AWS Elastic Load Balancer (ELB)¶

1. Why Load Balancers Exist¶

2. ELB Types ⭐¶

3. Application Load Balancer (ALB)¶

Architecture¶

Client
  ↓ HTTPS:443
ALB (DNS: my-alb-123.us-east-1.elb.amazonaws.com)
  ↓ evaluates Listener Rules
  ├── /api/* → Target Group A (API servers)
  ├── /static/* → Target Group B (CDN origins)
  └── default → Target Group C (main app)

Listener Actions (Not Just "Forward")¶

HTTP → HTTPS redirect (every ALB should have this):

Listener: port 80 (HTTP)
  Action: Redirect to port 443 (HTTPS), status 301
Listener: port 443 (HTTPS)
  Action: Forward to Target Group

Routing Rules ⭐¶

ALB listener rules evaluate conditions in priority order (1 = highest):

SSL/TLS Termination ⭐¶

ALB terminates SSL at the load balancer — backend targets receive plain HTTP:

Client → HTTPS (TLS 1.3) → ALB (decrypts) → HTTP → EC2
                                         ↑
                              ACM certificate loaded here

Benefits: - Offloads crypto from application instances - Centralized certificate management via ACM - Backends serve HTTP (simpler config, less CPU)

End-to-end encryption (if compliance requires):

Client → HTTPS → ALB → HTTPS → EC2
(ALB re-encrypts to backend — certificate needed on EC2 too)

SNI — Multiple Certificates on One ALB ⭐¶

Server Name Indication (SNI) allows a single HTTPS listener to serve multiple domains, each with its own certificate:

ALB Listener (HTTPS:443)
  ├── Certificate: api.example.com (ACM cert 1)
  ├── Certificate: app.example.com (ACM cert 2)  ← up to 25 certs
  └── Default certificate: example.com

Client requests api.example.com:
  → TLS Client Hello contains SNI hostname
  → ALB selects matching certificate
  → Serves correct cert ✅

Clients that don't support SNI (legacy clients) receive the default certificate. Up to 25 additional certificates per ALB listener.

Built-in Authentication ⭐¶

ALB can authenticate users before forwarding to targets — no auth code in app:

Client request → ALB
  → Check: is user authenticated? (session cookie)
  → No? Redirect to Cognito / Okta / Google login page
  → User logs in → IdP issues token
  → ALB validates token → forwards request + user claims in headers
  → EC2 reads X-Amzn-Oidc-Data header to get user info

Requires HTTPS listener. Works with Cognito and any OIDC-compliant provider.

Source IP — X-Forwarded-For¶

Because ALB terminates the connection, the EC2 backend sees the ALB's IP as source, not the client IP. ALB adds headers:

X-Forwarded-For: 203.0.113.45      ← real client IP
X-Forwarded-Proto: https           ← original protocol
X-Forwarded-Port: 443              ← original port
X-Amzn-Trace-Id: Root=1-xxxxx      ← request tracing ID

Parse X-Forwarded-For in your application for the real client IP.

ALB Key Properties¶

4. Network Load Balancer (NLB)¶

Key Distinction from ALB¶

NLB operates at Layer 4 — it sees TCP/UDP packets but not HTTP headers. It cannot inspect paths, headers, or cookies. What it gains: extreme speed.

Client TCP connection:
  SYN → NLB → SYN → EC2
           (NLB is transparent — EC2 sees the actual connection)

Static IP ⭐¶

NLB provides one static IP per AZ (or you can assign an Elastic IP):

NLB in 3 AZs:
  AZ-1a: 54.1.2.3 (static or EIP)
  AZ-1b: 54.4.5.6 (static or EIP)
  AZ-1c: 54.7.8.9 (static or EIP)

This is why NLB is used when clients need to whitelist IP addresses. ALB provides only a DNS name — IPs can change.

Source IP Preservation¶

Unlike ALB, NLB passes the real client IP directly to the backend (no X-Forwarded-For needed):

Client (203.0.113.45) → NLB → EC2 sees source IP: 203.0.113.45 ✅

Exception: if targets are registered by Instance ID (not IP), the source IP is preserved. If proxy protocol is needed for IP targets, enable it.

NLB Security Groups ⭐ (August 2023 Update)¶

NLB now supports Security Groups — previously it relied on NACL and backend SG only:

Before August 2023:
  NLB → no SG → all traffic passed through → EC2 SG filtered

After August 2023:
  NLB → NLB SG (filters what NLB accepts) → EC2 SG (filters what EC2 accepts)

Important: SG on NLB can only be attached at creation time — cannot add later. AWS now recommends attaching an SG to all new NLBs.

SG referencing pattern (NLB):

NLB SG:  Allow TCP 443 from 0.0.0.0/0
EC2 SG:  Allow TCP 443 from NLB-SG  ← reference NLB SG, not IP
         (ensures EC2 only accepts traffic from NLB, not direct internet)

Cross-Zone Load Balancing¶

Cross-zone OFF (NLB default):
  AZ-1a: 3 targets → each gets 33% of that AZ's traffic (50% total ÷ 3)
  AZ-1b: 1 target  → gets 50% of all traffic

Cross-zone ON:
  All 4 targets share traffic equally (25% each) regardless of AZ

Enable cross-zone for NLB when AZs have different numbers of targets. Note: Cross-zone NLB traffic is charged at $0.01/GB.

NLB Key Properties¶

5. Gateway Load Balancer (GWLB)¶

Deploys, scales, and manages third-party virtual network appliances (firewalls, IDS/IPS, deep packet inspection) in the traffic path — transparently.

Traffic flow with GWLB:
  Internet
    ↓
  GWLB (GENEVE encapsulation — port 6081)
    ↓
  Security Appliances (Palo Alto, Fortinet, CheckPoint) → inspect
    ↓
  GWLB (returns traffic)
    ↓
  Application VPC

6. Internet-Facing vs Internal¶

3-tier architecture:
  Internet → Internet-Facing ALB (public) → App servers
  App servers → Internal ALB (private) → Database services

7. Listener Rules — Complete Flow ⭐¶

Listener: HTTPS:443
  Rule 1 (priority 1): IF path = /api/*        → Forward to API-TG
  Rule 2 (priority 2): IF host = admin.app.com → Authenticate → Forward to Admin-TG
  Rule 3 (priority 3): IF path = /health       → Fixed Response: 200 "OK"
  Rule 4 (priority 4): IF method = OPTIONS      → Fixed Response: 200 (CORS preflight)
  Default rule:                                 → Forward to Web-TG

Rules evaluated in priority order — first match wins. Default rule has no condition — always matches as fallback.

8. Security Groups Architecture¶

ALB + EC2 SG Chaining ⭐¶

ALB SG:
  Inbound:  Allow TCP 80, 443 from 0.0.0.0/0
  Outbound: Allow TCP 80 to EC2-SG (reference by SG ID)

EC2 SG:
  Inbound:  Allow TCP 80 from ALB-SG (reference by SG ID)
            ← This blocks all direct internet access to EC2 ✅
  Outbound: Allow all

NLB + EC2 SG Chaining (post August 2023)¶

NLB SG:
  Inbound:  Allow TCP 443 from 0.0.0.0/0
  Outbound: Allow TCP 443 to EC2-SG

EC2 SG:
  Inbound:  Allow TCP 443 from NLB-SG
            ← Prevents bypass of NLB; ensures all traffic via NLB ✅

9. Multi-AZ Nodes ⭐¶

When you attach subnets from multiple AZs, ELB creates a load balancer node in each AZ. DNS resolution round-robins across these nodes:

ALB DNS: my-alb.elb.amazonaws.com
  → resolves to: 10.0.1.5 (AZ-1a LB node)
                 10.0.2.5 (AZ-1b LB node)
                 10.0.3.5 (AZ-1c LB node)

If AZ-1a fails → DNS stops returning that IP → AZ-1b and 1c serve all traffic

Minimum 2 AZs for ALB (best practice: 3). Each AZ must have at least one public subnet for internet-facing LB.

10. Cross-Region Load Balancing¶

ALB and NLB are regional services — cannot target instances in another Region directly.

11. WAF + Shield Integration (ALB) ⭐¶

Internet → AWS Shield (DDoS protection, automatic) → ALB → WAF Web ACL → EC2

WAF rules can:
  - Block by IP, geo, rate limiting
  - SQL injection / XSS protection
  - Custom regex rules
  - Bot control

WAF attaches to ALB (and CloudFront, API Gateway). NLB does NOT support WAF — use ALB for applications needing WAF.

12. Complete ALB vs NLB Reference ⭐¶

13. Common Mistakes¶

14. Interview Questions Checklist¶

• What problems does a load balancer solve?
• ALB vs NLB — layer, protocols, and key feature differences
• What is a Listener? What types of actions can it take?
• List all ALB routing condition types (path, host, header, method, query, IP)
• What is SSL termination? End-to-end encryption vs termination at LB?
• What is SNI? How many certificates per ALB listener?
• How does ALB pass the real client IP to EC2?
• What is NLB's static IP capability? Why is it needed?
• Does NLB support Security Groups? Since when? Key restriction?
• Cross-zone load balancing — default for ALB vs NLB?
• What is built-in authentication on ALB? Providers?
• ALB + EC2 SG chaining — how to prevent direct access to EC2?
• What does GWLB do and what protocol does it use?
• Internet-facing vs internal LB — difference?
• Cross-region load balancing — why doesn't ALB support it natively? What to use?
• What is WAF? Which ELB types support it?
• What happens to multi-AZ LB nodes when one AZ fails?
• What is Global Accelerator? When to use it over Route 53?

Nectar¶

• At least two Availability Zones and a subnet for each zone.
• The selected subnet does not have a route to an internet gateway. This means that your load balancer will not receive internet traffic.
• You can proceed with this selection; however, for internet traffic to reach your load balancer, you must update the subnet’s route table in the VPC console