Amazon CloudFormation: How to get an ELB's private IP for a specific subnet?

TL;DR - Is it possible for a CloudFormation template to insert the subnet-specific internal IP address of a specific ELB into the UserData of an instance within that subnet?

We have a fleet of EC2 web servers in an Amazon VPC with six subnets, one private and one public across each of the three AZ's within EU-West-1. All servers are configured with CloudFormation.

We would like to configure Apache's mod_rpaf to log the X-Forwarded-For header (we can change the LogFormat, but this doesn't translate easily to PHP or Apache error logs; RPAF is the neatest solution for us).

As far as I know, the way an ELB is architected means that it has a 'foot' in each of its configured AZs, and this can change if the ELB is torn down or re-created.

It seems that the version of mod_rpaf in Ubuntu 12.04's repositories hasn't been updated to allow CIDR notation for the ProxyIPS directive, and in theory the ELB's IP address can be anything within our three public subnets.

The one remaining solution is to configure the module via Puppet, using hieradata generated by the instance's UserData. I know that to some degree you can interpolate references and variables within CloudFormation templates, but I'm unsure if it's possible to effectively say "Give me the private IP address for this ELB in this subnet".

Unfortunately not. I've gone back and forth with our AWS solutions engineer on this and currently there's no way to query the internal IPs for an ELB. I'm currently scraping log files to find them.

We had same problem, below command I use for getting internal IP of ELB "LAMP-Prod"

aws ec2 describe-network-interfaces --filters "Name=description,Values=ELB LAMP-Prod" |grep -wE 'Description|PrivateIpAddress'

Or using JQ and without the need to specify an ELB name

 aws ec2 describe-network-interfaces --filters Name=requester-id,Values='amazon-elb' | jq -r '.NetworkInterfaces[].PrivateIpAddresses[].PrivateIpAddress'