Skip to content
intermediate Phase 2 · AWS Networking

Elastic Load Balancing

Distribute traffic with ALB, NLB, and GLB for high availability.

1h 15m
0 problems
Topic Progress 0%

ELB Overview

Elastic Load Balancing Overview

ELB automatically distributes incoming application traffic across multiple targets.

Load Balancer Types

Type Use Case Protocol Performance
ALB HTTP/HTTPS, microservices Layer 7 General purpose
NLB TCP, UDP, TLS, extreme performance Layer 4 Millions of requests/sec
GLB IoT, industrial IoT Layer 3 UDP/GRE traffic
CLB Legacy (deprecated) L4/L7 Not recommended

Key Concepts

  • Listener: Checks for connection requests on specified port
  • Target Group: Route requests to registered targets
  • Target: Individual EC2 instance, IP, or Lambda function
  • Health Check: Monitors health of registered targets
# Create an Application Load Balancer
aws elbv2 create-load-balancer \
  --name my-alb \
  --type application \
  --subnets subnet-xxx subnet-yyy \
  --security-groups sg-alb \
  --scheme internet-facing \
  --ip-address-type ipv4

# Create a target group
aws elbv2 create-target-group \
  --name my-targets \
  --protocol HTTP \
  --port 80 \
  --vpc-id vpc-xxx \
  --health-check-path /health \
  --health-check-interval-seconds 30 \
  --health-check-timeout-seconds 5 \
  --healthy-threshold-count 3 \
  --unhealthy-threshold-count 3

# Register targets
aws elbv2 register-targets \
  --target-group-arn arn:aws:elasticloadbalancing:us-east-1:xxx:targetgroup/my-targets/xxx \
  --targets Id=i-xxx Id=i-yyy Id=i-zzz

# Create a listener
aws elbv2 create-listener \
  --load-balancer-arn arn:aws:elasticloadbalancing:us-east-1:xxx:loadbalancer/app/my-alb/xxx \
  --protocol HTTP \
  --port 80 \
  --default-actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:us-east-1:xxx:targetgroup/my-targets/xxx

Application Load Balancer (ALB)

Application Load Balancer (ALB)

Path-Based Routing

Route traffic based on URL path:

# Create target groups for different services
aws elbv2 create-target-group --name api-targets --protocol HTTP --port 8080 --vpc-id vpc-xxx
aws elbv2 create-target-group --name web-targets --protocol HTTP --port 80 --vpc-id vpc-xxx

# Create listener rules
aws elbv2 create-rule \
  --listener-arn arn:aws:elasticloadbalancing:us-east-1:xxx:listener/app/my-alb/xxx/yyy \
  --priority 10 \
  --conditions Field=path-pattern,Values="/api/*" \
  --actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:us-east-1:xxx:targetgroup/api-targets/xxx

aws elbv2 create-rule \
  --listener-arn arn:aws:elasticloadbalancing:us-east-1:xxx:listener/app/my-alb/xxx/yyy \
  --priority 20 \
  --conditions Field=path-pattern,Values="/*" \
  --actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:us-east-1:xxx:targetgroup/web-targets/xxx

Host-Based Routing

Route traffic based on hostname:

aws elbv2 create-rule \
  --listener-arn arn:xxx \
  --priority 5 \
  --conditions Field=host-header,Values="api.example.com" \
  --actions Type=forward,TargetGroupArn=arn:xxx

aws elbv2 create-rule \
  --listener-arn arn:xxx \
  --priority 6 \
  --conditions Field=host-header,Values="www.example.com" \
  --actions Type=forward,TargetGroupArn=arn:yyy

HTTPS Configuration

# Import certificate (using ACM)
aws acm request-certificate \
  --domain-name example.com \
  --subject-alternative-names "*.example.com"

# Create HTTPS listener
aws elbv2 create-listener \
  --load-balancer-arn arn:xxx \
  --protocol HTTPS \
  --port 443 \
  --certificates CertificateArn=arn:aws:acm:us-east-1:xxx:certificate/yyy \
  --ssl-policy ELBSecurityPolicy-TLS-1-2-2017-01 \
  --default-actions Type=forward,TargetGroupArn=arn:xxx

# Redirect HTTP to HTTPS
aws elbv2 create-listener \
  --load-balancer-arn arn:xxx \
  --protocol HTTP \
  --port 80 \
  --default-actions '[{
    "Type": "redirect",
    "RedirectConfig": {
      "Protocol": "HTTPS",
      "Port": "443",
      "StatusCode": "HTTP_301"
    }
  }]'

Network Load Balancer (NLB)

Network Load Balancer (NLB)

NLB operates at Layer 4 and handles millions of requests per second with ultra-low latency.

Create NLB

aws elbv2 create-load-balancer \
  --name my-nlb \
  --type network \
  --subnets subnet-xxx subnet-yyy \
  --scheme internet-facing

# Create target group
aws elbv2 create-target-group \
  --name nlb-targets \
  --protocol TCP \
  --port 80 \
  --vpc-id vpc-xxx \
  --target-type instance

# Create TCP listener
aws elbv2 create-listener \
  --load-balancer-arn arn:xxx \
  --protocol TCP \
  --port 80 \
  --default-actions Type=forward,TargetGroupArn=arn:xxx

# Cross-zone load balancing
aws elbv2 modify-load-balancer-attributes \
  --load-balancer-arn arn:xxx \
  --attributes Key=load_balancer.cross_zone.enabled,Value=true

NLB Features

  • Static IP: Each AZ gets a static IP (useful for whitelisting)
  • Elastic IP: Assign your own public IPs
  • Preserve source IP: Pass client IP to target
  • Idle timeout: Up to 4000 seconds

NLB with ALB (Tiered Architecture)

Internet → NLB (Layer 4) → ALB (Layer 7) → EC2/ECS

Health Checks and Sticky Sessions

Health Checks and Sticky Sessions

Health Check Configuration

# Update health check settings
aws elbv2 modify-target-group \
  --target-group-arn arn:xxx \
  --health-check-protocol HTTP \
  --health-check-path /health \
  --health-check-interval-seconds 15 \
  --health-check-timeout-seconds 5 \
  --healthy-threshold-count 3 \
  --unhealthy-threshold-count 3 \
  --matcher HttpCode=200

# Custom health check headers
aws elbv2 modify-target-group \
  --target-group-arn arn:xxx \
  --health-check-protocol HTTPS \
  --health-check-port 443

Health Check States

State Description
initial Target is being registered
healthy Target meets health check criteria
unhealthy Target fails health check
unused Target not in routing rotation
draining Target deregistering, draining connections

Sticky Sessions

# Enable sticky sessions with duration
aws elbv2 modify-load-balancer-attributes \
  --load-balancer-arn arn:xxx \
  --attributes Key=stickiness.enabled,Value=true \
  Key=stickiness.type,Value=app_cookie \
  Key=stickiness.app_cookie.cookie_name,Value=SESSION_ID \
  Key=stickiness.app_cookie.duration_seconds,Value=86400

# Use ALB cookie (default)
aws elbv2 modify-load-balancer-attributes \
  --load-balancer-arn arn:xxx \
  --attributes Key=stickiness.enabled,Value=true \
  Key=stickiness.type,Value=lb_cookie \
  Key=stickiness.lb_cookie.duration_seconds,Value=86400

ELB Best Practices and Security

ELB Best Practices and Security

Security Configuration

# Restrict ALB to specific IPs
aws elbv2 modify-rule \
  --rule-arn arn:xxx \
  --conditions Field=source-ip,Values=203.0.113.0/24

# Enable WAF on ALB
aws wafv2 associate-web-acl \
  --web-acl-arn arn:aws:wafv2:us-east-1:xxx:regional/webacl/my-wacl/xxx \
  --resource-arn arn:aws:elasticloadbalancing:us-east-1:xxx:loadbalancer/app/my-alb/xxx

# Access logs
aws elbv2 modify-load-balancer-attributes \
  --load-balancer-arn arn:xxx \
  --attributes Key=access_logs.s3.enabled,Value=true \
  Key=access_logs.s3.bucket,Value=my-alb-logs

Architecture Patterns

┌─────────────────────────────────────────────────────────────┐
│                    Single ALB Architecture                   │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  Internet ──▶ ALB ──┬──▶ /api/* ──▶ API Target Group       │
│                     ├──▶ /web/* ──▶ Web Target Group        │
│                     └──▶ /admin/* ──▶ Admin Target Group    │
│                                                             │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│                   Multi-Region Architecture                  │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  Route 53 (latency-based)                                   │
│    ├──▶ us-east-1 ALB ──▶ EC2 instances                    │
│    └──▶ eu-west-1 ALB ──▶ EC2 instances                    │
│                                                             │
└─────────────────────────────────────────────────────────────┘

Monitoring

# Get ALB metrics
aws cloudwatch get-metric-statistics \
  --namespace AWS/ApplicationELB \
  --metric-name RequestCount \
  --dimensions Name=LoadBalancer,Value=app/my-alb/xxx \
  --start-time $(date -u -d '1 hour ago' +%Y-%m-%dT%H:%M:%S) \
  --end-time $(date -u +%Y-%m-%dT%H:%M:%S) \
  --period 300 \
  --statistics Sum

# Check target health
aws elbv2 describe-target-health --target-group-arn arn:xxx