[Yandex Cloud documentation](../../../index.md) > [Yandex Application Load Balancer](../../index.md) > [Tutorials](../index.md) > [Integrating an L7 load balancer with a CDN and Object Storage](index.md) > Management console, CLI, and API

# Integrating an L7 load balancer with Cloud CDN and Object Storage using the management console


{% note info %}

To implement this solution, you will need a domain. We will use the `example.com` domain name as an example.

{% endnote %}

To [set up integration](index.md) of an L7 load balancer with Yandex Cloud CDN and Yandex Object Storage using the [management console](https://console.yandex.cloud), Yandex Cloud [CLI](../../../cli/index.md), or [API](../../../api-design-guide/index.md):

1. [Get your cloud ready](#before-you-begin).
1. [Create and configure a public DNS zone](#configure-dns).
1. [Add a certificate to Certificate Manager](#add-certificate).
1. [Create a cloud network and subnets](#create-network).
1. [Create a security group](#create-security-group).
1. [Create a bucket in Object Storage](#create-buckets).
1. [Upload the file of your service to the bucket](#upload-files).
1. [Create an Application Load Balancer backend group](#create-l7backend).
1. [Create an HTTP router and a virtual host](#create-route-hosts).
1. [Create an L7 load balancer](#create-balancer).
1. [Create a CDN resource](#create-cdn-resource).
1. [Create a CNAME resource record for the CDN resource](#create-cdn-cname-record).
1. [Test the service](#check).

If you no longer need the resources you created, [delete them](#clear-out).

## Supported tools {#supported-tools}

You can use various supported tools to perform these steps. You can complete most of the steps in this tutorial using any standard tool, such as the [management console](https://console.yandex.cloud), [Yandex Cloud CLI](../../../cli/index.md), and [Yandex Cloud API](../../../api-design-guide/index.md). Each step lists its respective supported tools.

Some steps do not support certain tools: currently, you cannot [create an Application Load Balancer backend group with buckets as backends](#create-l7backend) via the Yandex Cloud CLI.

## Get your cloud ready {#before-you-begin}

Sign up for Yandex Cloud and create a [billing account](../../../billing/concepts/billing-account.md):
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account.
1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../../billing/quickstart/index.md) and [link](../../../billing/operations/pin-cloud.md) a cloud to it.

If you have an active billing account, you can create or select a [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud).

[Learn more about clouds and folders here](../../../resource-manager/concepts/resources-hierarchy.md).

We will use a folder named `example-folder` in our example.

### Required paid resources {#paid-resources}

The infrastructure support costs include:

* Fee for data storage in Object Storage, data operations, and outbound traffic (see [Object Storage pricing](../../../storage/pricing.md)).
* Fee for using the L7 load balancer’s computing resources (see [Application Load Balancer pricing](../../pricing.md)).
* A fee for outgoing traffic from CDN servers (see [Cloud CDN pricing](../../../cdn/pricing.md)).
* Fee for public DNS requests and DNS zones if using Yandex Cloud DNS (see [Cloud DNS pricing](../../../dns/pricing.md)).

## Create and configure a public DNS zone {#configure-dns}

{% note info %}

This guide describes a scenario where [Yandex Cloud DNS](../../../dns/index.md) handles domain management.

If you do not want to delegate management of your domain to Yandex Cloud, you can complete the required DNS setup using tools provided by your domain administrator. To create resource records, use your domain administrator’s tutorials or contact their support.

{% endnote %}

To configure a public DNS zone in the Yandex Cloud infrastructure:

1. Delegate your domain to Cloud DNS. To do this, in your domain registrar's account, specify the addresses of these DNS servers in your domain settings: `ns1.yandexcloud.net` and `ns2.yandexcloud.net`.
1. Create a public [DNS zone](../../../dns/concepts/dns-zone.md) in Yandex Cloud DNS.

    {% list tabs group=instructions %}

    - Management console {#console}

      1. In the [management console](https://console.yandex.cloud), select `example-folder`.
      1. Navigate to **Cloud DNS**.
      1. Click **Create zone**.
      1. Specify the zone settings consistent with your domain:

         1. **Zone**: Domain zone. Its name must end with a trailing dot. For example, `example.com.` matches the `example.com` domain. To create a domain name with non-Latin characters, use the [Punycode](https://en.wikipedia.org/wiki/Punycode) encoding.
         1. **Type**: `Public`.
         1. **Name**: `my-domain-zone`.

      1. Click **Create**.

    - Yandex Cloud CLI {#cli}

      If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

      The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

      Run this command:

      ```bash
      yc dns zone create \
        --name my-domain-zone \
        --zone <domain_name> \
        --public-visibility
      ```

      Where `--zone` is your domain's name, e.g., `example.com.`. The `--zone` parameter value must end with a trailing dot. For example, `example.com.` matches the `example.com` domain.

      Result:

      ```text
      id: dns6b0mdas5r********
      folder_id: b1gt6g8ht345********
      created_at: "2026-02-05T10:42:16.017Z"
      name: my-domain-zone
      zone: example.com.
      public_visibility: {}
      ```

      For more information about the `yc dns zone create` command, see the [CLI reference](../../../cli/cli-ref/dns/cli-ref/zone/create.md).

    - API {#api}

      To create a public DNS zone, use the [create](../../../dns/api-ref/DnsZone/create.md) REST API method for the [DnsZone](../../../dns/api-ref/DnsZone/index.md) resource or the [DnsZoneService/Create](../../../dns/api-ref/grpc/DnsZone/create.md) gRPC API call.

    {% endlist %}

## Add a certificate to Certificate Manager {#add-certificate}

Certificates from [Yandex Certificate Manager](../../../certificate-manager/index.md) are supported. You can [issue a new Let's Encrypt® certificate](../../../certificate-manager/operations/managed/cert-create.md) or [upload one of your own](../../../certificate-manager/operations/import/cert-create.md).

The certificate must be located in the same [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) as your CDN resource.

This guide describes a scenario where the CDN resource is issued a new Let's Encrypt® certificate.

1. Add a Let's Encrypt® [certificate](../../../certificate-manager/concepts/managed-certificate.md) for your domain to Certificate Manager:

    {% list tabs group=instructions %}

    - Management console {#console}

      1. In the [management console](https://console.yandex.cloud), select `example-folder`.
      1. Navigate to **Certificate Manager**.
      1. Click **Add certificate** and select **Let's Encrypt certificate**.
      1. In the window that opens, specify `mymanagedcert` in the **Name** field.
      1. In the **Domains** field, enter a name for your domain, e.g., `example.com`.
      1. Select the [domain rights check type](../../../certificate-manager/concepts/challenges.md): `DNS`.
      1. Click **Create**.

    - Yandex Cloud CLI {#cli}

      Run this command:

      ```bash
      yc certificate-manager certificate request \
        --name mymanagedcert \
        --challenge dns \
        --domains <domain_name>
      ```

      Where `<domain_name>` is your domain name, e.g., `example.com`.

      Result:

      ```text
      id: fpq7t9dpi4o0********
      folder_id: b1gt6g8ht345********
      created_at: "2026-02-05T11:00:15.952968372Z"
      name: mymanagedcert
      type: MANAGED
      domains:
        - example.com
      status: VALIDATING
      updated_at: "2026-02-05T11:00:15.952968372Z"
      ```

      For more information about the `yc certificate-manager certificate request` command, see the [CLI reference](../../../cli/cli-ref/certificate-manager/cli-ref/certificate/request.md).

      Save the ID (`id`) of the certificate you created, as you will need it when creating a CDN resource.

    - API {#api}

      To add a certificate, use the [requestNew](../../../certificate-manager/api-ref/Certificate/requestNew.md) REST API method for the [Certificate](../../../certificate-manager/api-ref/Certificate/index.md) resource or the [CertificateService/RequestNew](../../../certificate-manager/api-ref/grpc/Certificate/requestNew.md) gRPC API call.

    {% endlist %}

    A new certificate with the `Validating` status will appear in the certificate list. This status means that a Let's Encrypt® certificate was requested and you need to pass a [domain rights check](../../../certificate-manager/operations/managed/cert-validate.md) for it to be successfully processed.

1. To successfully issue the certificate, pass a domain rights check:

    {% list tabs group=instructions %}

    - Management console {#console}

        1. In the [management console](https://console.yandex.cloud), select `example-folder`.
        1. Navigate to **Certificate Manager**.
        1. From the list of certificates, select `mymanagedcert`.
        1. In the window that opens, under **Check rights for domains**, select `CNAME record` and click **Create record** in the section with your domain below.
        1. In the window that opens, confirm creating the resource record.

        Checking rights for a domain may take from a few minutes to a few days. Wait until the check is complete. As a result, the certificate will be issued and get the `Issued` status.

    - Yandex Cloud CLI {#cli}

        1. Get the values of the resource record required for validation:

            ```bash
            yc certificate-manager certificate get \
              --name mymanagedcert \
              --full
            ```

            Result:

            ```text
            id: fpq7t9dpi4o0********
            folder_id: b1gt6g8ht345********
            created_at: "2026-02-05T11:00:15.952Z"
            name: mymanagedcert
            type: MANAGED
            domains:
              - example.com
            status: VALIDATING
            updated_at: "2026-02-05T11:00:15.952Z"
            challenges:
              - domain: example.com
                type: DNS
                created_at: "2026-02-05T11:00:15.952968372Z"
                updated_at: "2026-02-05T11:00:19.659820021Z"
                status: PENDING
                message: Create a record in your DNS provider.
                dns_challenge:
                  name: _acme-challenge.example.com.
                  type: CNAME
                  value: fpq7t9dpi4o0********.cm.yandexcloud.net.
              - domain: example.com
                type: DNS
                created_at: "2026-02-05T11:00:15.952968372Z"
                updated_at: "2026-02-05T11:00:19.659820021Z"
                status: PENDING
                message: Create a record in your DNS provider.
                dns_challenge:
                  name: _acme-challenge.example.com.
                  type: TXT
                  value: 77LcWo8-Qx4sHJuFDoNCpptLZkyWVW5A2dY********
            ```

            For more information about the `yc certificate-manager certificate get` command, see the [CLI reference](../../../cli/cli-ref/certificate-manager/cli-ref/certificate/get.md).

            Save the value of the `value` field from the `CNAME` type section under `challenges.dns_challenge`. You will need this value in the next step.

        1. Create a CNAME [resource record](../../../dns/concepts/resource-record.md) to pass a domain rights check:

            ```bash
            yc dns zone add-records \
              --name my-domain-zone \
              --record "_acme-challenge 600 CNAME <dns_challenge_value>"
            ```

            Where `<dns_challenge_value>` is the value you saved in the previous step, required for the domain rights check using a CNAME record.

            Result:

            ```text
            +--------+------------------------------+-------+------------------------------------------+-----+
            | ACTION |             NAME             | TYPE  |                   DATA                   | TTL |
            +--------+------------------------------+-------+------------------------------------------+-----+
            | +      | _acme-challenge.example.com. | CNAME | fpq7t9dpi4o0********.cm.yandexcloud.net. | 600 |
            +--------+------------------------------+-------+------------------------------------------+-----+
            ```

            For more information about the `yc dns zone add-records` command, see the [CLI reference](../../../cli/cli-ref/dns/cli-ref/zone/add-records.md).

            Checking rights for a domain may take from a few minutes to a few days. Wait until the check is complete. As a result, the certificate will be issued and get the `Issued` status.

        1. Make sure that the certificate status has switched to `Issued`:

            ```bash
            yc certificate-manager certificate get \
              --name mymanagedcert
            ```

            Result:

            ```text
            id: fpq7t9dpi4o0********
            folder_id: b1gt6g8ht345********
            created_at: "2026-02-05T11:00:15.952Z"
            name: mymanagedcert
            type: MANAGED
            domains:
              - example.com
            status: ISSUED
            issuer: CN=R12,O=Let's Encrypt,C=US
            subject: CN=example.com
            serial: 57bc7967996d73d63d9d52e337c********
            updated_at: "2026-02-05T13:29:23.658Z"
            issued_at: "2026-02-05T13:29:23.658Z"
            not_after: "2026-05-06T12:30:49Z"
            not_before: "2026-02-05T12:30:50Z"
            ```

            Save the certificate ID you got as you will need it later to create the CDN resource.

    - API {#api}

      To get the information required to pass a domain rights check, use the [get](../../../certificate-manager/api-ref/Certificate/get.md) REST API method for the [Certificate](../../../certificate-manager/api-ref/Certificate/index.md) resource or the [CertificateService/Get](../../../certificate-manager/api-ref/grpc/Certificate/get.md) gRPC API call with `view=FULL`.
      
      To create a CNAME resource record in a DNS zone, use the [updateRecordSets](../../../dns/api-ref/DnsZone/updateRecordSets.md) REST API method for the [DnsZone](../../../dns/api-ref/DnsZone/index.md) resource or the [DnsZoneService/UpdateRecordSets](../../../dns/api-ref/grpc/DnsZone/updateRecordSets.md) gRPC API call.

    {% endlist %}

    {% note info %}

    For a successful DNS domain rights check based on a `CNAME` record, make sure the `_acme-challenge` subdomain of the domain name you are checking has no other [resource records](../../../dns/concepts/resource-record.md) except `CNAME`. For example, for the `_acme-challenge.example.com.` domain name, there should only be a CNAME record and no TXT record.

    {% endnote %}

    If your domain is managed from outside Yandex Cloud, to create the resource record for the domain rights check, use tools provided by your domain administrator. For more information, see [Domain rights check](../../../certificate-manager/concepts/challenges.md).

## Create a cloud network and subnets {#create-network}


All resources will belong to the same [cloud network](../../../vpc/concepts/network.md).

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select `example-folder`.
  1. Navigate to **Virtual Private Cloud**.
  1. At the top right, click **Create network**.
  1. In the **Name** field, specify `example-network`.
  1. In the **Advanced** field, select `Create subnets`.
  1. Click **Create network**.

- Yandex Cloud CLI {#cli}

  1. Create a network named `example-network`:

      ```bash
      yc vpc network create example-network
      ```

      Result:

      ```text
        id: enpqm699f18v********
        folder_id: b1gt6g8ht345********
        created_at: "2026-02-05T11:57:02Z"
        name: example-network
        default_security_group_id: enp4qvbg2ri1********
      ```

      For more information about the `yc vpc network create` command, see the [CLI reference](../../../cli/cli-ref/vpc/cli-ref/network/create.md).

  1. Create subnets in all [availability zones](../../../overview/concepts/geo-scope.md):

      * In `ru-central1-a`:

          ```bash
          yc vpc subnet create example-subnet-ru-central1-a \
            --zone ru-central1-a \
            --network-name example-network \
            --range 192.168.1.0/24
          ```

          Result:

          ```text
          id: e9b0fo0hvhpd********
          folder_id: b1gt6g8ht345********
          created_at: "2026-02-05T12:00:21Z"
          name: example-subnet-ru-central1-a
          network_id: enpqm699f18v********
          zone_id: ru-central1-a
          v4_cidr_blocks:
            - 192.168.1.0/24
          ```

          Save the subnet ID you got as you will need it later to create an L7 load balancer.

      * In `ru-central1-b`:

          ```bash
          yc vpc subnet create example-subnet-ru-central1-b \
            --zone ru-central1-b \
            --network-name example-network \
            --range 192.168.2.0/24
          ```

          Result:

          ```text
          id: e2lo05oe9slo********
          folder_id: b1gt6g8ht345********
          created_at: "2026-02-05T12:02:02Z"
          name: example-subnet-ru-central1-b
          network_id: enpqm699f18v********
          zone_id: ru-central1-b
          v4_cidr_blocks:
            - 192.168.2.0/24
          ```

          Save the subnet ID you got as you will need it later to create an L7 load balancer.

      * In `ru-central1-d`:

          ```bash
          yc vpc subnet create example-subnet-ru-central1-d \
            --zone ru-central1-d \
            --network-name example-network \
            --range 192.168.3.0/24
          ```

          Result:

          ```text
          id: fl8bpb6lnu80********
          folder_id: b1gt6g8ht345********
          created_at: "2026-02-05T12:03:23Z"
          name: example-subnet-ru-central1-d
          network_id: enpqm699f18v********
          zone_id: ru-central1-d
          v4_cidr_blocks:
            - 192.168.3.0/24
          ```

          Save the subnet ID you got as you will need it later to create an L7 load balancer.

      For more information about the `yc vpc subnet create` command, see the [CLI reference](../../../cli/cli-ref/vpc/cli-ref/subnet/create.md).

- API {#api}

  1. To create `example-network`, use the [create](../../../vpc/api-ref/Network/create.md) REST API method for the [Network](../../../vpc/api-ref/Network/index.md) resource or the [NetworkService/Create](../../../vpc/api-ref/grpc/Network/create.md) gRPC API call.
  1. To create `example-subnet-ru-central1-a`, `example-subnet-ru-central1-b`, and `example-subnet-ru-central1-d` in three availability zones, use the [create](../../../vpc/api-ref/Subnet/create.md) REST API method for the [Subnet](../../../vpc/api-ref/Subnet/index.md) resource or the [SubnetService/Create](../../../vpc/api-ref/grpc/Subnet/create.md) gRPC API call.

{% endlist %}

## Create a security group {#create-security-group}

[Security groups](../../../vpc/concepts/security-groups.md) contain rules that allow the L7 load balancer to receive incoming traffic and send it to backend buckets.

To create security groups:

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select `example-folder`.
  1. Navigate to **Virtual Private Cloud**.
  1. In the left-hand panel, select ![image](../../../_assets/console-icons/shield.svg) **Security groups**.
  1. At the top right, click **Create security group**.
  1. In the **Name** field, specify `example-sg`.
  1. In the **Network** field, select `example-network`.
  1. Under **Rules**, create the following rules [using the instructions below](../../../vpc/operations/security-group-create.md):
   
      | Traffic<br/>direction | Description | Port range | Protocol | Source /<br/>destination | CIDR blocks |
      | --- | --- | --- | --- | --- | --- |
      | `Egress` | `any` | `All` | `Any` | `CIDR` | `0.0.0.0/0` |
      | `Ingress` | `ext-http` | `80` | `TCP` | `CIDR` | `0.0.0.0/0` |
      | `Inbound` | `ext-https` | `443` | `TCP` | `CIDR` | `0.0.0.0/0` |
      | `Inbound` | `healthchecks` | `30080` | `TCP` | `Load balancer healthchecks` | — |

  1. Click **Create**.

- Yandex Cloud CLI {#cli}

  Run this command:

  ```bash
  yc vpc security-group create example-sg \
    --network-name example-network \
    --rule "direction=egress,port=any,protocol=any,v4-cidrs=[0.0.0.0/0]" \
    --rule "direction=ingress,port=80,protocol=tcp,v4-cidrs=[0.0.0.0/0]" \
    --rule "direction=ingress,port=443,protocol=tcp,v4-cidrs=[0.0.0.0/0]" \
    --rule "direction=ingress,port=30080,protocol=tcp,predefined=loadbalancer_healthchecks"
  ```
  
  Result:
  
  ```text
  id: enp9dpfa774h********
  folder_id: b1gt6g8ht345********
  created_at: "2026-02-05T12:29:47Z"
  name: example-sg
  network_id: enpqm699f18v********
  status: ACTIVE
  rules:
    - id: enpa11mk1r50********
      direction: EGRESS
      protocol_name: ANY
      protocol_number: "-1"
      cidr_blocks:
        v4_cidr_blocks:
          - 0.0.0.0/0
    - id: enp4aob2uiam********
      direction: INGRESS
      ports:
        from_port: "80"
        to_port: "80"
      protocol_name: TCP
      protocol_number: "6"
      cidr_blocks:
        v4_cidr_blocks:
          - 0.0.0.0/0
    - id: enpn8onb4lda********
      direction: INGRESS
      ports:
        from_port: "443"
        to_port: "443"
      protocol_name: TCP
      protocol_number: "6"
      cidr_blocks:
        v4_cidr_blocks:
          - 0.0.0.0/0
    - id: enp6j82kiu2p********
      direction: INGRESS
      ports:
        from_port: "30080"
        to_port: "30080"
      protocol_name: TCP
      protocol_number: "6"
      predefined_target: loadbalancer_healthchecks
  ```

  Save the security group ID as you will need it later to create an L7 load balancer.

  For more information about the `yc vpc security-group create` command, see the [CLI reference](../../../cli/cli-ref/vpc/cli-ref/security-group/create.md).

- API {#api}

  Use the [create](../../../vpc/api-ref/SecurityGroup/create.md) REST API method for the [SecurityGroup](../../../vpc/api-ref/SecurityGroup/index.md) resource or the [SecurityGroupService/Create](../../../vpc/api-ref/grpc/SecurityGroup/create.md) gRPC API call.

  To add a rule for load balancer health checks, use the `loadbalancer_healthchecks` parameter in under [predefinedTarget](../../../vpc/api-ref/SecurityGroup/create.md#yandex.cloud.vpc.v1.CreateSecurityGroupRequest) for the REST API or under [SecurityGroupRuleSpec.target.predefined_target](../../../vpc/api-ref/grpc/SecurityGroup/create.md#yandex.cloud.vpc.v1.SecurityGroupRuleSpec) for the gRPC API.

{% endlist %}

## Create an Object Storage bucket {#create-buckets}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select `example-folder`.
  1. Navigate to **Object Storage**.
  1. At the top right, click **Create bucket**.
  1. In the ** Name** field, enter a unique [name](../../../storage/concepts/bucket.md#naming) for the bucket.
  1. In the **Read objects** and **Read object list** fields, select `For all`.
  1. Click **Create bucket**.

- Yandex Cloud CLI {#cli}

  Run this command, specifying the unique bucket [name](../../../storage/concepts/bucket.md#naming):

  ```bash
  yc storage bucket create \
    --name <bucket_name> \
    --public-read \
    --public-list
  ```

  Result:

  ```text
  name: my-cdn-bucket
  folder_id: b1gt6g8ht345********
  anonymous_access_flags:
    read: true
    list: true
  default_storage_class: STANDARD
  versioning: VERSIONING_DISABLED
  created_at: "2026-02-05T12:35:03.639102Z"
  resource_id: e3e8qar9vrim********
  ```

- API {#api}

  Use the [create](../../../storage/api-ref/Bucket/create.md) REST API method for the [Bucket](../../../storage/api-ref/Bucket/index.md) resource or the [BucketService/Create](../../../storage/api-ref/grpc/Bucket/create.md) gRPC API call.

{% endlist %}

## Upload the file of your service to the bucket {#upload-files}

1. Create a file named `index.html` with the following contents:
   
   ```html
   <!DOCTYPE html>
   <html>
     <head>
       <title>My service</title>
     </head>
     <body>
       <p>The service is working</p>
     </body>
   </html>
   ```
1. Upload the file to the bucket:

    {% list tabs group=instructions %}
    
    - Management console {#console}

        1. In the [management console](https://console.yandex.cloud), select `example-folder`.
        1. Navigate to **Object Storage**.
        1. Select the previously created bucket.
        1. Click ![arrow-up-from-line](../../../_assets/console-icons/arrow-up-from-line.svg) **Upload** and select the `index.html` file for uploading.
        1. In the window that opens, click **Upload**.

    - Yandex Cloud CLI {#cli}

      Upload the `index.html` file to the bucket:

      ```bash
      yc storage s3api put-object \
        --bucket <bucket_name> \
        --key index.html \
        --content-type "text/html" \
        --body <local_path_to_file>
      ```

      Where:

      * `--bucket`: Name of the bucket.
      * `--body`: Local path to the HTML file created earlier, e.g., `./index.html`.
      
      Result:
      
      ```text
      etag: '"2f613d0f35668e1d98fa9c6b********"'
      request_id: a809736f********
      ```

      For more information about the `yc storage s3api put-object` command, see the [CLI reference](../../../storage/cli-ref/s3api/put-object.md).

   - API {#api}
   
     Use the [upload](../../../storage/s3/api-ref/object/upload.md) REST API method.

   {% endlist %}

## Create an Application Load Balancer backend group {#create-l7backend}

{% list tabs group=instructions %}
   
- Management console {#console}
   
  1. In the [management console](https://console.yandex.cloud), select `example-folder`.
  1. Navigate to **Application Load Balancer**.
  1. In the left-hand panel, select ![image](../../../_assets/console-icons/cubes-3-overlap.svg) **Backend groups**.
  1. At the top right, click **Create backend group**.
  1. In the **Name** field, specify `example-bg`.
  1. In the **Type** field, select `HTTP` as the [backend group type](../../concepts/backend-group.md#group-types).
  1. Under **Backends**, click **Add** and set up the backend:
      1. In the **Name** field, specify `example-backend`.
      1. In the **Weight** field, specify `100`.
      1. In the **Type** field, select `Bucket` as the [backend type](../../concepts/backend-group.md#types).
      1. In the **Bucket** field, select the bucket you created earlier.
  1. Click **Create**.

  If you are going to complete the next steps in the Yandex Cloud CLI, copy the ID of the `example-bg` backend group as you will need it later.

- Yandex Cloud CLI {#cli}

  Currently, the Yandex Cloud CLI does not support creating a backend group with the `bucket` backend [type](../../concepts/backend-group.md#group-types). Use the management console or API to create the backend group.

- API {#api}

  Use the [create](../../api-ref/BackendGroup/create.md) REST API method for the [BackendGroup](../../api-ref/BackendGroup/index.md) resource or the [BackendGroupService/Create](../../api-ref/grpc/BackendGroup/create.md) gRPC API call.
     
{% endlist %} 

## Create an HTTP router and a virtual host {#create-route-hosts}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select `example-folder`.
  1. Navigate to **Application Load Balancer**.
  1. In the left-hand panel, select ![image](../../../_assets/console-icons/route.svg) **HTTP routers**.
  1. At the top right, click **Create HTTP router**.
  1. In the **Name** field, specify `example-router`.
  1. Create a virtual host named `example-vh`:
  
     1. Under **Virtual hosts**, click **Add virtual host**.
     1. In the **Name** field, specify `example-vh`.
     1. In the **Authority** field, specify your domain name, e.g., `example.com`.
     1. Click **Add route**.
     1. In the **Name** field, specify `example-route`.
     1. In the **Path** field, select `Starts with` and specify the `/` path.
     1. From the **HTTP methods** list, select `GET`.
     1. In the **Action** field, keep `Routing`.
     1. From the **Backend group** list, select `example-bg`.

  1. Do not change the other settings. Click **Create**.
  
- Yandex Cloud CLI {#cli}

  1. Create an HTTP router `example-router`:
  
      ```bash
      yc alb http-router create example-router
      ```
      
      Result:
      
      ```text
      id: ds78i77j8lg0********
      name: example-router
      folder_id: b1gt6g8ht345********
      created_at: "2026-02-05T13:09:27.917359782Z"
      ```
      
      For more information about the `yc alb http-router create` command, see the [CLI reference](../../../cli/cli-ref/application-load-balancer/cli-ref/http-router/create.md).

  1. Create a virtual host named `example-vh`:
  
      ```bash
      yc alb virtual-host create example-vh \
        --http-router-name example-router \
        --authority <domain_name>
      ```

      Where `<domain_name>` is your domain name, e.g., `example.com`.
      
      Result:
      
      ```text
      done (1s)
      name: example-vh
      authority:
        - example.com
      ```
      
      For more information about the `yc alb virtual-host create` command, see the [CLI reference](../../../cli/cli-ref/application-load-balancer/cli-ref/virtual-host/create.md).
     
  1. Create a route named `example-route` in the `example-vh` virtual host:
  
      ```bash
      yc alb virtual-host append-http-route example-route \
        --http-router-name example-router \
        --virtual-host-name example-vh \
        --prefix-path-match "/" \
        --backend-group-name example-bg
      ```
      
      Result:
      
      ```text
      done (1s)
      name: example-vh
      authority:
        - example.com
      routes:
        - name: example-route
          http:
            match:
              path:
                prefix_match: /
            route:
              backend_group_id: ds7glpil29lb********
      ```

      For more information about the `yc alb virtual-host append-http-route` command, see the [CLI reference](../../../cli/cli-ref/application-load-balancer/cli-ref/virtual-host/append-http-route.md).

- API {#api}

  1. To create the `example-router` HTTP router, use the [create](../../api-ref/HttpRouter/create.md) REST API method for the [HttpRouter](../../api-ref/HttpRouter/index.md) resource or the [HttpRouterService/Create](../../api-ref/grpc/HttpRouter/create.md) gRPC API call.
  1. To create the `example-vh` virtual host associated with the router, use the [create](../../api-ref/VirtualHost/create.md) REST API method for the [VirtualHost](../../api-ref/VirtualHost/index.md) resource or the [VirtualHostService/Create](../../api-ref/grpc/VirtualHost/create.md) gRPC API call.

{% endlist %}

## Create an L7 load balancer {#create-balancer}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select `example-folder`.
  1. Navigate to **Application Load Balancer**.
  1. At the top right, click **Create L7 load balancer** and select **Manual**.
  1. In the **Name** field, specify `example-balancer`.
  1. Under **Network settings**:

     1. In the **Network** field, select `example-network`.
     1. In the **Security groups** field, select `From list` and then, from the list that opens, the `example-sg` security group you created earlier.
      
  1. Under **Allocation**, select the three subnets for the load balancer nodes (`example-subnet-ru-central1-a`, `example-subnet-ru-central1-b`, and `example-subnet-ru-central1-d`) and enable traffic to these subnets.
  1. Under **Listeners**, click **Add listener** and set up the listener:
  
     1. In the **Name** field, specify `example-listener`.
     1. Under **Public IP address**:
        * In the **Port** field, specify `80`.
        * In the **Type** field, select `Automatically`.
      
  1. In the **HTTP router** field, select `example-router`.
  1. Click **Create**.
  
- Yandex Cloud CLI {#cli}

  1. Create a load balancer named `example-balancer`:
  
      ```bash
      yc alb load-balancer create example-balancer \
        --network-name example-network \
        --security-group-id <example-sg_security_group_ID> \
        --location zone=ru-central1-a,subnet-id=<example-subnet-ru-central1-a_ID> \
        --location zone=ru-central1-b,subnet-id=<example-subnet-ru-central1-b_ID> \
        --location zone=ru-central1-d,subnet-id=<example-subnet-ru-central1-d_ID>
      ```

      Where:

      * `--security-group-id`: Security group ID you saved when creating the security group.
      * `subnet_id`: Subnet IDs in three availability zones you saved when creating the subnets.
        
      Result:
      
      ```text
      done (7m17s)
      id: ds790ardig7r********
      name: example-balancer
      folder_id: b1gt6g8ht345********
      status: ACTIVE
      region_id: ru-central1
      network_id: enpqm699f18v********
      allocation_policy:
        locations:
          - zone_id: ru-central1-a
            subnet_id: e9b0fo0hvhpd********
          - zone_id: ru-central1-b
            subnet_id: e2lo05oe9slo********
          - zone_id: ru-central1-d
            subnet_id: fl8bpb6lnu80********
      security_group_ids:
        - enp9dpfa774h********
      created_at: "2026-02-05T13:30:25.695763710Z"
      ```
      
      For more information about the `yc alb load-balancer create` command, see the [CLI reference](../../../cli/cli-ref/application-load-balancer/cli-ref/load-balancer/create.md).
     
  1. Add a listener to the load balancer:
  
      ```bash
      yc alb load-balancer add-listener \
        --name example-balancer \
        --listener-name example-listener \
        --external-ipv4-endpoint port=80 \
        --http-router-name example-router
      ```
      
      Result:
      
      ```text
      done (9m53s)
      id: ds790ardig7r********
      name: example-balancer
      folder_id: b1gt6g8ht345********
      status: ACTIVE
      region_id: ru-central1
      network_id: enpqm699f18v********
      listeners:
        - name: example-listener
          endpoints:
            - addresses:
                - external_ipv4_address:
                    address: 158.160.***.***
              ports:
                - "80"
          http:
            handler:
              http_router_id: ds78i77j8lg0********
      allocation_policy:
        locations:
          - zone_id: ru-central1-a
            subnet_id: e9b0fo0hvhpd********
          - zone_id: ru-central1-b
            subnet_id: e2lo05oe9slo********
          - zone_id: ru-central1-d
            subnet_id: fl8bpb6lnu80********
      security_group_ids:
        - enp9dpfa774h********
      ```

      Save the listener IP address (the `address` field value), as you will need it later to create a CDN resource.

      For more information about the `yc alb load-balancer add-listener` command, see the [CLI reference](../../../cli/cli-ref/application-load-balancer/cli-ref/load-balancer/add-listener.md).

- API {#api}

  To create an L7 load balancer, use the [create](../../api-ref/LoadBalancer/create.md) REST API method for the [LoadBalancer](../../api-ref/LoadBalancer/index.md) resource or the [LoadBalancerService/Create](../../api-ref/grpc/LoadBalancer/create.md) gRPC API call.
          
{% endlist %}

## Create a CDN resource {#create-cdn-resource}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select `example-folder`.
  1. Navigate to **Cloud CDN**.
  1. Click **Create resource**.
  1. Configure the basic CDN resource settings:

      * Under **Content**:

          * Enable **Enable access to content**.
          * In the **Content query** field, select `From one origin`.
          * In the **Origin type** field, select `L7 load balancer` and then, in the field that appears, `example-balancer`.
          * In the **IP address** field, select the IP address assigned to the load balancer (the only one in the list).
          * In the **Origin request protocol** field, select `HTTP`.
          * In the **Domain name** field, specify your domain name, e.g., `example.com`.

              {% note alert %}

              The specified domain name will become the primary one, and you will not be able to edit it after you create a CDN resource.

              {% endnote %}

      * Under **Additional settings**:

          * In the **Redirect clients** field, select `HTTP to HTTPS`.
          * In the **Certificate type** field, specify `Use from Certificate Manager` and select the `mymanagedcert` [certificate](#add-certificate) you previously created for your domain name.
          * In the **Host header** field, select `Match client`.
  1. Click **Continue**.
  1. Keep the default settings for **Caching**, **HTTP headers and methods**, and **Additional** and click **Continue**.

- Yandex Cloud CLI {#cli}

  1. Create an origin group named `example-origin-group`, specifying the load balancer IP address you saved earlier:

      ```bash
      yc cdn origin-group create --name "example-origin-group" \
        --origin source=<load_balancer_IP_address>:80,enabled=true
      ```

      Result:

      ```text
      id: "12756795849********"
      folder_id: b1gt6g8ht345********
      name: example-origin-group
      use_next: true
      origins:
        - id: "68784"
          origin_group_id: "12756795849********"
          source: 158.160.***.***:80
          enabled: true
          provider_type: ourcdn
      provider_type: ourcdn
      ```

      Save the origin group ID (the `origin_group_id` field value), as you will need it later to create a CDN resource.

      For more information about the `yc cdn origin-group create` command, see the [CLI reference](../../../cli/cli-ref/cdn/cli-ref/origin-group/create.md).

  1. Create a CDN resource:
  
      ```bash
      yc cdn resource create \
        --cname <domain_name> \
        --origin-group-id <origin_group_ID> \
        --origin-protocol http \
        --cert-manager-ssl-cert-id <certificate_ID> \
        --forward-host-header
      ```

      Where:

      * `--cname`: Your domain's name, e.g., `example.com`.
      * `--origin-group-id`: Origin group ID you got in the previous step.
      * `--cert-manager-ssl-cert-id`: ID of the `mymanagedcert` certificate you created [earlier](#add-certificate).

      Result:

      ```text
      id: bc8rpt67l6dl********
      folder_id: b1gt6g8ht345********
      cname: example.com
      created_at: "2026-02-05T14:05:24.913996Z"
      updated_at: "2026-02-05T14:05:24.913996Z"
      active: true
      options:
        edge_cache_settings:
          enabled: true
          default_value: "86400"
        browser_cache_settings: {}
        query_params_options:
          ignore_query_string:
            enabled: true
            value: true
        slice: {}
        host_options:
          forward_host_header:
            enabled: true
            value: true
        static_headers:
          enabled: true
        stale: {}
        allowed_http_methods:
          enabled: true
          value:
            - GET
            - HEAD
            - OPTIONS
        static_request_headers:
          enabled: true
        custom_server_name: {}
        ignore_cookie:
          enabled: true
          value: true
        secure_key:
          type: DISABLE_IP_SIGNING
      origin_group_id: "12756795849********"
      origin_group_name: example-origin-group
      origin_protocol: HTTP
      ssl_certificate:
        type: CM
        status: READY
        data:
          cm:
            id: fpq7t9dpi4o0********
      provider_type: ourcdn
      provider_cname: d88c6ee6********.topology.gslb.yccdn.ru
      ```

      Save the new resource `id` and `provider_cname` as you will need them later.

      For more information about the `yc cdn resource create` command, see the [CLI reference](../../../cli/cli-ref/cdn/cli-ref/resource/create.md).

  1. Enable client redirects for the CDN resource, specifying the ID you saved in the previous step:

      ```bash
      yc cdn resource update <CDN_resource_ID> \
        --redirect-http-to-https
      ```

      For more information about the `yc cdn resource update` command, see the [CLI reference](../../../cli/cli-ref/cdn/cli-ref/resource/update.md).

- API {#api}

  To create a CDN resource, use the [create](../../../cdn/api-ref/Resource/create.md) REST API method for the [Resource](../../../cdn/api-ref/Resource/index.md) resource or the [ResourceService/Create](../../../cdn/api-ref/grpc/Resource/create.md) gRPC API call.
  
{% endlist %}

## Create a CNAME resource record for the CDN resource {#create-cdn-cname-record}

{% list tabs group=instructions %}

- Management console {#console}

  1. [Get](../../../cdn/operations/resources/get-resources-info.md#get-cname) the CDN provider domain name value.
  1. In the [management console](https://console.yandex.cloud), select `example-folder`.
  1. Navigate to **Cloud DNS** and select the DNS zone you created [earlier](#configure-dns).
  1. Click **Create record**.
  1. Specify the record settings:

        * In the **Name** field, select `Matches zone name (@)`.
        * In the **Type** field, select the `CNAME` [record type](../../../dns/concepts/resource-record.md#rr-types).
        * In the **Data** field, specify the [domain name](../../../cdn/operations/resources/get-resources-info.md#get-cname) value of the CDN provider.

  1. Click **Create**.

- Yandex Cloud CLI {#cli}

  1. Create a CNAME resource record in Cloud DNS:

      ```bash
      yc dns zone add-records \
        --name my-domain-zone \
        --record "@ 600 CNAME <cname_value>"
      ```

      Where `<cname_value>` is the CNAME provider value you got ealier.

      Result:

      ```text
      +--------+--------------+-------+-----------------------------------------+-----+
      | ACTION |     NAME     | TYPE  |                  DATA                   | TTL |
      +--------+--------------+-------+-----------------------------------------+-----+
      | +      | example.com. | CNAME | d88c6ee6********.topology.gslb.yccdn.ru | 600 |
      +--------+--------------+-------+-----------------------------------------+-----+
      ```

      For more information about the `yc dns zone add-records` command, see the [CLI reference](../../../cli/cli-ref/dns/cli-ref/zone/add-records.md).

- API {#api}

  To get the CNAME record value for a CDN resource, use the [getProviderCName](../../../cdn/api-ref/Resource/getProviderCName.md) REST API method for the [Resource](../../../cdn/api-ref/Resource/index.md) resource or the [ResourceService/GetProviderCName](../../../cdn/api-ref/grpc/Resource/getProviderCName.md) gRPC API call.

  To create a CNAME resource record in a DNS zone, use the [updateRecordSets](../../../dns/api-ref/DnsZone/updateRecordSets.md) REST API method for the [DnsZone](../../../dns/api-ref/DnsZone/index.md) resource or the [DnsZoneService/UpdateRecordSets](../../../dns/api-ref/grpc/DnsZone/updateRecordSets.md) gRPC API call.

{% endlist %}

It may take a few hours to update DNS records on the DNS servers. After that, you can check the health of the service.

If your domain is managed from outside Yandex Cloud, to create the resource record for the CDN resource, use tools provided by your domain administrator. For more information, see [Domain rights check](../../../certificate-manager/concepts/challenges.md).

## Test the service {#check}

To test the service, open `https://example.com/index.html` in your browser (with your domain name in place of `example.com`). If everything is configured correctly, you should see a page with the following content:

```html
<!DOCTYPE html>
<html>
  <head>
    <title>My service</title>
  </head>
  <body>
    <p>The service is working</p>
  </body>
</html>
```

## How to delete the resources you created {#clear-out}

To shut down the infrastructure and stop paying for the resources you created:

1. If you set up CNAME records in Cloud DNS, [delete](../../../dns/operations/zone-delete.md) `example-dns-zone`.
1. Delete the CDN resource with `example.com` as its primary domain name.
1. [Delete](../../operations/application-load-balancer-delete.md) the `example-balancer` L7 load balancer.
1. [Delete](../../../storage/operations/objects/delete.md) all objects from the bucket.
1. [Delete](../../../storage/operations/buckets/delete.md) the bucket.
1. [Delete](../../../vpc/operations/subnet-delete.md) the `example-subnet-ru-central1-a`, `example-subnet-ru-central1-b`, and `example-subnet-ru-central1-d` subnets.
1. [Delete](../../../vpc/operations/security-group-delete.md) the `example-sg` security group.
1. [Delete](../../../vpc/operations/network-delete.md) `example-network`.
1. [Delete](../../../certificate-manager/operations/managed/cert-delete.md) the `mymanagedcert` certificate if you no longer need it.

#### See also {#see-also}

* [Integrating an L7 load balancer with Cloud CDN and Object Storage using Terraform](terraform.md)