[Yandex Cloud documentation](../../index.md) > [Yandex Application Load Balancer](../index.md) > [Step-by-step guides](index.md) > L7 load balancers > Creating an L7 load balancer

# Creating an L7 load balancer

To create an [L7 load balancer](../concepts/application-load-balancer.md):

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to create a load balancer.
  1. Navigate to **Application Load Balancer**.
  1. Click **Create L7 load balancer** and select **Manual**.
  1. Specify the load balancer name.
  1. Under **Network settings**, select:
     1. [Network](../../vpc/concepts/network.md#network) whose [subnets](../../vpc/concepts/network.md#subnet) will host load balancer nodes.
     1. Relevant [security groups](../concepts/application-load-balancer.md#security-groups):

        * `No groups`: Allows any incoming and outgoing traffic for the load balancer. This is the least secure option.
        * `Auto`: The load balancer creation process automatically provisions a security group allowing any incoming traffic on port `80` and TCP health check traffic on port `30080`. This security group also allows any outgoing traffic from the load balancer.
        * `From list`: For more traffic management flexibility, [create](../../vpc/operations/security-group-create.md) your own security groups. You can assign up to five security groups to your load balancer.

        {% note info %}
        
          Security group rules must specify IP ranges in CIDR format. You cannot assign a group that uses a different security group.
        
          {% endnote %}

  1. Under **Allocation**, select the load balancer node subnets in different [availability zones](../../overview/concepts/geo-scope.md) and enable their traffic.

      If you do not want to create a load balancer node in a specific availability zone, click ![xmark](../../_assets/console-icons/xmark.svg) next to it.


  1. Optionally, under **Allocation**, enable or disable incoming traffic for each availability zone using **Receive traffic**.

  1. Optionally, under **Autoscaling settings**, set the [resource unit](../concepts/application-load-balancer.md#lcu-scaling) limit.

     Resource units will scale automatically depending on load balancer traffic and specified limits. The number of resource units used affects the [load balancer pricing](../pricing.md).
  1. Optionally, under **Log settings**:
     1. Enable **Write logs**.
     1. Select the [Yandex Cloud Logging](../../logging/index.md) [log group](../../logging/concepts/log-group.md) where you want to store load balancer logs.
     1. Click **Add discard rule** and configure its [settings](../concepts/application-load-balancer.md#discard-logs-rules):
        * **HTTP codes**: Add HTTP status codes.
        * **HTTP code classes**: Add HTTP status code classes.
        * **gRPC codes**: Add gRPC codes.
        * **Share of discarded logs**: Set the log discard rate.

        You can add multiple rules.

  1. Under **Listeners**, click **Add listener**. Specify listener settings:
     1. Specify the listener name.
     1. Optionally, enable **Public IP address**. Set **Port** to `80` and select **Type**:
        * `Automatically`.
        * `List`: Select an address from the drop-down list that appears on the right.
     1. Optionally, enable **Internal IP address**. Specify **Port** and select **Subnet** from the drop-down list.
     1. Under **Receiving and processing traffic**, select the listener type: `HTTP` or `Stream`.

        For `HTTP`, select:
        * `Protocol`: `HTTP`, `HTTPS`, or `Redirect to HTTPS`.
        * [`HTTP router`](http-router-create.md): Select it from the drop-down list.

        For `Stream`, select a protocol:
        * `Plain-text`: Select **Backend groups** from the drop-down list.
        * `Encrypted`: Under **Main listener**, select **Certificates** and **Backend groups** from the drop-down lists.
  1. Add more listeners if needed.
  1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the [CLI](../../cli/index.md) command for creating an L7 load balancer:

     ```bash
     yc alb load-balancer create --help
     ```

  1. Run this command:

     ```bash
     yc alb load-balancer create <load_balancer_name> \
       --network-name <network_name> \
       --security-group-id <list_of_security_group_IDs> \
       --location subnet-name=<subnet_name>,zone=<availability_zone>
     ```

     Where:
     * `<load_balancer_name>`: New load balancer name.
     * `--network-name`: Name of the network containing the load balancer.
     * `--security-group-id`: Comma separated list of one to five [security group](../concepts/application-load-balancer.md#security-groups) IDs. This is an optional setting. If you skip it, the load balancer will accept all traffic.
     * `--location`: Subnet and availability zone. You can add this option multiple times to specify different availability zones and subnets.

     Result:

     ```text
     done (1m40s)
     id: a5d88ep483cm********
     name: test-balancer2
     folder_id: aoe197919j8e********
     status: ACTIVE
     region_id: ru-central1
     network_id: c64l1c06d151********
     allocation_policy:
       locations:
       - zone_id: ru-central1-a
         subnet_id: buc4gsmpj8hv********
     log_group_id: eolul9ap0bv0********
     security_group_ids:
       - enpulh2tbrep********
       - enpg05a3ck35********
     created_at: "2021-04-26T12:12:13.624832586Z"
     ```

  1. Optionally, set the [resource unit](../concepts/application-load-balancer.md#lcu-scaling) limit:

     1. See the description of the CLI command for setting up limits:
     
        ```bash
        yc alb load-balancer autoscale --help
        ```
     
     1. Specify limits by running this command:
     
        ```bash
        yc alb load-balancer autoscale <load_balancer_name_or_ID> \
          --min-zone-size <resource_unit_minimum_per_zone> \
          --max-size <resource_unit_maximum_total>
        ```
     
        Where:
     
        * `--min-zone-size`: Resource unit minimum per availability zone The default minimum is 2. You cannot set a minimum below 2.
        * `--max-size`: Resource unit maximum total. By default, it is unlimited. Make sure this value is no less than (number of load balancer availability zones) × (minimum number of resource units per zone).
     
        You can specify one or both settings at once using this command.
     
        For example:
     
        ```bash
        yc alb load-balancer autoscale test-balancer2 \
          --min-zone-size 3 \
          --max-size 10
        ```
     
        Result:
     
        ```text
        id: a5d88ep483cm********
        name: test-balancer2
        folder_id: aoe197919j8e********
        status: ACTIVE
        region_id: ru-central1
        network_id: c64l1c06d151********
        allocation_policy:
          locations:
            - zone_id: ru-central1-a
              subnet_id: buc4gsmpj8hv********
        created_at: "2022-06-02T12:12:13.624832586Z"
        auto_scale_policy:
          min_zone_size: 3
          max_size: 10
        ```

  1. Optionally, configure [Yandex Cloud Logging](../../logging/index.md) [settings](../logs-ref.md):
     1. See the description of the CLI command for enabling load balancer logging:

        ```bash
        yc alb load-balancer logging --help
        ```

     1. Specify the load balancer log group and set up a [log discard rule](../concepts/application-load-balancer.md#discard-logs-rules):

        ```bash
        yc alb load-balancer logging <load_balancer_name> \
          --log-group-id <log_group_ID> \
          --enable \
          --discard codes=[<HTTP_code>,<HTTP_code_class>,<gRPC_code>],percent=<discarded_log_percentage>
        ```

        Where:
        * `--log-group-id`: [Log group](../../logging/concepts/log-group.md) ID.
        * `--discard`: Log discard rule. Rule options:
          * `codes`: HTTP codes, HTTP code classes, or gRPC codes.
          * `percent`: Log discard rate.

        You can add multiple rules.

        Result:

        ```text
        done (42s)
        id: ds76g83js9gf********
        name: test-load-balancer
        ...
        log_options:
          log_group_id: e23p9bfjvsgr********
          discard_rules:
            - http_codes:
                - "200"
              http_code_intervals:
                - HTTP_3XX
              grpc_codes:
                - OK
              discard_percent: "90"
        ```

  1. Add a listener to an L7 load balancer:
     * HTTP listener.
       1. See the description of the CLI command for adding an HTTP listener to an L7 load balancer:

          ```bash
          yc alb load-balancer add-listener --help
          ```

       1. Add a listener by running this command:

          ```bash
          yc alb load-balancer add-listener <load_balancer_name> \
            --listener-name <listener_name> \
            --http-router-id <HTTP_router_ID> \
            --external-ipv4-endpoint port=<listener_port>
          ```

     * Stream listener.
       1. See the description of the CLI command for adding a Stream listener to an L7 load balancer:

          ```bash
          yc alb load-balancer add-stream-listener --help
          ```

       1. Add a listener by running this command:

          ```bash
          yc alb load-balancer add-stream-listener <load_balancer_name> \
            --listener-name=<listener_name> \
            --backend-group-id=<backend_group_ID> \
            --external-ipv4-endpoint port=<listener_port>
          ```

     The result of adding two listeners:
 
     ```text
     done (42s)
     id: ds76g8b2op3f********
     name: test-load-balancer
     folder_id: b1gu6g9ielh6********
     status: ACTIVE
     network_id: enp0uulja5s3********
     listeners:
     - name: tslistener
       endpoints:
       - addresses:
         - external_ipv4_address:
             address: 51.250.64.197
         ports:
         - "80"
       http:
         handler:
           http_router_id: ds7d7b14b3fs********
     - name: teststreamlistener
       endpoints:
       - addresses:
         - external_ipv4_address:
             address: 51.250.64.197
         ports:
         - "443"
       stream:
         handler:
           backend_group_id: ds77tero4f5h********
     allocation_policy:
       locations:
       - zone_id: ru-central1-a
         subnet_id: e9bs1hp7lgdl********
     log_group_id: ckgs4u5km3u8********
     security_group_ids:
     - enp49ot04g63********
     created_at: "2022-04-04T02:12:40.160629110Z"
     log_options:
       log_group_id: e23p9bfjvsgr********
       discard_rules:
         - http_codes:
             - "200"
           http_code_intervals:
             - HTTP_3XX
           grpc_codes:
             - OK
           discard_percent: "90"
     ```

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  1. In the configuration file, describe the resources you want to create:

      ```hcl
      resource "yandex_alb_load_balancer" "test-balancer" {
        name        = "<L7_load_balancer_name>"
        network_id  = "<network_ID>"
        security_group_ids = ["<list_of_security_group_IDs>"]

        allocation_policy {
          location {
            zone_id   = "<availability_zone>"
            subnet_id = "<subnet_ID>" 
          }
        }

        # HTTP listener
        listener {
          name = "<HTTP_listener_name>"
          endpoint {
            address {
              external_ipv4_address {
              }
            }
            ports = [<port>]
          }
          http {
            handler {
              http_router_id = "<HTTP_router_ID>"
            }
          }
        }

        # Stream listener
        listener {
          name = "<Stream_listener_name>"
          endpoint {
            address {
              external_ipv4_address {
              }
            }
            ports = [<port>]
          }
          stream {
            handler {
              backend_group_id = "<backend_group_ID>"
              idle_timeout     = "<timeout>"
            }
          }
        }

        # TLS listener
        listener {
          name = "<TLS_listener_name>"
          endpoint {
            address {
              external_ipv4_address {
              }
            }
            ports = [<port>]
          }
          tls {
            default_handler {
              certificate_ids = ["<certificate_IDs>"]
              stream_handler {
                backend_group_id = "<backend_group_ID>"
                idle_timeout     = "<timeout>"
              }
            }
            sni_handler {
              name         = "SNI_listener_name"
              server_names = ["server_names"]
              handler {
                certificate_ids = ["<certificate_IDs>"]
                stream_handler {
                  backend_group_id = "<backend_group_ID>"
                  idle_timeout     = "<timeout>"
                }
              }
            }
          }
        }

        log_options {
          log_group_id = "<log_group_ID>"
          discard_rule {
            http_codes          = ["<HTTP_code>"]
            http_code_intervals = ["<HTTP_code_class>"]
            grpc_codes          = ["<gRPC_code>"]
            discard_percent     = <discarded_log_percentage>
          }
        }
      }
      ```

      Where:

       * `name`: L7 load balancer name. Follow these naming requirements:

          * Length: between 3 and 63 characters.
          * It can only contain lowercase Latin letters, numbers, and hyphens.
          * It must start with a letter and cannot end with a hyphen.

      * `network_id`: ID of the network that will host your load balancer.
      * `security_group_ids`: Comma separated list of one to five [security group](../concepts/application-load-balancer.md#security-groups) IDs. This is an optional setting.

          If you skip it, the load balancer will accept all traffic.

      * `allocation_policy`: L7 load balancer's [node location](../concepts/application-load-balancer.md#lb-location). Specify the availability zones and subnet IDs.
      * `listener`: Description of parameters for the L7 load balancer [listener](../concepts/application-load-balancer.md#listener). This is an optional setting. You can specify one or multiple listeners.

          * `name`: Listener name. The name format is as follows:

              * Length: between 3 and 63 characters.
              * It can only contain lowercase Latin letters, numbers, and hyphens.
              * It must start with a letter and cannot end with a hyphen.

          * `endpoint`: Listener addresses and ports. Specify the external IPv4 address and port for receiving traffic. If the `external_ipv4_address` setting is not specified, a public IP address will be assigned automatically.
          * `ports`: One or multiple ports. Listener ports must not match.
          * `http`: Listener HTTP endpoint description.

              * `http_router_id`: HTTP router ID.

        * `stream`: Listener Stream endpoint description.

            * `backend_group_id`: ID of the `Stream`-type backend group to forward the incoming TCP connections to.
            * `idle_timeout`: Idle timeout to close the connection when it expires. This is an optional setting. The possible values are, e.g., `"10s"`, `"5m"`, or `"1h"`. Set `"0"` to have no timeout. The default value is one hour.

        * `tls`: TLS listener description.

            * `default_handler`: Default TLS listener.

                * `certificate_ids`: List of Yandex Certificate Manager [certificate](../../certificate-manager/concepts/index.md#types) IDs.
                * `stream_handler`: Stream listener settings.

                    * `backend_group_id`: ID of the `Stream`-type backend group.
                    * `idle_timeout`: Idle timeout to close the connection when it expires. This is an optional setting. The possible values are, e.g., `"10s"`, `"5m"`, `"1h"`. Set `"0"` to have no timeout. The default value is one hour.

            * `sni_handler`: SNI listener description.

                * `name`: Listener name. The name format is as follows:

                  * Length: between 3 and 63 characters.
                  * It can only contain lowercase Latin letters, numbers, and hyphens.
                  * It must start with a letter and cannot end with a hyphen.

                * `server_names`: Names of servers that the SNI listener is mapped to.
                * `handler`: SNI listener settings:

                    * `certificate_ids`: List of Yandex Certificate Manager certificate IDs.
                    * `stream_handler`: Stream listener settings.

                        * `backend_group_id`: ID of the `Stream`-type backend group.
                        * `idle_timeout`: Idle timeout to close the connection when it expires. This is an optional setting. The possible values are, e.g., `"10s"`, `"5m"`, `"1h"`. Set `"0"` to have no timeout. The default value is one hour.

      * `log_options`: Optional [logging](../logs-ref.md) settings for [Yandex Cloud Logging](../../logging/index.md):

          * `log_group_id`: [Log group](../../logging/concepts/log-group.md) ID.
          * `discard_rule`: [Log discard rule](../concepts/application-load-balancer.md#discard-logs-rules).

            * `http_codes`: HTTP codes.
            * `http_code_intervals`: HTTP code classes.
            * `grpc_codes`: gRPC codes.
            * `discard_percent`: Log discard rate.

            You can add multiple rules.

      For more information about `yandex_alb_load_balancer` properties in Terraform, see [this Terraform article](../../terraform/resources/alb_load_balancer.md).

  1. Make sure the configuration files are correct.

      1. In the terminal, navigate to the directory where you created your configuration file.
      1. Run a check using this command:

          ```bash
          terraform plan
          ```

      If the configuration is correct, the terminal will display a list of the resources and their settings. Otherwise, Terraform will show any detected errors.

  1. Deploy the cloud resources.

      1. If the configuration is correct, run this command:

          ```bash
          terraform apply
          ```

      1. Confirm creating the resources by typing `yes` and pressing **Enter**.

          This will create all the resources you need in the specified folder. You can check your new resources and their settings in the [management console](https://console.yandex.cloud) or using this [CLI](../../cli/index.md) command:

          ```bash
          yc alb load-balancer list
          ```

          {% note warning "Timeouts" %}
          
          The Terraform provider limits operations with Application Load Balancer load balancers to 10 minutes.
          
          Operations in excess of this time will be interrupted.
          
          {% cut "How do I modify these limits?" %}
          
          Add the `timeouts` section to the load balancer description, e.g.:
          
          ```hcl
          resource "yandex_alb_load_balancer" "<load_balancer_name>" {
            ...
            timeouts {
              create = "60m"
              update = "60m"
              delete = "60m"
            }
          }
          ```
          
          {% endcut %}
          
          {% endnote %}

- API {#api}

  Use the [create](../api-ref/LoadBalancer/create.md) REST API method for the [LoadBalancer](../api-ref/LoadBalancer/index.md) resource or the [LoadBalancer/Create](../api-ref/grpc/LoadBalancer/create.md) gRPC API call.

{% endlist %}