launch-template and provide:

• The AMI ID.
• The security group ID.
• The Base64-encoded user data.
• A launch template name, shown in the lab as LT1.

The command returns a launch template ID and version information. Launch templates are versioned, so future configuration changes can be published as new versions rather than overwriting the existing version.

5. Discover the default VPC and subnets

Use the VPC description command to obtain the default VPC ID. Then use the subnet description command with the VPC and the desired Availability Zones, US East 1A and US East 1B, to return the corresponding subnet IDs.

The ASG and ALB creation commands use subnet IDs rather than Availability Zone names alone. Copy the correct IDs carefully and replace every relevant placeholder in the command file.

6. Create the Auto Scaling group

Use aws autoscaling create-auto-scaling-group with the launch template, the selected subnet IDs, and the desired capacity defined by the lab. The resulting ASG is named ASG1 and launches two instances.

After creation, verify that both instances reach the running state and have the intended security group. You can also test an instance directly over HTTP using its public IP address. The lab’s web response identifies the Availability Zone, which helps demonstrate that requests can reach instances in different zones.

7. Create the target group

Use aws elbv2 create-target-group to create TG1 with:

• Protocol: HTTP.
• Port: 80.
• The default VPC ID.

Immediately after creation, the target group may have no registered targets. That is expected because the ASG has not yet been attached to it.

8. Create the Application Load Balancer

Use aws elbv2 create-load-balancer with the ALB name, the selected subnet IDs, and the security group. The ALB begins in a provisioning state.

At this point, the ALB exists but does not yet have a listener. Creating the load balancer alone does not make it forward HTTP requests.

9. Create the HTTP listener

Use aws elbv2 create-listener with:

• The ALB ARN.
• Protocol HTTP.
• Port 80.
• A default forward action targeting the target group ARN.

The listener is the component that accepts client HTTP traffic and forwards it to the configured target group.

10. Attach the target group to the ASG

Use aws autoscaling attach-load-balancer-target-groups, specifying the ASG name and target group ARN. This integration causes instances launched by the ASG to be registered with the target group.

After attachment, refresh the target group and check the Targets view. The instances should become healthy after registration and health checks succeed.

11. Test through the ALB

Copy the ALB DNS name and open it in a browser. Repeated requests should return responses from instances in US East 1A and US East 1B, demonstrating that the load balancer is distributing traffic across healthy ASG instances.

When the lab is complete, delete the ASG and ALB and any other chargeable resources unless they are needed for the next lifecycle-hook lab. The source lesson specifically advises leaving them running if continuing directly to that lab.

Exam- or Assessment-Relevant Takeaways

• A launch template must exist before an ASG can use it to launch the lab instances.
• The ALB, target group, and listener are separate resources and must be created and connected explicitly.
• Creating a target group does not automatically register ASG instances.
• Creating an ALB does not automatically create a listener.
• The listener forwards to a target group by ARN, while ASG integration uses the ASG name and target group ARN.
• If targets are not present or healthy, verify the ASG-to-target-group attachment, instance security group, HTTP port 80, and health-check reachability.
• Subnet IDs must match the intended VPC and Availability Zones. A copy/paste error in a subnet ID can prevent ASG creation.
• Launch templates support versioning, allowing updated launch configurations to be published as new versions.
• The lab’s SSH and HTTP rules allow traffic from any source. Recognize this as a testing choice, not a recommendation for least-privilege production access.

Tool / Feature Decision Guide

Need	AWS CLI resource or command family	Decisive reason
Define instance startup configuration	EC2 launch template	Stores the AMI, security group, and user data used by new instances
Maintain a fixed number of instances	Auto Scaling group	Launches and manages the desired instance capacity
Group backend instances for load balancing	ELBv2 target group	Provides the backend destination and health status
Accept client HTTP requests	ALB listener	Listens on port 80 and applies the forwarding action
Distribute traffic across instances	Application Load Balancer	Uses the listener and healthy target group members
Connect ASG instances to the load balancer	attach-load-balancer-target-groups	Registers instances launched by the ASG with the target group
Find the current lab AMI	Systems Manager get-parameters lookup	Retrieves the AMI ID used by the launch template workflow
Find network placement values	VPC and subnet description commands	Returns the VPC ID and subnet IDs required by later commands

Common Traps / Misconceptions

• Trap: Assuming the target group automatically contains ASG instances. The ASG must be explicitly attached to the target group.
• Trap: Assuming an ALB automatically forwards traffic after creation. A listener is still required.
• Trap: Confusing subnet names with subnet IDs. The creation commands require the actual subnet IDs.
• Trap: Supplying the wrong VPC. The target group and subnets must belong to the intended VPC.
• Trap: Forgetting Base64 encoding. The user-data value must be encoded for the launch-template workflow used in this lab.
• Trap: Testing too early. Instances must be running and must pass target-group health checks before the ALB can route successfully.
• Trap: Copying an incomplete identifier. A missing character in a subnet ID or ARN can cause a command to fail or reference the wrong resource.
• Trap: Treating broad ingress as secure. SSH and HTTP from any source simplify the lab but expose the resources broadly.
• Trap: Leaving resources running unintentionally. The ASG and ALB can create charges; clean them up unless the next lab depends on them.

Real-World Engineer / Analyst Notes

• Keep the deployment inputs organized: security group ID, AMI ID, launch template ID or name, VPC ID, subnet IDs, ALB ARN, and target group ARN. Most later commands depend on values returned by earlier commands.
• Prefer querying AWS for identifiers instead of manually copying values from the console when building repeatable CLI workflows.
• Validate each layer independently: instance state and web response, target registration and health, listener configuration, and finally ALB DNS behavior.
• When a CLI command fails with a syntax error, inspect the assembled command first. In the lab, a stray character and an incomplete subnet ID caused failures unrelated to AWS architecture.
• Use the ALB DNS name for normal client testing. Direct instance-IP testing is useful for isolating web-server or security-group issues, but it bypasses the load-balancing path.
• For production designs, narrow SSH access and consider restricting backend HTTP access to the ALB security group rather than allowing port 80 from every source. The lab does not implement that tighter arrangement.

Quick Reference Summary

1. Create a security group with TCP 22 and TCP 80 ingress.
2. Save the user-data script in CloudShell and Base64 encode it.
3. Retrieve the AMI ID with Systems Manager parameters.
4. Create launch template LT1 with the AMI, security group, and user data.
5. Retrieve the default VPC ID and subnet IDs for US East 1A and US East 1B.
6. Create ASG ASG1 with two instances using the launch template.
7. Create target group TG1 for HTTP port 80.
8. Create the ALB in the selected subnets.
9. Create an HTTP port-80 listener forwarding to TG1.
10. Attach the target group to ASG1.
11. Wait for healthy targets and test using the ALB DNS name.
12. Delete chargeable resources when the lab sequence is finished.

Flashcards

Q: Which resources must be connected before an ALB can distribute HTTP traffic to ASG instances?
A: The ALB needs an HTTP listener, the listener needs a target group as its forwarding destination, and the ASG must be attached to that target group so its instances are registered.

Q: Why is a launch template created before the Auto Scaling group in this lab?
A: The ASG uses the launch template to know which AMI, security group, and user data to apply when launching instances.

Q: When would you use the ALB DNS name instead of an instance public IP for testing?
A: Use the ALB DNS name to test the complete load-balancing path and distribution across healthy targets. Use an instance IP mainly to isolate instance or web-service problems.

Q: What is the purpose of Base64 encoding the user-data script?
A: The encoded script is supplied as the user-data value in the launch-template creation workflow.

Q: A target group exists but shows no targets. What is the most likely missing step in this lab?
A: The ASG has not yet been attached to the target group with aws autoscaling attach-load-balancer-target-groups.

Q: What is the difference between creating an ALB and creating an ALB listener?
A: The ALB provides the load-balancing resource, while the listener defines where client traffic is accepted and what action is taken. The lab explicitly creates an HTTP port-80 listener after the ALB.

Q: Which identifiers are needed to create the listener in this workflow?
A: The ALB ARN and the target group ARN. The listener uses them to define the HTTP endpoint and forwarding destination.

Q: Why does the lab retrieve subnet IDs for US East 1A and US East 1B?
A: Those subnet IDs provide the network placement values used to create the ASG and ALB across the selected Availability Zones.

Q: What does launch-template versioning allow an operator to do?
A: It allows configuration changes to be published as new launch-template versions while retaining the existing version history.

Q: An ASG creation command fails after subnet values were copied. What should you check first?
A: Check that every subnet placeholder was replaced with the complete subnet ID, that no spaces or stray characters were introduced, and that the subnets belong to the selected VPC.

Q: Why can the ALB exist while its listener view is empty?
A: Creating the ALB alone does not create a listener. The HTTP listener must be created separately.

Q: What protocol and port does the lab use for both the web service and load-balancer path?
A: HTTP on TCP port 80.

Q: What security-group rule supports direct troubleshooting access to the instances?
A: TCP port 22 from any source supports SSH troubleshooting in the lab. This broad rule should not automatically be treated as a production recommendation.

Q: What must be true before an ALB request is expected to succeed through the target group?
A: The instances must be running, registered with the target group, and healthy according to the target-group health checks.

Q: What operational action should be taken after the lab if the resources are no longer needed?
A: Delete the Auto Scaling group and Application Load Balancer, along with other lab resources as appropriate, to remove chargeable elements. Keep them running only when required by the next lab.

Practice Questions

Question 1

An engineer creates TG1 and an ALB, then creates an HTTP listener that forwards to TG1. The target group still shows zero targets. Which action should be performed next?

A. Create another listener on port 443
B. Attach the target group to ASG1
C. Recreate the default VPC
D. Encode the ALB DNS name with Base64

Correct answer: B. The target group does not automatically receive ASG instances. The ASG must be attached to the target group with attach-load-balancer-target-groups.

Question 2

A command intended to create the ASG fails because a subnet cannot be found. The engineer copied the subnet value from a CLI table but omitted the final character. What is the best diagnosis?

A. The ALB listener has the wrong default action
B. The target group protocol must be HTTPS
C. The subnet ID is incomplete or incorrect
D. The user-data script was not Base64 encoded

Correct answer: C. A truncated subnet ID prevents the command from identifying the requested subnet. Identifier completeness and exact copy/paste are critical in CLI workflows.

Question 3

Two instances are running and respond successfully when accessed directly by public IP. However, the ALB DNS name does not return the web page, and the ALB has no listeners. Which resource is missing?

A. Launch template
B. Target group
C. Listener
D. Security-group description

Correct answer: C. An ALB without a listener has no configured client-facing port or forwarding action, even if the ALB and backend instances already exist.

Question 4

A learner wants to confirm that the ALB is distributing requests across the two instances in different Availability Zones. Which test is most appropriate?

A. Open the ALB DNS name and observe responses from both Availability Zones
B. Query only the launch-template version
C. Delete the target group before testing
D. Connect only through SSH to one instance

Correct answer: A. The ALB DNS name exercises the listener and target-group path; the lab’s web response identifies the serving Availability Zone, allowing distribution to be observed.

WordPress Metadata

Suggested Slug:
create-asg-alb-with-aws-cli

Meta Description:
A practical AWS CLI lab guide for building a launch template, Auto Scaling group, Application Load Balancer, listener, and target group integration.

Tags:
AWS CLI, AWS CloudShell, EC2, Auto Scaling Groups, Application Load Balancer, Launch Templates, Target Groups, VPC, Security Groups, High Availability, SOA-C03