# ApplicationLoadBalancer

Define an Application Load Balancer.

Extends: Construct › Resource › BaseLoadBalancer › ApplicationLoadBalancer
Implements: IResource, IConnectable, IApplicationLoadBalancer, IApplicationLoadBalancerRef, ILoadBalancerV2, IEnvironmentAware, ILoadBalancerRef, IConstruct, IDependable

- CloudFormation: [`AWS::ElasticLoadBalancingV2::LoadBalancer`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-loadbalancer.html)
- L1 type: [`CfnLoadBalancer`](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.CfnLoadBalancer.html)
- Source: [`aws-elasticloadbalancingv2/lib/alb/application-load-balancer.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-elasticloadbalancingv2/lib/alb/application-load-balancer.ts#L164)
- Type last changed: v2.234.0 · 8 Jan 2026

## Example

```ts
declare const vpc: ec2.Vpc;

const securityGroup1 = new ec2.SecurityGroup(this, 'SecurityGroup1', { vpc });
const lb = new elbv2.ApplicationLoadBalancer(this, 'LB', {
  vpc,
  internetFacing: true,
  securityGroup: securityGroup1, // Optional - will be automatically created otherwise
});

const securityGroup2 = new ec2.SecurityGroup(this, 'SecurityGroup2', { vpc });
lb.addSecurityGroup(securityGroup2);
```

## Initializer

```ts
new ApplicationLoadBalancer(scope: Construct, id: string, props: ApplicationLoadBalancerProps)
```

## Construct Props

- `clientKeepAlive`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) = Duration.seconds(3600) — The client keep alive duration.

  The valid range is 60 to 604800 seconds (1 minute to 7 days).

- `crossZoneEnabled`: boolean — Indicates whether cross-zone load balancing is enabled.

  **Default:** false for Network Load Balancers and true for Application Load Balancers. This can not be `false` for Application Load Balancers.

- `deletionProtection`: boolean = false — Indicates whether deletion protection is enabled.

- `denyAllIgwTraffic`: boolean — Indicates whether the load balancer blocks traffic through the Internet Gateway (IGW).

  **Default:** false for internet-facing load balancers and true for internal load balancers

- `desyncMitigationMode`: [DesyncMitigationMode](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.DesyncMitigationMode.html) = DesyncMitigationMode.DEFENSIVE — Determines how the load balancer handles requests that might pose a security risk to your application.

- `dropInvalidHeaderFields`: boolean = false — Indicates whether HTTP headers with invalid header fields are removed by the load balancer (true) or routed to targets (false).

- `http2Enabled`: boolean = true — Indicates whether HTTP/2 is enabled.

- `idleTimeout`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) = 60 — The load balancer idle timeout, in seconds.

- `internetFacing`: boolean = false — Whether the load balancer has an internet-routable address.

- `ipAddressType`: [IpAddressType](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.IpAddressType.html) = IpAddressType.IPV4 — The type of IP addresses to use.

- `loadBalancerName`: string — Name of the load balancer.

  **Default:** Automatically generated name.

- `minimumCapacityUnit`: number — The minimum capacity (LCU) for a load balancer.

  **Default:** undefined - ELB default is 0 LCU

- `preserveHostHeader`: boolean = false — Indicates whether the Application Load Balancer should preserve the host header in the HTTP request and send it to the target without any change.

- `preserveXffClientPort`: boolean = false — Indicates whether the X-Forwarded-For header should preserve the source port that the client used to connect to the load balancer.

- `securityGroup`: [ISecurityGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ISecurityGroup.html) — Security group to associate with this load balancer.

  **Default:** A security group is created

- `vpc`: [IVpc](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IVpc.html) (required) — The VPC network to place the load balancer in.

- `vpcSubnets`: [SubnetSelection](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.SubnetSelection.html) — Which subnets place the load balancer in.

  **Default:** the Vpc default strategy.

- `wafFailOpen`: boolean = false — Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF.

- `xAmznTlsVersionAndCipherSuiteHeaders`: boolean = false — Indicates whether the two headers (x-amzn-tls-version and x-amzn-tls-cipher-suite), which contain information about the negotiated TLS version and cipher suite, are added to the client request before sending it to the target.

  The x-amzn-tls-version header has information about the TLS protocol version negotiated with the client,
  and the x-amzn-tls-cipher-suite header has information about the cipher suite negotiated with the client.

  Both headers are in OpenSSL format.

- `xffHeaderProcessingMode`: [XffHeaderProcessingMode](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.XffHeaderProcessingMode.html) = XffHeaderProcessingMode.APPEND — Enables you to modify, preserve, or remove the X-Forwarded-For header in the HTTP request before the Application Load Balancer sends the request to the target.

## Properties

- `connections`: [Connections](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Connections.html) — The network connections associated with this resource.

- `env`: [ResourceEnvironment](/cdk/api/v2/docs/aws-cdk-lib.interfaces.ResourceEnvironment.html) — The environment this resource belongs to.

  For resources that are created and managed in a Stack (those created by
  creating new class instances like `new Role()`, `new Bucket()`, etc.), this
  is always the same as the environment of the stack they belong to.

  For referenced resources (those obtained from referencing methods like
  `Role.fromRoleArn()`, `Bucket.fromBucketName()`, etc.), they might be
  different than the stack they were imported into.

- `ipAddressType`: [IpAddressType](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.IpAddressType.html) — The IP Address Type for this load balancer.

  If the `@aws-cdk/aws-elasticloadbalancingV2:albDualstackWithoutPublicIpv4SecurityGroupRulesDefault`
  feature flag is set (the default for new projects), and `addListener()` is called with `open: true`,
  the load balancer's security group will automatically include both IPv4 and IPv6 ingress rules
  when using `IpAddressType.DUAL_STACK_WITHOUT_PUBLIC_IPV4`.

  For existing projects that only have IPv4 rules, you can opt-in to IPv6 ingress rules
  by enabling the feature flag in your cdk.json file. Note that enabling this feature flag
  will modify existing security group rules.

- `isApplicationLoadBalancer`: boolean — Indicates that this is an Application Load Balancer.

  Will always return true, but is necessary to prevent accidental structural
  equality in TypeScript.

- `listeners`: [ApplicationListener](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.ApplicationListener.html)[] — A list of listeners that have been added to the load balancer.

  This list is only valid for owned constructs.

- `loadBalancerArn`: string — The ARN of this load balancer.

  Example value: `arn:aws:elasticloadbalancing:us-west-2:123456789012:loadbalancer/app/my-internal-load-balancer/50dc6c495c0c9188`

- `loadBalancerCanonicalHostedZoneId`: string — The canonical hosted zone ID of this load balancer.

  Example value: `Z2P70J7EXAMPLE`

- `loadBalancerDnsName`: string — The DNS name of this load balancer.

  Example value: `my-load-balancer-424835706.us-west-2.elb.amazonaws.com`

- `loadBalancerFullName`: string — The full name of this load balancer.

  Example value: `app/my-load-balancer/50dc6c495c0c9188`

- `loadBalancerName`: string — The name of this load balancer.

  Example value: `my-load-balancer`

- `loadBalancerRef`: [LoadBalancerReference](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_elasticloadbalancingv2.LoadBalancerReference.html) — A reference to this load balancer.

- `loadBalancerSecurityGroups`: string[]

- `metrics`: [IApplicationLoadBalancerMetrics](/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.IApplicationLoadBalancerMetrics.html) — All metrics available for this load balancer.

- `node`: [Node](/cdk/api/v2/docs/constructs.Node.html) — The tree node.

- `PROPERTY_INJECTION_ID`: string (static) — Uniquely identifies this class.

- `stack`: [Stack](/cdk/api/v2/docs/aws-cdk-lib.Stack.html) — The stack in which this resource is defined.

- `vpc`: [IVpc](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IVpc.html) — The VPC this load balancer has been created in.

  This property is always defined (not `null` or `undefined`) for sub-classes of `BaseLoadBalancer`.

## Methods

- `addListener(id: string, props: BaseApplicationListenerProps): ApplicationListener` — Add a new listener to this load balancer.

- `addRedirect(props?: ApplicationLoadBalancerRedirectConfig): ApplicationListener` — Add a redirection listener to this load balancer.

- `addSecurityGroup(securityGroup: ISecurityGroup): void` — Add a security group to this load balancer.

- `applyCrossStackReferenceStrength(strength: ReferenceStrength): void` — Override the cross-stack reference strength for this resource.

  When set, any cross-stack reference to this resource will use the specified
  mechanism instead of the global default determined by the
  `@aws-cdk/core:defaultCrossStackReferences` context key. This is useful for
  selectively weakening specific references to avoid the "deadly embrace" problem
  without changing the app-wide default.

  **Parameters**

  - `strength` — - The reference strength to use for this resource.

- `applyRemovalPolicy(policy: RemovalPolicy): void` — Apply the given removal policy to this resource.

  The Removal Policy controls what happens to this resource when it stops
  being managed by CloudFormation, either because you've removed it from the
  CDK application or because you've made a change that requires the resource
  to be replaced.

  The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
  account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).

- `fromApplicationLoadBalancerAttributes(scope: Construct, id: string, attrs: ApplicationLoadBalancerAttributes): IApplicationLoadBalancer` (static) — Import an existing Application Load Balancer.

- `fromLookup(scope: Construct, id: string, options: ApplicationLoadBalancerLookupOptions): IApplicationLoadBalancer` (static) — Look up an application load balancer.

- `isConstruct(x: any): boolean` (static) — Checks if `x` is a construct.

  Use this method instead of `instanceof` to properly detect `Construct`
  instances, even when the construct library is symlinked.

  Explanation: in JavaScript, multiple copies of the `constructs` library on
  disk are seen as independent, completely different libraries. As a
  consequence, the class `Construct` in each copy of the `constructs` library
  is seen as a different class, and an instance of one class will not test as
  `instanceof` the other class. `npm install` will not create installations
  like this, but users may manually symlink construct libraries together or
  use a monorepo tool: in those cases, multiple copies of the `constructs`
  library can be accidentally installed, and `instanceof` will behave
  unpredictably. It is safest to avoid using `instanceof`, and using
  this type-testing method instead.

  **Parameters**

  - `x` — Any object.

  **Returns:** true if `x` is an object created from a class which extends `Construct`.

- `isOwnedResource(construct: IConstruct): boolean` (static) — Returns true if the construct was created by CDK, and false otherwise.

- `isResource(construct: IConstruct): boolean` (static) — Check whether the given construct is a Resource.

- `logAccessLogs(bucket: IBucket, prefix?: string): void` — Enable access logging for this load balancer.

  A region must be specified on the stack containing the load balancer; you cannot enable logging on
  environment-agnostic stacks. See https://docs.aws.amazon.com/cdk/latest/guide/environments.html

- `logConnectionLogs(bucket: IBucket, prefix?: string): void` — Enable connection logging for this load balancer.

  A region must be specified on the stack containing the load balancer; you cannot enable logging on
  environment-agnostic stacks.

- `metric(metricName: string, props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.custom`` instead

- `metricActiveConnectionCount(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.activeConnectionCount`` instead

- `metricClientTlsNegotiationErrorCount(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.clientTlsNegotiationErrorCount`` instead

  Possible causes include a
  mismatch of ciphers or protocols.

- `metricConsumedLCUs(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.consumedLCUs`` instead

- `metricElbAuthError(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.elbAuthError`` instead

  Because an authenticate action was misconfigured, the load balancer
  couldn't establish a connection with the IdP, or the load balancer
  couldn't complete the authentication flow due to an internal error.

- `metricElbAuthFailure(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.elbAuthFailure`` instead

- `metricElbAuthLatency(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.elbAuthLatency`` instead

  If one or more of these operations fail, this is the time to failure.

- `metricElbAuthSuccess(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.elbAuthSuccess`` instead

  This metric is incremented at the end of the authentication workflow,
  after the load balancer has retrieved the user claims from the IdP.

- `metricHttpCodeElb(code: HttpCodeElb, props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.httpCodeElb`` instead

  This does not include any response codes generated by the targets.

- `metricHttpCodeTarget(code: HttpCodeTarget, props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.httpCodeTarget`` instead

  This does not include any response codes generated by the load balancer.

- `metricHttpFixedResponseCount(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.httpFixedResponseCount`` instead

- `metricHttpRedirectCount(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.httpRedirectCount`` instead

- `metricHttpRedirectUrlLimitExceededCount(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.httpRedirectUrlLimitExceededCount`` instead

- `metricIpv6ProcessedBytes(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.ipv6ProcessedBytes`` instead

- `metricIpv6RequestCount(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.ipv6RequestCount`` instead

- `metricNewConnectionCount(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.newConnectionCount`` instead

- `metricProcessedBytes(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.processedBytes`` instead

- `metricRejectedConnectionCount(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.rejectedConnectionCount`` instead

- `metricRequestCount(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.requestCount`` instead

  This count includes only the requests with a response generated by a target of the load balancer.

- `metricRuleEvaluations(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.ruleEvaluations`` instead

- `metricTargetConnectionErrorCount(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.targetConnectionErrorCount`` instead

- `metricTargetResponseTime(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.targetResponseTime`` instead

- `metricTargetTLSNegotiationErrorCount(props?: MetricOptions): Metric` — Use ``ApplicationLoadBalancer.metrics.targetTLSNegotiationErrorCount`` instead

  Possible causes include a mismatch of ciphers or protocols.

- `removeAttribute(key: string): void` — Remove an attribute from the load balancer.

- `setAttribute(key: string, value?: string): void` — Set a non-standard attribute on the load balancer.

- `toString(): string` — Returns a string representation of this construct.

- `with(...mixins: IMixin[]): IConstruct` — Applies one or more mixins to this construct.

  Mixins are applied in order. The list of constructs is captured at the
  start of the call, so constructs added by a mixin will not be visited.
  Use multiple `with()` calls if subsequent mixins should apply to added
  constructs.