anchor.diff:  
   In a short time, the **Instance State** for your instance should indicate `Running`. You will need to scroll to the right to see all of the information available about your instances.
   
  -
  -Now proceed with the rest of the setup as described under single tier. However, there is one important difference. When you edit the security group for your instances (all should use the same one), you will need to identify the ports to be used by the load balancer in place of those expected by the external client. Thus, the inbound rules for your security group should now look like this:
  -
  -image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/multitier-inbound.png[align=center]
  -
  -
  -[4] Create the databases
  +=== Setup Security Rules
  +
  +You are almost set, but there is one more thing you need to do, and that is to scroll down in the menu on the left side to select **Security Groups**. You should see a list of two or more groups. Select the group whose name begins with `Kill Bill on AWS`, then scroll to the bottom and select the tab for `Inbound Rules`. You should see:
  +
  +image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/multitier-inbound-original.png[align=center]
  +
  +These rules enable the ports that must be open to access KAUI and Kill Bill from a browser. However, for access through the ELB these ports will be different. In addition, to enable direct login to your instance using SSH, you need to add one more port.
  +
  +Click on **Edit Inbound Rules**. then do the following:
  +
  +1. For the rule that specifies Type: HTTPS, Port Range: 443, change the type to CUStOM TCP and the Port Range to 3000.
  +2. For the rule that specifies Type: CUStOM TCP, Port Range: 8443, change the Port Range to 8080.
  +3. Finally, add a rule with the following elements: Type: SSH, Protocol: TCP, Port Range: 22, Source: 0.0.0.0/0.
  +
  +Your Inbound Rules should now look like this:  
  +
  +image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/multitier-inbound-new.png[align=center]
  +
  +You should now be able to login to KAUI from your browser using the URL https://INSTANCE_IP:3000, where INSTANCE_IP is the IPV4 address for any one of your instances, given on your dashboard as **Public IPV4 Address**. This should display the KAUI login screen. The default credentials are: *admin/password*. The first few requests might be a bit slow as Kill Bill initializes itself. For an introduction to KAUI, see our http://docs.killbill.io/latest/getting_started.html#_using_kill_bill_with_kaui[Getting Started] guide.
  +
  +In addition, the URL https://INSTANCE_IP:8080 should display a page confirming that the Kill Bill server is accessible.
  +
  +
  +=== Create the Databases
   
   Kill Bill requires two databases, with the names `killbill` and `kaui`. We provide predefined schemas for these databases.
   
  -First you will need to login to *one* of your instances and create the databases. To login, use the secure shell command:
  +To create the databases, you will need to login to *one* of your instances. To login, use the secure shell command:
   
   `ssh -i PRIVATE_KEY.pem ubuntu@INSTANCE_IP`
   
  -Here PRIVATE_KEY is the pathname where you have stored the private key that was downloaded when you generated your key pair, and INSTANCE_IP is the IPV4 address described earlier. The private key will not work unless its access controls are set to readable by the owner only.
  +Here PRIVATE_KEY is the pathname where you have stored the private key that was downloaded when you generated your key pair, and INSTANCE_IP is the IPV4 address described earlier. *The private key will not work unless its access controls are set to readable by the owner only*.  The `ssh` command relies on the security rule providing access to Port 22, which you added in the previous step.
   
   On Windows versions before Windows 10, you may need to download a program called PuTTY to enable `ssh`. On Windows 10 `ssh` is available but may need to be activated through the Settings screen.
   
  
positive.code: > mysql -h DB-INSTANCE-NAME -u ADMIN-NAME -p kaui < kaui.ddl
  Enter Password:
  ```
  To ensure that the databases are setup correctly, login to mysql again, then try the SHOW TABLES command:
  
  ```
  > mysql -h DB-INSTANCE-NAME -u ADMIN-NAME -p
  
negative.code: 
  
  
  
  === Add the ELB in front of the EC2 instances
  
  The last major task is to setup the Elastic Load Balancer in front of the EC2 instances. You will actually need to deploy two separate load balancers, one for access to KAUI, and one for the KB server.
  
  To begin, from the EC2 dashboard scroll down the left-hand menu and select *Load Balancing / Load Balancers*. Then click the  *Create Load Balancer* button at the upper left.
  
  You will be given a choice of several load balancer types. The type we will use is *Application Load Balancer*.
  
  