[Yandex Cloud documentation](../../index.md) > [Yandex Application Load Balancer](../index.md) > [Step-by-step guides](index.md) > Backend groups > Editing a backend group

# Editing a backend group

## Update group basic settings {#update-group}

{% list tabs group=instructions %}

- Management console {#console}

  {% note info %}

  To change the [group type](../concepts/backend-group.md#group-types), you need to use different tools, such as the [CLI](../../cli/index.md), Terraform, API.

  {% endnote %}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) with your [backend group](../concepts/backend-group.md).
  1. Navigate to **Application Load Balancer**.
  1. In the left-hand panel, select ![image](../../_assets/console-icons/cubes-3-overlap.svg) **Backend groups**.
  1. Click your group name.
  1. Click ![image](../../_assets/console-icons/pencil.svg) **Edit**.
  1. Edit group settings:
     * Backend group **Name** and **Description**.
     * **Session affinity**: If you select this option, the same endpoint will process all requests within one user session.

       {% note info %}
       
       Currently, session affinity only works for a single active backend in a group, containing at least one target group and using the `MAGLEV_HASH` [load balancing mode](../concepts/backend-group.md#balancing-mode).
       
       {% endnote %}

       `HTTP` and `gRPC` backend groups support the following session affinity modes:
       * `By IP address`.
       * `By HTTP header`.
       * `By cookie`.

       `Stream` backend groups only support session affinity by [IP address](../../vpc/concepts/address.md).

       For more information about session affinity and its modes, see [this section](../concepts/backend-group.md#session-affinity).
  1. Click **Save** at the bottom of the page.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the [CLI](../../cli/index.md) command for updating [backend group](../concepts/backend-group.md) basic settings:

     ```bash
     yc alb backend-group update --help
     ```

  1. Run this command:

     ```bash
     yc alb backend-group update \
       --name <backend_group_name> \
       --new-name <new_backend_group_name> \
       --description <backend_group_description> \
       --labels key=value[,<key>=<label_value>] \
       --connection-affinity source-ip=<IP_address_session_affinity_mode>
     ```

     Where:
     * `--name`: Backend group name.
     * `--new-name`: Backend group new name. The naming requirements are as follows:

       * The name must be from 3 to 63 characters long.
       * It may contain uppercase and lowercase Latin and Cyrillic letters, numbers, hyphens, underscores, and spaces.
       * The first character must be a letter. The last character cannot be a hyphen, underscore, or space.

     * `--description`: Backend group description. This is an optional setting.
     * `--labels key=value`: Labels in `key=value` format. This is an optional setting.
     * `--connection-affinity`: [Session affinity](../concepts/backend-group.md#session-affinity) by the `source-ip` [IP address](../../vpc/concepts/address.md). It can be either `true` or `false`. This is an optional setting. You can also use the following modes:
       * `--cookie-affinity`: Cookie affinity. Available parameters:
         * `name`: Cookie name. This is a required setting.
         * `path`: Path to the website section where the cookie will apply. If no path is set, requests from the same user may go to different backends.
         * `ttl`: Cookie lifetime.
       * `--header-affinity` (by HTTP header): In the `name` parameter, specify the request header name to use for affinity.

       But you can only specify one mode. For [Stream](../concepts/backend-group.md#group-types) backend groups, you can only use `--connection-affinity` mode.

       {% note info %}
       
       Currently, session affinity only works for a single active backend in a group, containing at least one target group and using the `MAGLEV_HASH` [load balancing mode](../concepts/backend-group.md#balancing-mode).
       
       {% endnote %}

     Result:

     ```text
     id: ds7mi7mlqgct********
     name: <backend_group_name>
     description: update
     folder_id: b1g6hif00bod********
     labels:
       bar: buz
       foo: buz
     http:
       backends:
       - name: <backend_name>
         backend_weight: "2"
         load_balancing_config:
           panic_threshold: "90"
         port: "80"
         target_groups:
           target_group_ids:
           - ds75pc3146dh********
         healthchecks:
         - timeout: 10s
           interval: 2s
           healthy_threshold: "10"
           unhealthy_threshold: "15"
           healthcheck_port: "80"
           http:
             host: <host_address>
             path: <path>
       connection:
         source_ip: true
     created_at: "2022-11-30T17:46:05.599491104Z"
     ```

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  1. Open the Terraform configuration file and edit the fragment describing the [backend group](../concepts/backend-group.md):

     ```hcl
     resource "yandex_alb_backend_group" "test-backend-group" {
       name        = "<backend_group_name>"
       description = "<backend_group_description>"
       labels      = {
         new-label = "test-label"
       }
       session_affinity {
         connection {
           source_ip = <IP_address_session_affinity_mode>
         }
       }
     ...
     }
     ```

     Where `yandex_alb_backend_group` includes backend group settings:
     * `name`: Backend group name.
     * `description`: Backend group description. This is an optional setting.
     * `labels`: Labels in `key=value` format. This is an optional setting.
     * `session_affinity`: [Session affinity](../concepts/backend-group.md#session-affinity) settings. This is an optional setting. Select one of the modes:

       * `connection`: Session affinity by the `source_ip` [IP address](../../vpc/concepts/address.md). It can either be `true` or `false`.
       * `connection`: Session affinity by cookie. Specify the following settings in `<parameter_1>=<value>,<parameter_2>=<value>` format:
         * `name`: Cookie name. This is a required setting.
         * `path`: Path to the website section where the cookie will apply. If no path is set, requests from the same user may go to different backends.
         * `ttl`: Cookie lifetime, in seconds.
       * `header`: Session affinity by header. In the `header_name` parameter, specify the request header name to use for affinity.

       For `Stream` backend groups consisting of `stream_backend` resources, you can only use the `connection` affinity mode.

       {% note info %}
       
       Currently, session affinity only works for a single active backend in a group, containing at least one target group and using the `MAGLEV_HASH` [load balancing mode](../concepts/backend-group.md#balancing-mode).
       
       {% endnote %}

     For more information about `yandex_alb_backend_group` properties, see [this Terraform provider guide](../../terraform/resources/alb_backend_group.md).
  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     You can check backend group updates in the [management console](https://console.yandex.cloud) or using this [CLI](../../cli/quickstart.md) command:

     ```bash
     yc alb backend-group get --name <backend_group_name>
     ```

     {% note warning "Timeouts" %}
     
     The Terraform provider limits operations with Application Load Balancer backend groups to 10 minutes.
     
     Operations in excess of this time will be interrupted.
     
     {% cut "How do I modify these limits?" %}
     
     Add a `timeouts` section to the backend group description:
     
     ```hcl
     resource "yandex_alb_backend_group" "<backend_group_name>" {
       ...
       timeouts {
         create = "60m"
         update = "60m"
         delete = "60m"
       }
     }
     ```
     
     {% endcut %}
     
     {% endnote %}

- API {#api}

  To change [backend group](../concepts/backend-group.md) basic settings, use the [update](../api-ref/BackendGroup/update.md) REST API method for the [BackendGroup](../api-ref/BackendGroup/index.md) resource or the [BackendGroupService/Update](../api-ref/grpc/BackendGroup/update.md) gRPC API call.

{% endlist %}

## Add a backend to a group {#add-backend}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder with your backend.
  1. Navigate to **Application Load Balancer**.
  1. In the left-hand panel, select ![image](../../_assets/console-icons/cubes-3-overlap.svg) **Backend groups**.
  1. Click your group name.
  1. Click ![image](../../_assets/console-icons/plus.svg) **Create backend**.
  1. In the window that opens, specify backend settings:

     * Backend **Name**.
     * **Weight**: Backend weight in traffic distribution. If this option is disabled, the backend weight will be 0 and its endpoints will not be receiving traffic.
     * Backend **Type**: `Target group` for Application Load Balancer [target groups](../concepts/target-group.md) or `Bucket` for Object Storage [buckets](../../storage/concepts/bucket.md). This option works for `HTTP` backend groups only. `gRPC` and Stream group backends have the `Target group` backend type. For more on backend types, see [Backend types](../concepts/backend-group.md#types).
     
     * The settings described below only work for **Target group** backends:
     
       * Under **Load balancing settings**:
         
         * **Balancing mode**: [Load balancing mode](../concepts/backend-group.md#balancing-mode).
         * **Panic mode threshold**: Healthy endpoint threshold triggering [panic mode](../concepts/backend-group.md#panic-mode) when the load balancer distributes requests across all endpoints, regardless of their health status.
         * **Locality aware routing**: Share of incoming traffic the load balancer node will route to its availability zone backends. The remaining traffic is split equally between the other zones. For more information, see [Locality aware routing](../concepts/backend-group.md#locality).
         * **Strict locality**: If this option is enabled, the load balancer will return `503 Service Unavailable` if no application backends are operational in the request’s originating availability zone.
      
       * Under **Protocol settings**:
         
         * For a `HTTP` backend group:
           
           * **HTTP/2**: With this option enabled, the load balancer will use the HTTP/2 protocol when routing requests to `HTTP` group backends. By default, the load balancer uses the HTTP/1.1 protocol. `gRPC` backend groups only support the HTTP/2 protocol.
           * **Protocol**: Backend connection protocol, e.g., `HTTP` without encryption or `HTTPS` with TLS encryption. For `HTTPS`, specify:
             
             * **SNI**. SNI domain name for TLS connections.
             * **Trusted root certificate**. Specify the [root CA](https://en.wikipedia.org/wiki/Root_certificate) for the certificate chain installed on backend endpoints.
     
               The L7 load balancer supports [IETF](https://www.ietf.org/) (RFC [2459](https://www.ietf.org/rfc/rfc2459.txt)/[3280](https://www.ietf.org/rfc/rfc3280.txt)/[5280](https://www.ietf.org/rfc/rfc5280.txt)) compliant [X.509 certificates](https://en.wikipedia.org/wiki/X.509). For [ECDSA](https://en.wikipedia.org/wiki/ECDSA) certificates, only the P-256 curve is supported.
         
         * For a `gRPC` backend group:
     
           * **Protocol**: Backend connection protocol, e.g., `Plain-text` or `Encrypted`. For the encrypted protocol, specify **SNI** and **Trusted root certificate** as shown above.
         
         * For a `Stream` backend group:
           
           * **PROXY protocol**: With this option enabled, the load balancer will send its client connection metadata, e.g., its IP address, to the backend via [HAProxy](https://www.haproxy.org/download/1.9/doc/proxy-protocol.txt) protocol.
             
           * **Protocol**: Backend connection protocol, e.g., `Plain-text` or `Encrypted`. For the encrypted protocol, specify **SNI** and **Trusted root certificate** as shown above.
     
     * The following settings only work for **Bucket** backends in **HTTP** backend groups:
     
       * **Bucket ID format**: `List` or `ID`.
       * **Bucket**: Select a bucket from the list or specify its ID.
     
     * Under **HTTP health check**, **gRPC health check**, or **Stream health check** specify:
       
       * **Timeout, s**: Response timeout. Maximum connection time.
       * **Interval**: Health check request interval.
       * **Healthy threshold**: Number of consecutive successful checks required before considering the endpoint healthy. The load balancer ignores this setting at start, conducting one health check to identify the endpoint as healthy.
       * **Unhealthy threshold**: Number of consecutive failed checks required before considering the endpoint unhealthy. The load balancer ignores this setting when receiving `503 Service Unavailable` from a backend, following which it is considered unhealthy right away.
       * **Port**.
       * **Type**: Health check protocol, e.g., `HTTP`, `gRPC`, or `Stream`. The health check protocol does not need to match the backend group type. Also specify:
         
         * For the `HTTP` type:
           
           * **Path**: Endpoint request URI path.
           * **Authority**: HTTP/1.1 `Host` or HTTP/2 `:authority` header of the backend endpoint health check requests.
           * **HTTP/2**: Use HTTP v2 protocol.
           * **HTTP codes**: HTTP status codes deemed valid during a backend health check.
          
         * For the `gRPC` type:
           
           * **Service name**: Name of the gRPC service you want to check. If no service is specified, the system will check the backend overall health.
          
         * For the `Stream` type:
           
           * **Send**: Data sent to the endpoint for a health check.
           * **Receive**: Data the endpoint must return to pass the health check.
           
       {% note alert %}
       
       If all backends with health checks enabled in an availability zone fail those checks, traffic will no longer route to that zone, even if functional backends without health checks remain.
       
       We recommend configuring [health checks](../concepts/backend-group.md#health-checks) for all backends.
       
       {% endnote %}
     
       To add a health check, at the bottom of the backend section, click **Add health check** and specify the check settings.
     
       To remove a health check, click ![image](../../_assets/console-icons/ellipsis.svg) next to the **HTTP health check**, **gRPC health check**, or **Stream health check** title, and select **Delete**.

  1. Click **Add**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  Add the backend and a health check to the group.

  {% note alert %}
  
  If all backends with health checks enabled in an availability zone fail those checks, traffic will no longer route to that zone, even if functional backends without health checks remain.
  
  We recommend configuring [health checks](../concepts/backend-group.md#health-checks) for all backends.
  
  {% endnote %}

  All backends within a group must be of the same [type](../concepts/backend-group.md#group-types): `HTTP` or `Stream`.

  {% cut "HTTP backend" %}

  Run this command:

  ```bash
  yc alb backend-group add-http-backend \
    --backend-group-name <backend_group_name> \
    --name <name_of_backend_you_are_adding> \
    --weight <backend_weight> \
    --port <backend_port> \
    --target-group-id=<target_group_ID> \
    --panic-threshold 90 \
    --http-healthcheck port=80,healthy-threshold=10,unhealthy-threshold=15,expected-statuses=211,\
  timeout=10s,interval=2s,host=<host_address>,path=<path>
  ```

  Where:
  * `--name`: The name of the backend you want to add or update.
  * `--panic-threshold`: Panic mode threshold.
  * `--http-healthcheck`: Health check settings:
    * `port`: Port.
    * `healthy-threshold`: Healthy threshold.
    * `unhealthy-threshold`: Unhealthy threshold.
    * `expected-statuses`: HTTP status code deemed valid during a backend health check. You can add multiple values separated by a comma: `expected-statuses=201,expected-statuses=205,expected-statuses=302`. You can use HTTP codes in the range between `100` and `599`. If this setting is not specified, the response code will be `200`.
    * `timeout`: Maximum connection time.
    * `interval`: Interval.
    * `host`: Host address.
    * `path`: Path.

  Result:

  ```text
  id: a5dqkr2mk3rr********
  name: <backend_group_name>
  folder_id: aoe197919j8e********
  ...
          host: <host_address>
          path: <path>
  created_at: "2021-02-11T20:46:21.688940670Z"
  ```

  {% endcut %}

  {% cut "gRPC backend" %}

  Run this command:

  ```bash
  yc alb backend-group add-grpc-backend \
    --backend-group-name <backend_group_name> \
    --name <name_of_backend_you_are_adding> \
    --weight <backend_weight> \
    --port <backend_port> \
    --target-group-id=<target_group_ID> \
    --panic-threshold 90 \
    --grpc-healthcheck port=80,healthy-threshold=10,unhealthy-threshold=15,\
  timeout=10s,interval=2s,service-name=<gRPC_service_name>
  ```

  Where:
  * `--panic-threshold`: Panic mode threshold.
  * `--grpc-healthcheck`: Resource health check settings:
    * `port`: Port.
    * `healthy-threshold`: Healthy threshold.
    * `unhealthy-threshold`: Unhealthy threshold.
    * `timeout`: Maximum connection time.
    * `interval`: Interval.
    * `service-name`: Name of the gRPC service you want to check. If no service is specified, the system will check the backend overall health.

  Result:

  ```text
  id: a5dqkr2mk3rr********
  name: <backend_group_name>
  folder_id: aoe197919j8e********
  ...
            grpc:
              service_name: <gRPC_service_name>
  ...
  created_at: "2021-02-11T20:46:21.688940670Z"
  ```

  {% endcut %}

  {% cut "Stream backend" %}

  Run this command:

  ```bash
  yc alb backend-group add-stream-backend \
    --backend-group-name <backend_group_name> \
    --name <name_of_backend_you_are_adding> \
    --weight <backend_weight> \
    --port <backend_port> \
    --target-group-id=<target_group_ID> \
    --panic-threshold 90 \
    --enable-proxy-protocol \
    --keep-connections-on-host-health-failure \
    --stream-healthcheck port=80,healthy-threshold=10,unhealthy-threshold=15,\
  timeout=10s,interval=2s,send-text=<data_to_endpoint>,receive-text=<data_from_endpoint>
  ```

  Where:
  * `--panic-threshold`: Panic mode threshold.
  * `--enable-proxy-protocol`: With this option enabled, the load balancer will send its client connection metadata, e.g. its IP address, to the backend via [HAProxy](https://www.haproxy.org/download/1.9/doc/proxy-protocol.txt) protocol. If you do not set specific values for this option, the load balancer will only send its IP address to the backend.
  * `--keep-connections-on-host-health-failure`: Keeps the connection alive even if the health check fails.
  * `--stream-healthcheck`: Health check settings:
    * `port`: Port.
    * `healthy-threshold`: Healthy threshold.
    * `unhealthy-threshold`: Unhealthy threshold.
    * `timeout`: Maximum connection time.
    * `interval`: Interval.
    * `send-text`: Data sent to the endpoint for a health check.
    * `receive-text`: Data the endpoint must return to pass the health check.

  Result:

  ```text
  id: ds77tero4f5********
  name: <backend_group_name>
  folder_id: b1gu6g9ielh6********
  ...
              text: <data_to_endpoint>
            receive:
              text: <data_from_endpoint>
      enable_proxy_protocol: true
  created_at: "2022-04-06T09:17:57.104324513Z"
  ```

  {% endcut %}

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  1. Open the Terraform configuration file and add your `http_backend`, `grpc_backend`, or `stream_backend` description to the backend group section:

     ```hcl
     resource "yandex_alb_backend_group" "test-backend-group" {
       name                     = "<backend_group_name>"
     
       stream_backend {
         name                   = "<backend_name>"
         weight                 = 1
         port                   = 80
         target_group_ids       = ["<target_group_ID>"]
         load_balancing_config {
           panic_threshold      = 90
         }
         enable_proxy_protocol  = true
         healthcheck {
           timeout              = "10s"
           interval             = "2s"
           healthy_threshold    = 10
           unhealthy_threshold  = 15 
           stream_healthcheck {
             send               = "<data_to_endpoint>"
             receive            = "<data_from_endpoint>"
           }
         }
       }
     }
     ```

     Where `yandex_alb_backend_group` includes backend group settings:
     * `name`: Backend group name.
     * `http_backend`, `grpc_backend`, or `stream_backend`: [Backend type](../concepts/backend-group.md#group-types). All backends within a group must match the same type: `HTTP`, `gRPC`, or `Stream`.

     Backend parameters:
     * `name`: Backend name.
     * `port`: Backend port.
     * `weight`: Backend weight.
     * `target_group_ids`: [Target group](../concepts/target-group.md) ID. To get a list of available target groups, run the `yc alb target-group list` [CLI](../../cli/index.md) command.
     * `load_balancing_config`: Balancing parameters:
       * `panic_threshold`: Panic mode threshold.
     * `enable_proxy_protocol`: With this option enabled, the load balancer will send its client connection metadata, e.g. its IP address, to the backend via [HAProxy](https://www.haproxy.org/download/1.9/doc/proxy-protocol.txt) protocol. If you do not set specific values for this option, the load balancer will only send its IP address to the backend. This option is only available for `Stream` type backends.
     * `healthcheck`: Health check settings:
       * `timeout`: Maximum connection request timeout.
       * `interval`: Interval.
       * `healthy_threshold`: Healthy threshold.
       * `unhealthy_threshold`: Unhealthy threshold.
       * `keep_connections_on_host_health_failure`: This option maintains connections open even if the target host status changes to `Unhealthy`.
       * `http_healthcheck`: `HTTP` health check settings:
         * `path`: Path, e.g., `/health`.
         * `host`: Host address, e.g., `example.com`.
         * `expected_statuses`: List of HTTP status codes corresponding to the `Healthy` status, e.g., `[200, 201, 202]`.
       * `grpc_healthcheck`: `gRPC` health check settings:
         * `service_name`: Name of the gRPC service you want to check. If no service is specified, the system will check the backend overall health.
       * `stream_healthcheck`: `Stream` health check settings:
         * `send`: Data sent to the endpoint for a health check.
         * `receive`: Data the endpoint must return to pass the health check.
     
       {% note alert %}
       
       If all backends with health checks enabled in an availability zone fail those checks, traffic will no longer route to that zone, even if functional backends without health checks remain.
       
       We recommend configuring [health checks](../concepts/backend-group.md#health-checks) for all backends.
       
       {% endnote %}

     For more information about `yandex_alb_backend_group` properties, see [this Terraform provider guide](../../terraform/resources/alb_backend_group.md).
  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     You can check backend group updates in the [management console](https://console.yandex.cloud) or using this CLI command:

     ```bash
     yc alb backend-group get --name <backend_group_name>
     ```

     {% note warning "Timeouts" %}
     
     The Terraform provider limits operations with Application Load Balancer backend groups to 10 minutes.
     
     Operations in excess of this time will be interrupted.
     
     {% cut "How do I modify these limits?" %}
     
     Add a `timeouts` section to the backend group description:
     
     ```hcl
     resource "yandex_alb_backend_group" "<backend_group_name>" {
       ...
       timeouts {
         create = "60m"
         update = "60m"
         delete = "60m"
       }
     }
     ```
     
     {% endcut %}
     
     {% endnote %}

- API {#api}

  To change group basic settings, use the [addBackend](../api-ref/BackendGroup/addBackend.md) REST API method for the [BackendGroup](../api-ref/BackendGroup/index.md) resource or the [BackendGroupService/Update](../api-ref/grpc/BackendGroup/addBackend.md) gRPC API call.

{% endlist %}

## Update backend settings in a group {#update-backend}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder with your backend.
  1. Navigate to **Application Load Balancer**.
  1. In the left-hand panel, select ![image](../../_assets/console-icons/cubes-3-overlap.svg) **Backend groups**.
  1. Click your group name.
  1. Next to the backend name, click ![image](../../_assets/console-icons/ellipsis.svg) and select **Edit**.
  1. In the window that opens, specify backend settings. For more information about these settings, see [above](#add-backend).
  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for updating backend settings:

     ```bash
     yc alb backend-group update-<backend_type>-backend --help
     ```

  1. Specify new backend settings depending on its type:

     {% cut "HTTP backend" %}

     Run this command:

     ```bash
     yc alb backend-group update-http-backend \
       --backend-group-name <backend_group_name> \
       --name <backend_name> \
       --weight <backend_weight> \
       --port <backend_port> \
       --target-group-id=<target_group_ID> \
       --panic-threshold 90 \
       --http-healthcheck port=80,healthy-threshold=10,unhealthy-threshold=15,expected-statuses=211,\
     timeout=10s,interval=2s,host=your-host.com,path=/ping
     ```

     Where:
     * `--name`: The name of the backend you want to add or update.
     * `--panic-threshold`: Panic mode threshold.
     * `--http-healthcheck`: Health check settings:
       * `port`: Port.
       * `healthy-threshold`: Healthy threshold.
       * `unhealthy-threshold`: Unhealthy threshold.
       * `expected-statuses`: HTTP status code deemed valid during a backend health check. You can add multiple values separated by a comma: `expected-statuses=201,expected-statuses=205,expected-statuses=302`. You can use HTTP codes in the range between `100` and `599`. If this setting is not specified, the response code will be `200`.
       * `timeout`: Maximum connection time.
       * `interval`: Interval.
       * `host`: Host address.
       * `path`: Path.

     Result:

     ```text
     id: a5dqkr2mk3rr********
     name: <backend_group_name>
     folder_id: aoe197919j8e********
     ...
             host: <host_address>
             path: <path>
     created_at: "2021-02-11T20:46:21.688940670Z"
     ```

     {% endcut %}

     {% cut "gRPC backend" %}

     Run this command:

     ```bash
     yc alb backend-group update-grpc-backend \
       --backend-group-name <backend_group_name> \
       --name <name_of_backend_you_are_adding> \
       --weight <backend_weight> \
       --port <backend_port> \
       --target-group-id=<target_group_ID> \
       --panic-threshold 90 \
       --grpc-healthcheck port=80,healthy-threshold=10,unhealthy-threshold=15,\
     timeout=10s,interval=2s,service-name=<gRPC_service_name>
     ```

     Where:
     * `--panic-threshold`: Panic mode threshold.
     * `--grpc-healthcheck`: Resource health check settings:
       * `port`: Port.
       * `healthy-threshold`: Healthy threshold.
       * `unhealthy-threshold`: Unhealthy threshold.
       * `timeout`: Maximum connection time.
       * `interval`: Interval.
       * `service-name`: Name of the gRPC service you want to check. If no service is specified, the system will check the backend overall health.

     Result:

     ```text
     id: a5dqkr2mk3rr********
     name: <backend_group_name>
     folder_id: aoe197919j8e********
     ...
               grpc:
                 service_name: <gRPC_service_name>
     ...
     created_at: "2021-02-11T20:46:21.688940670Z"
     ```

     {% endcut %}

     {% cut "Stream backend" %}

     Run this command:

     ```bash
     yc alb backend-group update-stream-backend \
       --backend-group-name <backend_group_name> \
       --name <name_of_backend_you_are_adding> \
       --weight <backend_weight> \
       --port <backend_port> \
       --target-group-id=<target_group_ID> \
       --panic-threshold 90 \
       --enable-proxy-protocol \
       --keep-connections-on-host-health-failure \
       --stream-healthcheck port=80,healthy-threshold=10,unhealthy-threshold=15,\
     timeout=10s,interval=2s,send-text=<data_to_endpoint>,receive-text=<data_from_endpoint>
     ```

     Where:
     * `--panic-threshold`: Panic mode threshold.
     * `--enable-proxy-protocol`: With this option enabled, the load balancer will send its client connection metadata, e.g. its IP address, to the backend via [HAProxy](https://www.haproxy.org/download/1.9/doc/proxy-protocol.txt) protocol. If you do not set specific values for this option, the load balancer will only send its IP address to the backend.
     * `--keep-connections-on-host-health-failure`: Keeps the connection alive even if the health check fails.
     * `--stream-healthcheck`: Health check settings:
       * `port`: Port.
       * `healthy-threshold`: Healthy threshold.
       * `unhealthy-threshold`: Unhealthy threshold.
       * `timeout`: Maximum connection time.
       * `interval`: Interval.
       * `send-text`: Data sent to the endpoint for a health check.
       * `receive-text`: Data the endpoint must return to pass the health check.

     Result:

     ```text
     id: ds77tero4f5********
     name: <backend_group_name>
     folder_id: b1gu6g9ielh6********
     ...
                 text: <data_to_endpoint>
               receive:
                 text: <data_from_endpoint>
         enable_proxy_protocol: true
     created_at: "2022-04-06T09:17:57.104324513Z"
     ```

     {% endcut %}

     {% note alert %}
     
     If all backends with health checks enabled in an availability zone fail those checks, traffic will no longer route to that zone, even if functional backends without health checks remain.
     
     We recommend configuring [health checks](../concepts/backend-group.md#health-checks) for all backends.
     
     {% endnote %}

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  1. Open the Terraform configuration file and edit your `http_backend`, `grpc_backend`, or `stream_backend` description in the backend group section:

     ```hcl
     resource "yandex_alb_backend_group" "test-backend-group" {
       name                     = "<backend_group_name>"
     
       stream_backend {
         name                   = "<backend_name>"
         weight                 = 1
         port                   = 80
         target_group_ids       = ["<target_group_ID>"]
         load_balancing_config {
           panic_threshold      = 90
         }
         enable_proxy_protocol  = true
         healthcheck {
           timeout              = "10s"
           interval             = "2s"
           healthy_threshold    = 10
           unhealthy_threshold  = 15 
           stream_healthcheck {
             send               = "<data_to_endpoint>"
             receive            = "<data_from_endpoint>"
           }
         }
       }
     }
     ```

     Where `yandex_alb_backend_group` includes backend group settings:
     * `name`: Backend group name.
     * `http_backend`, `grpc_backend`, or `stream_backend`: [Backend type](../concepts/backend-group.md#group-types). All backends within a group must match the same type: `HTTP`, `gRPC`, or `Stream`.

     Backend parameters:
     * `name`: Backend name.
     * `port`: Backend port.
     * `weight`: Backend weight.
     * `target_group_ids`: [Target group](../concepts/target-group.md) ID. To get a list of available target groups, run the `yc alb target-group list` [CLI](../../cli/index.md) command.
     * `load_balancing_config`: Balancing parameters:
       * `panic_threshold`: Panic mode threshold.
     * `enable_proxy_protocol`: With this option enabled, the load balancer will send its client connection metadata, e.g. its IP address, to the backend via [HAProxy](https://www.haproxy.org/download/1.9/doc/proxy-protocol.txt) protocol. If you do not set specific values for this option, the load balancer will only send its IP address to the backend. This option is only available for `Stream` type backends.
     * `healthcheck`: Health check settings:
       * `timeout`: Maximum connection request timeout.
       * `interval`: Interval.
       * `healthy_threshold`: Healthy threshold.
       * `unhealthy_threshold`: Unhealthy threshold.
       * `keep_connections_on_host_health_failure`: This option maintains connections open even if the target host status changes to `Unhealthy`.
       * `http_healthcheck`: `HTTP` health check settings:
         * `path`: Path, e.g., `/health`.
         * `host`: Host address, e.g., `example.com`.
         * `expected_statuses`: List of HTTP status codes corresponding to the `Healthy` status, e.g., `[200, 201, 202]`.
       * `grpc_healthcheck`: `gRPC` health check settings:
         * `service_name`: Name of the gRPC service you want to check. If no service is specified, the system will check the backend overall health.
       * `stream_healthcheck`: `Stream` health check settings:
         * `send`: Data sent to the endpoint for a health check.
         * `receive`: Data the endpoint must return to pass the health check.
     
       {% note alert %}
       
       If all backends with health checks enabled in an availability zone fail those checks, traffic will no longer route to that zone, even if functional backends without health checks remain.
       
       We recommend configuring [health checks](../concepts/backend-group.md#health-checks) for all backends.
       
       {% endnote %}

     For more information about `yandex_alb_backend_group` properties, see [this Terraform provider guide](../../terraform/resources/alb_backend_group.md).
  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     You can check backend group updates in the [management console](https://console.yandex.cloud) or using this CLI command:

     ```bash
     yc alb backend-group get --name <backend_group_name>
     ```

     {% note warning "Timeouts" %}
     
     The Terraform provider limits operations with Application Load Balancer backend groups to 10 minutes.
     
     Operations in excess of this time will be interrupted.
     
     {% cut "How do I modify these limits?" %}
     
     Add a `timeouts` section to the backend group description:
     
     ```hcl
     resource "yandex_alb_backend_group" "<backend_group_name>" {
       ...
       timeouts {
         create = "60m"
         update = "60m"
         delete = "60m"
       }
     }
     ```
     
     {% endcut %}
     
     {% endnote %}

- API {#api}

  To update backend settings in a group, use the [updateBackend](../api-ref/BackendGroup/updateBackend.md) REST API method for the [UpdateBackend](../api-ref/BackendGroup/index.md) resource or the [BackendGroupService/UpdateBackend](../api-ref/grpc/BackendGroup/updateBackend.md) gRPC API call.

{% endlist %}

## Remove a backend from a group {#delete-backend}

To remove a backend from a group:

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder with your backend.
  1. Navigate to **Application Load Balancer**.
  1. In the left-hand panel, select ![image](../../_assets/console-icons/cubes-3-overlap.svg) **Backend groups**.
  1. Click your group name.
  1. Click ![image](../../_assets/console-icons/ellipsis.svg) next to the backend name, then select **Delete**.
  1. In the window that opens, click **Delete**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for removing a backend from a group:

     ```bash
     yc application-load-balancer delete-<backend_type>-backend --help
     ```

  1. To delete a backend, run a command depending on its type:
     * HTTP backend:

       ```bash
       yc alb backend-group delete-http-backend \
         --backend-group-name=<backend_group_name> \
         --name=<name_of_backend_to_delete>
       ```

     * gRPC backend:

       ```bash
       yc alb backend-group delete-grpc-backend \
         --backend-group-name=<backend_group_name> \
         --name=<name_of_backend_to_delete>
       ```

     * Stream backend:

       ```bash
       yc alb backend-group delete-stream-backend \
         --backend-group-name=<backend_group_name> \
         --name=<name_of_backend_to_delete>
       ```

     Result:

     ```text
     id: a5dqkr2mk3rr********
     name: <backend_name>
     folder_id: aoe197919j8e********
     created_at: "2021-02-11T20:46:21.688940670Z"
     ```

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  1. Open the Terraform configuration file and remove your `http_backend`, `grpc_backend`, or `stream_backend` description from the backend group section.

     Sample backend group description in the Terraform configuration:

     ```hcl
     resource "yandex_alb_backend_group" "test-backend-group" {
       name                     = "<backend_group_name>"

       http_backend {
         name                   = "<backend_name>"
         weight                 = 1
         port                   = 80
         target_group_ids       = ["<target_group_ID>"]
         load_balancing_config {
           panic_threshold      = 90
         }
         healthcheck {
           timeout              = "10s"
           interval             = "2s"
           healthy_threshold    = 10
           unhealthy_threshold  = 15
           http_healthcheck {
             path               = "/"
           }
         }
       }
     }
     ```

     For more information about `yandex_alb_backend_group` properties, see [this Terraform provider guide](../../terraform/resources/alb_backend_group.md).
  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     You can check backend group updates in the [management console](https://console.yandex.cloud) or using this CLI command:

     ```bash
     yc alb backend-group get --name <backend_group_name>
     ```

- API {#api}

  Use the [removeBackend](../api-ref/BackendGroup/removeBackend.md) REST API method for the [BackendGroup](../api-ref/BackendGroup/index.md) resource or the [BackendGroupService/RemoveBackend](../api-ref/grpc/BackendGroup/removeBackend.md) gRPC API call.

{% endlist %}

### Useful links {#see-also}

* [Tips for configuring Yandex Application Load Balancer health checks](../concepts/best-practices.md)