AWS Elastic Load Balancer (ELB) is a managed service that distributes incoming application traffic across multiple targets, such as Amazon EC2 instances, containers, and IP addresses. It automatically scales to handle demands of your applications, providing high availability and security.
Understanding how ELB integrates with Virtual Private Cloud (VPC), health checks, and target groups is essential for building reliable and performant architectures in the cloud. This guide details core components, configuration options, and operational best practices.
| Component | Description | Default Behavior | Impact on Availability |
|---|---|---|---|
| Load Balancer Type | Classic, Application, Network, or Gateway Load Balancer | Selected at creation | Determines protocol support and use case fit |
| Listeners | Process incoming connections based on protocol and port | Check client requests on configured ports | Direct traffic to rules and target groups |
| Target Groups | Collection of targets registered with the balancer | None; must be configured explicitly | Health checks and routing depend on this |
| Health Checks | Evaluates target health to route traffic | Basic HTTP check on port 80 | Unhealthy targets are removed from rotation |
| Security Groups | Stateful virtual firewalls for ENIs | Restrictive by default | Controls allowed traffic to targets |
Application Load Balancer Advanced Routing
Rule-Based Traffic Distribution
Application Load Balancer (ALB) supports path-based, host-based, and header-based routing to forward requests to specific target groups. These rules are evaluated in order, enabling advanced microservice architectures within a single load balancer.
Priority and Default Actions
Rules have an explicit priority, and a default action handles traffic that does not match any rule. Proper ordering and testing of rule conditions are critical to avoid unintended routing behavior and dropped requests.
Network Load Balancer High Performance
TCP/TLS Termination at Scale
Network Load Balancer (NLB) operates at the connection level, handling millions of requests per second while maintaining ultra-low latencies. It is ideal for balancing TCP and TLS traffic where speed is critical.
Static IP and Elastic Address Integration
NLB supports Elastic IP addresses and auto-assigns public IPs per Availability Zone, providing predictable failover and simplified firewall rules for downstream systems.
Security and Encryption Controls
TLS Termination and Certificates
You can offload TLS decryption to the load balancer using ACM certificates, reducing the compute burden on backend instances. This also centralizes certificate management and simplifies renewal workflows.
Target Security and Access Policies
Security groups attached to backend targets control which traffic is accepted. Using least-privilege rules and VPC flow logs in combination with ELB enhances observability and reduces attack surface.
Monitoring and Observability
CloudWatch Metrics and Logs
ELB publishes detailed metrics such as RequestCount, TargetResponseTime, and HTTPCode_Target_5XX_Count. Enabling access logs captures detailed information about requests forwarded to targets.
AWS Distro OpenTelemetry Integration
Instrumenting services with OpenTelemetry collectors alongside ELB provides end-to-end tracing, allowing you to correlate load balancer behavior with application latency during incidents.
Operational Best Practices
- Enable access logs and CloudWatch alarms for error rate and latency.
- Configure sticky sessions only when stateful user experiences require it.
- Use least-privilege security group rules for backend targets.
- Set appropriate health check intervals and thresholds to detect failures quickly.
- Leverage autoscaling for backend fleets to align capacity with traffic patterns.
FAQ
Reader questions
How do I choose between Application Load Balancer and Network Load Balancer?
Use Application Load Balancer for HTTP/HTTPS traffic requiring advanced routing, WebSockets, and container-based workloads. Choose Network Load Balancer when you need static IPs, ultra-low latencies, and handling of non-HTTP protocols at massive scale.
Can I use a single target group across multiple load balancers?
A single target group cannot be attached to more than one load balancer. Instead, share targets by creating separate target groups per load balancer and registering the same backend instances while ensuring security group and port consistency.
What happens during an Availability Zone outage?
If an AZ becomes unavailable, ELB automatically routes traffic only to healthy targets in the remaining AZs. Cross-zone load balancing must be enabled explicitly to optimize distribution when targets exist in multiple zones.
How are idle connections handled and billed?
Idle connections to an NLB remain open until the client or target closes them, with no hourly charge for idle NLBs. ALB charges for active connections and processed bytes, so enabling idle timeout tuning can reduce costs and resource usage.