Elastic Load Balancing

What it is

Elastic Load Balancing (ELB) automatically distributes incoming traffic across multiple targets, such as EC2 instances, containers, IPIP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entryClose addresses, and Lambda functions, in one or more Availability ZonesAZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entryClose. It monitors the health of registered targets and sends traffic only to healthy ones, and it scales automatically with traffic.

Choose a load balancer whenever an application runs on more than one target: for high availabilityHA (High availability)The ability of a system to keep serving users when parts of it fail, usually by running redundant copies across Availability Zones and failing over automatically. It is often stated as a percentage of uptime, such as 99.99%.Glossary entryClose across Availability Zones, for scaling with Auto Scaling groups or ECS services, and as the single public entry point for private instances.

Types of load balancers

	Application Load Balancer (ALB)	Network Load Balancer (NLB)	Gateway Load Balancer (GWLB)
OSI layer	7 (HTTPHTTP (Hypertext Transfer Protocol)The protocol that web browsers and APIs use to send requests, such as GET and POST, and receive responses. On its own it is not encrypted; HTTPS adds TLS.Glossary entryClose, HTTPSHTTPS (HTTP Secure)HTTP sent over a TLS-encrypted connection, so that requests and responses cannot be read or changed on the way, and the server proves its identity with a certificate.Glossary entryClose, gRPC)	4 (TCPTCP (Transmission Control Protocol)The transport protocol that delivers data reliably and in order: it sets up a connection first and resends lost packets. HTTP, SSH, and most database connections run over TCP.Glossary entryClose, UDPUDP (User Datagram Protocol)A transport protocol that sends packets without setting up a connection or resending lost ones, trading reliability for low latency. DNS, video calls, and games often use it; Network Load Balancer and AWS Global Accelerator support UDP.Glossary entryClose, TLSTLS (Transport Layer Security)The protocol that encrypts traffic between a client and a server and lets the server prove its identity with a certificate. It replaced SSL, though the older name is still common; HTTPS is HTTP over TLS.Glossary entryClose, QUIC)	3 (all IP packets)
Routes by	Content: host, path, HTTP headers, method, query string, source IP	Protocol and port, at millions of requests per second	Sends traffic through virtual appliances
Targets	Instances, IPs, Lambda functions, containers	Instances, IPs, ALBs	Appliance instances or IPs
Stand-out features	Redirects, fixed responses, user authentication (Cognito or OIDCOIDC (OpenID Connect)A sign-in standard built on OAuth 2.0 that lets an application learn who a user is from a trusted identity provider, through a signed ID token. IAM accepts OIDC providers, so that, for example, a GitHub Actions workflow can assume an IAM role.Glossary entryClose), WAF	Static IPs (one per Availability Zone, can be Elastic IPs), preserves client IP, ultra-low latencyLatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entryClose	GENEVE on port 6081, flow stickiness, transparent "bump in the wire"
Choose for	Web apps, microservicesMicroservicesAn application built as small, independent services, each owning one business function and its data, that communicate over APIs or events. Each service can be changed, deployed, and scaled on its own.Glossary entryClose, containers	Extreme performance, non-HTTP protocols, fixed IPs, PrivateLink services	Third-party firewalls, IDSIDS (Intrusion detection system)A system that watches network traffic or servers for signs of attack or misuse and raises alerts. It detects; an intrusion prevention system (IPS) also blocks.Glossary entryClose/IPSIPS (Intrusion prevention system)A system that inspects traffic for attacks and blocks matching traffic automatically, rather than only raising alerts. AWS Network Firewall can act as an IPS with Suricata-compatible rules.Glossary entryClose, deep packet inspection

Classic Load Balancers are the previous generation; AWS recommends migrating to a current-generation load balancer.

Concepts

• Listener: a protocol and port that the load balancer listens on, such as HTTPS 443.
• Rules (ALB): conditions and actions evaluated in priority order:
  • Conditions: host-header, path-pattern, http-header, query-string, source-ip, and more.
  • Actions: forward (to target groups, optionally weighted), redirect (such as HTTP to HTTPS), fixed-response, and authenticate-cognito or authenticate-oidc on HTTPS listeners.
• Target group: a set of targets and their health checkHealth checkA regular test, such as a request to a web page, that a load balancer, an Auto Scaling group, or Route 53 makes to see whether a resource is working. Unhealthy resources stop receiving traffic or are replaced.Glossary entryClose settings. With the IP target type, targets can be private IP addresses outside the VPC, such as servers in a peered VPC or on premisesOn-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entryClose over Direct Connect or Site-to-Site VPNVPN (Virtual private network)An encrypted tunnel over a public network, such as the internet, that joins networks or devices as if they were directly connected. AWS Site-to-Site VPN connects networks; AWS Client VPN connects individual users.Glossary entryClose, so one load balancer can spread traffic across EC2 and on-premises servers during a migration. Settings include the routing algorithm (round robin by default, or least outstanding requests), deregistration delay (connection draining), slow start, and sticky sessionsSticky sessionsA load balancer setting that sends a client's requests to the same target for a period, tracked with a cookie. It suits applications that keep session data on the server, but it can spread load unevenly.Glossary entryClose.
• Cross-zone load balancing:
  • ALB: always on at the load balancer level; it can be turned off per target group.
  • NLB and GWLB: off by default; you can turn it on.
  • With cross-zone on, every node spreads traffic across targets in all enabled Availability Zones.
• Client IP: ALBs add X-Forwarded-For, X-Forwarded-Proto, and X-Forwarded-Port headers, so backends can see the original client.
• Internet-facing or internal: internet-facing load balancers sit in public subnetsSubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entryClose; internal ones have only private IPs.

Security, resilience, performance, and cost

Security

• Terminate TLS on the load balancer with certificates from AWS Certificate Manager (or IAM), and choose a security policy for TLS versions. One HTTPS listener can hold several certificates, and the load balancer picks the right one for each domain with SNI, so one ALB can serve many HTTPS domains (route them with host-header rules).
• Mutual TLS on an ALB checks client certificates in one of two modes: verify, where the load balancer validates them against a trust store, or passthrough, where it forwards the client's certificate chain in the X-Amzn-Mtls-Clientcert header for the application to validate.
• Attach security groupsSecurity groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entryClose to ALBs, and optionally to NLBs. An NLB can use security groups only if it was created with at least one; you can't add them later to an NLB created without them. Once it has them, you can change them at any time. Let targets accept traffic only from the load balancer's security group.
• Protect ALBs with AWS WAF, and authenticate users at the ALB with Cognito or an OIDC identity provider.

Resilience

• Enable at least two Availability Zones, with healthy targets in each. Health checks take failed targets out of rotation.
• An Auto Scaling group uses only EC2 status checks by default, so an instance whose application hangs keeps running. Turn on Elastic Load Balancing health checks for the group so it also replaces instances that fail the load balancer's health checks.
• Zonal shift moves traffic away from an impaired Availability Zone.

Performance

• ALB scales automatically; LCU reservations pre-provision capacity for known traffic spikes. NLB handles millions of requests per second with very low latency.

Cost

• Pay for each hour the load balancer runs, plus Load Balancer Capacity Units (LCUs) (or NLCUs and GLCUs) for the traffic it handles.

Monitoring

• CloudWatch metrics such as request count, latency, HTTP error codes, and healthy host count.
• Access logs are delivered to S3.

Which load balancer?

If the requirement is	Choose
Route by URL path or host name to different services	Application Load Balancer
Authenticate users before they reach the app	ALB with Cognito or OIDC
Invoke Lambda functions over HTTP	ALB with Lambda targets
TCP or UDP at millions of requests per second	Network Load Balancer
Static or Elastic IP addresses for allow lists	Network Load Balancer
Expose a service through PrivateLink	Network Load Balancer
Insert third-party firewalls transparently	Gateway Load Balancer
Global static IPs and Regional failoverFailoverSwitching automatically to a standby resource when the primary one fails, such as a standby database in Amazon RDS or a backup site chosen by Route 53 failover routing.Glossary entryClose	AWS Global Accelerator in front of ALBs or NLBs
Many HTTPS domains on one load balancer	ALB HTTPS listener with several certificates (SNI)
Balance across EC2 and on-premises servers	Target group with the IP target type

Reverse mindmap: when the question points here

• Application Load Balancer
  • Path-based or host-based routing→ leads to ALB listener rules
  • Redirect HTTP to HTTPS→ leads to ALB redirect action
  • Sign users in at the load balancer→ leads to ALB with Cognito or OIDC
  • Lambda behind a load balancer→ leads to ALB Lambda target
  • Client IP at the backend→ leads to X-Forwarded-For header
  • Several HTTPS domains, one ALB→ leads to Certificate list with SNI
  • App validates client certificates itself→ leads to mTLS passthrough
• Network Load Balancer
  • Extreme performance, TCP or UDP→ leads to NLB
  • Fixed IP per Availability Zone→ leads to NLB with Elastic IPs
  • Endpoint service for PrivateLink→ leads to NLB
• Gateway Load Balancer
  • Firewalls or IDS appliances inline→ leads to GWLB with GWLB endpoints
• Behaviors
  • Keep users on the same target→ leads to Sticky sessions
  • Finish requests before removing a target→ leads to Deregistration delay
  • Uneven Availability Zones on NLB→ leads to Turn on cross-zone
  • Only accept traffic from the ALB→ leads to Target security group references the ALB's group
  • Replace instances the load balancer marks unhealthy→ leads to ELB health checks on the Auto Scaling group
  • On-premises servers as targets→ leads to IP target type

Key takeaways

• ELB spreads traffic across healthy targets in multiple Availability Zones and scales automatically.
• ALB is layer 7, with content-based rules, redirects, authentication, Lambda targets, and WAF.
• NLB is layer 4 (TCP, UDP, TLS, QUIC), with static or Elastic IPs and very high performance; it's the front end for PrivateLink services.
• GWLB is layer 3, inserting appliances using GENEVE on port 6081.
• Cross-zone load balancing is always on for ALB (adjustable per target group) and off by default for NLB and GWLB.
• Terminate TLS with ACM certificates; restrict targets to the load balancer's security group.
• Turn on ELB health checks for Auto Scaling groups, or the group won't replace instances that fail only the load balancer's checks.

Sources

• Elastic Load Balancing User Guide: What is Elastic Load Balancing?
• Elastic Load Balancing User Guide: How Elastic Load Balancing works
• Application Load Balancers: What is an Application Load Balancer?
• Application Load Balancers: Listeners
• Application Load Balancers: Condition types for listener rules
• Application Load Balancers: Action types for listener rules
• Application Load Balancers: Authenticate users
• Application Load Balancers: Use Lambda functions as targets
• Application Load Balancers: Edit target group attributes
• Application Load Balancers: HTTP headers
• Application Load Balancers: Create an HTTPS listener
• Application Load Balancers: SSL certificates for your Application Load Balancer
• Application Load Balancers: Mutual authentication with TLS in Application Load Balancer
• Application Load Balancers: Target groups for your Application Load Balancers
• Application Load Balancers: Access logs
• Network Load Balancers: What is a Network Load Balancer?
• Network Load Balancers: Target groups
• Network Load Balancers: Create a Network Load Balancer
• Network Load Balancers: Update the security groups
• Gateway Load Balancers: What is a Gateway Load Balancer?
• Classic Load Balancers: What is a Classic Load Balancer?
• Amazon EC2 Auto Scaling User Guide: About the health checks for your Auto Scaling group
• Elastic Load Balancing pricing