anchor.diff:  
   === Add the ELB in front of the EC2 instances
   
  -The last major task is to setup the Elastic Load Balancer in front of the EC2 instances. You will actually need to deploy two separate load balancers, one for access to KAUI, and one for the KB server. We will describe the procedure for one ELB, and you will need to repeat this for each one.
  -
  -To begin, from the EC2 dashboard scroll down the left-hand menu and select *Load Balancing / Load Balancers*. Then click the  *Create Load Balancer* button at the upper left.
  +The last major task is to setup the Elastic Load Balancer in front of the EC2 instances. To begin, from the EC2 dashboard scroll down the left-hand menu and select *Load Balancing / Load Balancers*. Then click the  *Create Load Balancer* button at the upper left.
   
   You will be given a choice of several load balancer types. The type we will use is *Application Load Balancer*.
   
  
positive.code: On this page you need to do three things:
  
  1. Assign a name to your load balancer
  2. Select a protocol for your listener. For our first example we will assume this will be HTTP. However to ensure a secure connection, we recommend using HTTPS as discussed below.
  3. Set the listener port to 443 (for the KAUI load balancer) or 8443 (for the Kill Bill load balancer).
  4. Scroll to the bottom and select at least *two* availability zones. *IMPORTANT: You must select all of the zones that your EC2 instances are contained in. Otherwise, the load balancer will be unable to connect to these instances.*
  
  Then choose *Next: Configure Security Settings*. You will now see a page titled *Step 2: Configure Security Settings*.
  
  image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/ELB-configure-security.png[align=center]
  
  If you have selected the HTTPS protocol, you will now be required to create or provide an X.509 SSL Certificate. There are many ways to do this. Some are discussed below. If you are using HTTP, you will see a warning message. Ignore the message and choose *Next: Configure Security Groups*. This will take you to a page titled *Step 3: Configure Security Groups.*  This page will show you the existing security groups and offer the choice to choose an existing group or create a new one. We advise you to create a new group, which will then be used by both load balancers. The new security group should have inbound rules enabling inputs for KAUI and Kill Bill as shown here: 
  
  image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/ELB-configure-security-groups.png[align=center]
  
  The next step is to identify the *target* instances for each load balancer, which are collected into a *target group*. For each ELB you will need to create a new target group. Each group will consist of all of the instances you have launched. First, create the group and give it a simple name:
  
  image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/ELB-configure-routing.png[align=center]
  
  On this page the port must be set to 3000 for the KAUI ELB, or to 8080 for the Kill Bill ELB.
  
  Next scroll to the bottom of the same page and expand the section named *Advanced health check settings*. In the field named *Success Codes* enter "200,302".
  
  image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/ELB-healthcheck.png[align=center]
  
  
  Now click on *Next: Register Targets*. You are nearly done. The purpose of this final step is to identify the target instances that will be part of your target group. Initially all your instances will be listed in the bottom section. To register them, select them all and click *Add to Registered*. Then proceed to *Next: Review*.
  
  image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/aws/ELB-register-targets.png[align=center]
  
  Check all settings, then click *Create*. Your load balancer will be created. Close the final page to see the Load Balancer list. The initial status for your new ELB will be "provisioning". After a few minutes this will change to "active".
  
  When both ELBs are ready you can proceed to testing. You should be able to login to KAUI from your browser using the URL https://DNS_NAME:443/users/sign_in, where DNS_NAME is the *DNS name* for the KAUI load balancer as given on the Load Balancer dashboard. This should display the KAUI login screen. The default credentials are: *admin/password*. The first few requests might be a bit slow as Kill Bill initializes itself.
  
  For an introduction to KAUI, see our http://docs.killbill.io/latest/getting_started.html#_using_kill_bill_with_kaui[Getting Started] guide.
  
  
negative.code: To begin, log in to Amazon Web Services at https://aws.amazon.com. If you are new to AWS, you will be asked to create an account and provide billing information. You will need to sign in as a *Root User*. This should take you to the *AWS Management Console*, which provides links to all available services.
  
  Check the upper right corner of your screen to be sure you are in the appropriate *region*. All resources you create will be placed in this region, and may not be accessible from other regions.
  
  In addition, AWS places all resources within a *Virtual Private Network (VPC)*. A default VPC will be created and used automatically in the following steps. However, if you have access to other VPCs, you will need to ensure that all Kill Bill respources are deployed in the same one.
  
  === Setup the Database
  
  