anchor.diff:  To begin, log in to Amazon Web Services at https://aws.amazon.com. If you are new to AWS, you will be asked to create an account and provide billing information. You will need to sign in as a *Root User*. This should take you to the *AWS Management Console*, which provides links to all available services.
   
   Check the upper right corner of your screen to be sure you are in the appropriate *region*. All resources you create will be placed in this region, and may not be accessible from other regions.
  +
  +In addition, AWS places all resources within a *Virtual Private Network (VPC)*. A default VPC will be created and used automatically in the following steps. However, if you have access to other VPCs, you will need to ensure that all Kill Bill respources are deployed in the same one.
   
   === Setup the Database
   
  
positive.code: 
  === Add the ELB in front of the EC2 instances
  
  The last major task is to setup the Elastic Load Balancer in front of the EC2 instances. You will actually need to deploy two separate load balancers, one for access to KAUI, and one for the KB server. We will describe the procedure for one ELB, and you will need to repeat this for each one.
  
  To begin, from the EC2 dashboard scroll down the left-hand menu and select *Load Balancing / Load Balancers*. Then click the  *Create Load Balancer* button at the upper left.
  
  You will be given a choice of several load balancer types. The type we will use is *Application Load Balancer*.
  
  
negative.code: On this page you need to do three things:
  
  1. Assign a name to your load balancer
  2. Select a protocol for the listener. We recommend using HTTPS as discussed below.
  3. Set the listener port to 443 (if using HTTPS) or 80 (if using HTTP).
  4. Click *Add Listener* to add a second listener using the same protocol and set its port to 8443.
  5. Scroll to the bottom and select at least *two* availability zones. *IMPORTANT: You must select all of the zones that your EC2 instances are contained in. Otherwise, the load balancer will be unable to connect to these instances.*
  
  Now choose *Next: Configure Security Settings*. You will now see a page titled *Step 2: Configure Security Settings*.
  
  image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/ELB-configure-security.png[align=center]
  
  If you have selected the HTTPS protocol, you will be required to create or provide an X.509 SSL Certificate. If you have a certificate you can identify or upload it here. Otherwise we recommend you create a new one using the *Amazon Certificate Manager* as discussed below.
  
  If you are using HTTP, you will see a warning message, which can be ignored.
  
  In either case, your next step is to choose *Next: Configure Security Groups*. This will take you to a page titled *Step 3: Configure Security Groups.*  This page will show you the existing security groups and offer the choice to choose an existing group or create a new one. We advise you to create a new group, which will then be used by both load balancers. The new security group should have inbound rules enabling inputs for KAUI and Kill Bill as shown here: 
  
  image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/ELB-configure-security-groups.png[align=center]
  
  These rules assume you are using HTTPS. If you are using HTTP, the port for the first rule should be 80.
  
  The next step is to identify the *target* instances for your load balancer, which are collected into a *target group*. Each listener will have a separate target group, but you can only setup one right now. The other group will be added later.
  
  Your group will consist of all of the instances you have launched. First, create the group, give it a simple name, and set the port to 3000:
  
  image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/ELB-configure-routing.png[align=center]
  
  Now click on *Next: Register Targets*. The purpose of this step is to identify the target instances that will be part of your target group. Initially, all your instances will be listed in the bottom section. To register them, select them all and click *Add to Registered*. Then proceed to *Next: Review*.
  
  image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/ELB-register-targets.png[align=center]
  
  Check all settings, then click *Create*. Your load balancer will be created. Close the final page to see the Load Balancer list. The initial status for your new ELB will be "provisioning". After a few minutes this will change to "active".
  
  You are almost done. Your final step is to modify the second listener to use a different port number to access the Kill Bill server. From the left side menu select *Target Groups*. Click *Create Target Group*. In the page that appears, set the protocol to HTTP and set the port to 8080. THen click *Next*.
  
  image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/ELB-register-targets-2.png[align=center]
  
  
  The next page is provided to register the targets for this group. Once again you will register all your instances as targets, but this works just a little differently than before. The list of available targets is at the top. Select all of them, then click *Include as Pending Below* to make these targets pending as members of the group. Finally, click *Create Target Group* to create the group.
  
  Now you will need to associate this group with your load balancer's second listener. Return to the Load Balancer console, select your load balancer, and choose the *Listeners* tab in the bottom information panel.  Then in the second entry, click *View/Edit Rules*.
  
  image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/ELB-rules.png[align=center]
  
  Your objet now is to change the rule for this listener to point to your new target group. To do this:
  
  1. Click on the pencil icon at the top
  2. Click on the pencil icon to the left of the rule
  3. Click on the pencil icon under the heading *THEN*
  4. Select your new target group in the dropdown list
  5. At the top of the page, click *UPDATE*
  
  Go back to the listener tab and confirm that the second listener points to the new target group. Your load balancer is now ready.
  
  When your ELB is complete you can proceed to testing. You should be able to login to KAUI from your browser using the URL https://DNS_NAME/users/sign_in, where DNS_NAME is the *DNS name* for the KAUI load balancer as given on the Load Balancer dashboard. This should display the KAUI login screen. The default credentials are: *admin/password*. The first few requests might be a bit slow as Kill Bill initializes itself.
  
  For an introduction to KAUI, see our http://docs.killbill.io/latest/getting_started.html#_using_kill_bill_with_kaui[Getting Started] guide.
  
  