# AWS security group support using kong ingress controller annotation in NLB **URL:** \ **Category:** Questions\ **Created:** [November 25, 2025, 5:53am UTC](https://discuss.konghq.com/t/aws-security-group-support-using-kong-ingress-controller-annotation-in-nlb/13826 "2025-11-25T05:53:38Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![itsmepakky](https://avatars.discourse-cdn.com/v4/letter/i/71c47a/32.png) [@itsmepakky](https://discuss.konghq.com/u/itsmepakky)\ **Post date:** [November 25, 2025, 5:53am UTC](https://discuss.konghq.com/t/aws-security-group-support-using-kong-ingress-controller-annotation-in-nlb/13826/1 "2025-11-25T05:53:38Z")
Hello Community, We are currently running **Kong Ingress Controller (KIC) version 2.8.1** and **Kong Proxy version 3.1** within an AWS EKS cluster, where the Kong proxy Service is exposed via an **AWS Network Load Balancer (NLB)**. We recently installed the latest version of KIC, but encountered an issue when attempting to attach an existing AWS Security Group (SG) to the provisioned NLB using the standard Kubernetes Service annotation: YAML ```auto "service.beta.kubernetes.io/aws-load-balancer-security-groups": "sg-02d6474e862ee694a" ``` **Problem:** After deploying the new Ingress Controller, the NLB was created, but **no Security Group was attached** to it. * * * ### ❓ Key Questions 1. **Annotation Support:** Does the latest version of the Kong Ingress Controller officially support the `service.beta.kubernetes.io/aws-load-balancer-security-groups` annotation for attaching an SG directly to the **NLB** Service in AWS? 2. **IP Restriction Alternative:** If direct SG attachment via annotation is _not_ supported, what is the recommended method to **restrict traffic on ports 80 and 443** to only a specific list of public source IP addresses (CIDRs) for a public-facing NLB in this EKS setup? Thank you for your guidance. **Regards,** **Pankaj**