No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

This is how I'm creating my LB:
```
let httpBackendSg = new awsx.ec2.SecurityGroup("http-backend-lb-sg", {
    vpc: cluster.vpc,
    ingress: [{
        protocol: "tcp",
        fromPort: 8880,
        toPort: 8880,
        cidrBlocks: ["0.0.0.0/0"]
    }],
    egress: [{
        protocol: "-1",
        fromPort: 0,
        toPort: 0,
        cidrBlocks: ["0.0.0.0/0"]
    }]
});

const httpBackendLb = new awsx.elasticloadbalancingv2.ApplicationLoadBalancer("http-backend-lb4", {
    vpc: vpc,
    external: true,
    securityGroups: [httpBackendSg],
});

const httpBackendTg = httpBackendLb.createTargetGroup("http-backend-tg3", {
    port: 8880,
    healthCheck: {
        protocol: "HTTP",
        path: "/_healthcheck",
        healthyThreshold: 2,
        unhealthyThreshold: 4,
        matcher: "200"
    }
});

const httpBackendListener = httpBackendTg.createListener("http-backend-listener2", {
    port: 8880
});
```

Port 8880 seems ok for a target group: <https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html#target-group-routing-configuration>

Same for a listener: <https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html#listener-configuration>

is it the security group? should be `httpBackendSg.id`

also what is awsx? is that the non Terraform based aws provider?

No. It's a different API: <https://github.com/pulumi/pulumi-awsx>

```
        switch (port) {
            case 80: case 8000: case 8008: case 8080: return &lt;ApplicationProtocol&gt;"HTTP";
            case 443: case 8443: return &lt;ApplicationProtocol&gt;"HTTPS";
            default: throw new Error("Invalid port: " + JSON.stringify(port));
        }
```

You're right that the error message should be clearer.

in the meantime, you can solve this by manually providing a protocol.

Is there a reason it shouldn't always be HTTP if the port isn't 443 or 8443?

doesn't seem like there's a reason we would believe an arbitrary port would be HTTP

it seems just as likely to be HTTPS afaict.

<https://github.com/pulumi/pulumi-awsx/pull/154>