AWS ELB – How to Get Detailed Logs of Non-Application 500 Errors

ELB will only send traffic to EC2 instances.

You could have a couple nginx EC2 instances behind an ELB proxying traffic to your real servers, or you could just go the simple route and drop your DNS TTL to something like 10 minutes so changes reflect more quickly.

You need to create a security group on your app servers that only allows inbound traffic from the ELB security group.

As the docs say:

This feature involves two security groups—the source security group and a security group that defines the ingress rules for your back-end instance. To lock down traffic between your load balancer and your back-end instances, add or modify a rule to your back-end security group that limits ingress traffic so that it can come only from the Amazon EC2 source security group provided by the Elastic load Balancing.