Amazon ELBv2

Amazon Web Services

Overview

Integrates with AWS Elastic Load Balancing v2 to inventory Application, Network, and Gateway load balancers along with their target groups and the health of the individual targets registered to those groups. Across every configured AWS account and region the connector reads load balancers (DescribeLoadBalancers), enriches them with tags (DescribeTags), reads target groups (DescribeTargetGroups), and reads per-target health (DescribeTargetHealth), emitting one Brinqa object per load balancer, per target group, and per registered target/health record.

Data retrieved from Amazon ELBv2

Connector Object	Required	Maps to Data Model
Load Balancer	Yes	Cloud Resource
Target Group	Yes	Cloud Resource
Target Health	Yes	Cloud Resource

note

For detailed steps on how to view the data retrieved from Amazon ELBv2 in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Amazon ELBv2 from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Access key ID	No	—	AWS user access key ID, if not specified, the connector consults the default credentials provider chain to try and determine the \
Secret access key	No	—	AWS user secret access key, if not specified, the connector consults the default credentials provider chain to try and determine the \
Default region	No	us-east-1	Default AWS region, if not specified, the connector consults the default region provider chain to try and determine the region to use.
Assume role	No	—	Amazon Resource Name for the role to assume.
Session duration	No	900	Assume role session duration in seconds.
Page size	No	100	The maximum number of results to retrieve per operation.

Authentication

Authentication is shared across the AWS connector bundle via the AwsConfiguration base class. The ELBv2 sub-connector uses the AWS SDK for Java v2 ElasticLoadBalancingV2Client, which signs every request with AWS SigV4 using credentials resolved through the following chain (in order):

1. STS AssumeRole — if assumeRoleARN is configured, the connector assumes that role (using the credentials below as the principal) and uses the resulting temporary session credentials.
2. Static access keys — if accessKey / secretKey are configured, they are used directly.
3. Default credentials provider chain — environment variables, ~/.aws/credentials, container role, or EC2 instance metadata.

Assumed-role sessions use the configurable sessionDuration (default 900 s) with a unique session name per sync. assumeRoleARN may be a comma-separated list to sync multiple accounts in one run. A separate ElasticLoadBalancingV2Client is constructed per role per region and closed when that region has been fully synced.

Required AWS API permissions

Permission	Purpose
elasticloadbalancing:DescribeLoadBalancers	List and page through load balancers.
elasticloadbalancing:DescribeTags	Fetch tags for load balancers (batched at 20 ARNs per call).
elasticloadbalancing:DescribeTargetGroups	List and page through target groups.
elasticloadbalancing:DescribeTargetHealth	Read the health of targets registered in each target group.
ec2:DescribeRegions	Discover the set of regions to query when no explicit region/regions option is supplied.
sts:AssumeRole	Only when assumeRoleARN is set.

How to obtain Amazon ELBv2 credentials

Create an IAM user for AWS access

For the Amazon ELBv2 connector to interact with the AWS SDK and retrieve data, you must provide specific AWS credentials and permissions. To create an IAM user, follow these steps:

1. Log in to your organization's AWS Management Console as an administrator.

2. Navigate to the Identity and Access Management (IAM) dashboard.

3. From the navigation pane under Access management, click Users, and then click Create user.

4. Provide a User name, leave the Provide user access to AWS Management Console option unchecked, and then click Next.

5. Click the Attach policies directly option and then click Create policy.

6. Click the JSON tab and paste the following minimum required policy:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "elasticloadbalancing:DescribeLoadBalancers",
           "elasticloadbalancing:DescribeTargetGroups",
           "elasticloadbalancing:DescribeTargetHealth",
           "elasticloadbalancing:DescribeTags"
         ],
         "Resource": "*"
       }
     ]
   }

7. Click Next, provide a name for the policy, and then click Create policy.

8. Back on the Add permissions page, search for and select the policy you just created, and then click Next.

9. Click Create user.

Obtain access keys

After you have created an IAM user, generate the access keys that are required for the connector. To do so, follow these steps:

1. Navigate to the IAM dashboard.

2. From the navigation pane under Access management, click Users.

3. Choose the IAM user you created in the earlier steps.

4. Click the Security credentials tab and then click Create access key.

5. Select the Application running outside AWS use case and then click Next.

6. Provide a description and then click Create access key.

   The access key ID and secret access key display. The secret access key is shown only once and cannot be retrieved again, so copy the key and save it to a secure location.

Note: If you do not have the permissions to create access keys, contact your AWS administrator. For additional information, see AWS documentation.

The connector authenticates using the AWS SDK's credential resolution chain. If an assume-role ARN is configured, the connector assumes that IAM role using the provided credentials. Otherwise, it uses the provided access keys directly, falling back to the AWS Default Credential Provider Chain (environment variables, ~/.aws/credentials, or EC2 instance metadata).

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Load Balancer

Source Field Name	SDM Attribute
Constant "AWS"	CLOUD_PROVIDER
Derived: LoadBalancer.scheme == INTERNET_FACING	IS_INTERNET_FACING
DescribeTags → TagDescription.tags[] as key:value	TAGS (multivalued)
Iteration region	REGION
LoadBalancer.availabilityZones[].subnetId	SUBNET_IDS (multivalued)
LoadBalancer.availabilityZones[].zoneName	AVAILABILITY_ZONES (multivalued)
LoadBalancer.createdTime	FIRST_SEEN
LoadBalancer.customerOwnedIpv4Pool	CUSTOMER_OWNED_IPV4_POOL
LoadBalancer.dnsName	DNS_NAMES
LoadBalancer.ipAddressTypeAsString	IP_ADDRESS_TYPE
LoadBalancer.loadBalancerArn	UID
LoadBalancer.loadBalancerArn	LOAD_BALANCER_ARN
LoadBalancer.loadBalancerName (falls back to loadBalancerArn)	NAME
LoadBalancer.schemeAsString	SCHEME
LoadBalancer.securityGroups	SECURITY_GROUP_IDS (multivalued)
LoadBalancer.state().codeAsString	SOURCE_STATUS
LoadBalancer.typeAsString	TYPE
LoadBalancer.vpcId	VPC_ID
Sync timestamp (Instant.now())	LAST_CAPTURED

Target Group

Source Field Name	SDM Attribute
Constant "AWS"	CLOUD_PROVIDER
Iteration region	REGION
Sync timestamp (Instant.now())	LAST_CAPTURED
TargetGroup.healthCheckEnabled	HEALTH_CHECK_ENABLED
TargetGroup.healthCheckPath	HEALTH_CHECK_PATH
TargetGroup.healthCheckPort	HEALTH_CHECK_PORT
TargetGroup.healthCheckProtocolAsString	HEALTH_CHECK_PROTOCOL
TargetGroup.ipAddressTypeAsString	IP_ADDRESS_TYPE
TargetGroup.loadBalancerArns	LOAD_BALANCER_ARNS (multivalued)
TargetGroup.port	PORT
TargetGroup.protocolAsString	PROTOCOL
TargetGroup.protocolVersion	PROTOCOL_VERSION
TargetGroup.targetGroupArn	UID
TargetGroup.targetGroupArn	TARGET_GROUP_ARN
TargetGroup.targetGroupName (falls back to targetGroupArn)	NAME
TargetGroup.targetTypeAsString	TARGET_TYPE
TargetGroup.vpcId	VPC_ID

Target Health

Source Field Name	SDM Attribute
Constant "AWS"	CLOUD_PROVIDER
Iteration region	REGION
Parent TargetGroup.targetGroupArn	TARGET_GROUP_ARN
Same composite value as UID	NAME
Sync timestamp (Instant.now())	LAST_CAPTURED
TargetDescription.availabilityZone	TARGET_AVAILABILITY_ZONE
TargetDescription.id	TARGET_ID
TargetDescription.port	PORT
targetGroupArn + : + TargetDescription.id (+ : + TargetDescription.port when present)	UID
TargetHealthDescription.healthCheckPort	HEALTH_CHECK_PORT
TargetHealthDescription.targetHealth().description	HEALTH_DESCRIPTION
TargetHealthDescription.targetHealth().reasonAsString	HEALTH_REASON
TargetHealthDescription.targetHealth().stateAsString	SOURCE_STATUS

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Load Balancer

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query (one client per region).	Discovered via ec2:DescribeRegions
pageSize	Page size for each DescribeLoadBalancers call.	Shared pageSize configuration (100)
parallelismLevel	Number of parallel worker threads.	min(4, CPU cores)	No

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: AWS SDK for Java v2 (ElasticLoadBalancingV2Client) · Endpoint: elasticloadbalancing:DescribeLoadBalancers

Target Group

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query (one client per region).	Discovered via ec2:DescribeRegions
pageSize	Page size for each DescribeTargetGroups call.	Shared pageSize configuration (100)

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: AWS SDK for Java v2 (ElasticLoadBalancingV2Client) · Endpoint: elasticloadbalancing:DescribeTargetGroups

Target Health

Operation options

Option	Type	Default	Description
region / regions	Comma-separated list of regions to query (one client per region).	Discovered via ec2:DescribeRegions
pageSize	Page size for each DescribeTargetGroups call.	Shared pageSize configuration (100)

Delta sync

The connector README does not document sync behavior for this object.

API

• Type: AWS SDK for Java v2 (ElasticLoadBalancingV2Client) · Endpoint: elasticloadbalancing:DescribeTargetGroups

Changelog

Changelog

The Amazon ELBv2 connector has undergone the following changes:

Version	Description	Migration Steps
3.2.1	No changes in this release.	N/A
3.2.0	No changes in this release.	N/A
3.1.0	New Features - New connector — syncs Application, Network, and Gateway load balancers, their target groups, and per-target health, with an explicit flag identifying internet-facing load balancers. Improvements - Sync failures are now visible. Previously, certain AWS API errors (throttling, server errors, transient network failures, validation errors) could be silently swallowed during multi-region sync, producing empty results without indicating a problem. These now surface as sync failures with a clear log entry detailing the HTTP status, AWS error code, request id, and service name. Per-region permission gaps (HTTP 401 / 403) still allow the sync to continue across other regions, but are now visible in logs.	N/A