2.2.1.2. Load Balancing Concepts: ALB, NLB

2.2.1.2. Load Balancing Concepts: ALB, NLB

💡 First Principle: Load balancing distributes incoming application traffic across multiple targets, enhancing availability, fault tolerance, and scalability.

Load balancing is crucial for distributing network traffic evenly across a group of backend resources (e.g., EC2 instances, containers, Lambda functions). This prevents any single resource from becoming a bottleneck, improving performance, availability, and resilience. Elastic Load Balancing (ELB) is the AWS service that provides this functionality.

• Application Load Balancer (ALB): Operates at Layer 7 of the OSI model, the application layer (HTTP/HTTPS). Ideal for web applications, supporting advanced routing (e.g., path-based, host-based, sticky sessions) and content-based routing. Use for intelligent routing based on application-layer content.
• Network Load Balancer (NLB): Operates at Layer 4 of the OSI model, the transport layer (TCP/UDP). Designed for extreme performance, static IP addresses, and ultra-low latency. Best for non-HTTP/HTTPS traffic or when preserving client IP is critical.
  • TLS handling: A TCP listener on an NLB passes encrypted traffic straight through, so TLS terminates on the backend instances (end-to-end encryption). A TLS listener on an NLB, or an HTTPS listener on an ALB, terminates TLS at the load balancer.
  • Target types: Target groups can register instance, ip, or (ALB only) lambda targets. An ALB invokes a Lambda function directly when its target group type is lambda, with no API Gateway in between.
• Gateway Load Balancer (GWLB): Operates at Layer 3 and is purpose-built to deploy, scale and keep highly available a fleet of third-party virtual appliances (firewalls, IDS/IPS) that inspect traffic entering and leaving a VPC. It uses GENEVE encapsulation and forwards traffic transparently through the appliances.

Key Load Balancing Concepts:

• Traffic Distribution: Spreads load across targets.
• Health Checks: Routes traffic only to healthy targets.
• "ALB": Layer 7, HTTP/S, smart routing.
• "NLB": Layer 4, TCP/UDP, high performance, static IPs.

ALB health checks in detail:

• The protocol is HTTP or HTTPS, sent to a configurable path (default /) and port (default: the traffic port); a target is healthy when it returns the expected success codes.
• A target becomes unhealthy only after a configurable number of consecutive failures (unhealthy threshold), and healthy again after consecutive successes.
• The load balancer only stops routing to an unhealthy target — it never terminates it. An Auto Scaling group that uses ELB health checks replaces it.
• Health checks cannot be turned off for instance or IP targets (only Lambda targets make them optional).
• A check of / proves only that the web server answers. Point the path at an endpoint that exercises the application (a "deep" health check) if broken application logic should take a target out of service.

Scenario: An Application Load Balancer (ALB) efficiently routes incoming HTTP/HTTPS requests for a web application across a dynamic fleet of Amazon EC2 instances, ensuring consistent performance and high availability.

Visual: ALB vs. NLB

⚠️ Common Pitfall: Using an NLB when you need advanced Layer 7 routing features like path-based or host-based routing — the NLB operates at Layer 4 and lacks these application-level capabilities. Note: NLB does support TLS termination (SSL offloading) via a TLS listener, so "no SSL offloading" is not a valid reason to pick ALB over NLB.

Cost note: ALB and NLB both bill a fixed hourly charge plus capacity units (ALB: LCUs; NLB: NLCUs), metered on whichever dimension is highest — new connections, active connections, bytes processed and, for ALB, rule evaluations. At very low traffic capacity-unit usage is close to zero and the hourly charge dominates, so neither type is automatically cheaper. For plain TCP/UDP an NLB is the fit (an ALB handles only HTTP/HTTPS/gRPC), and each NLCU covers far more connections than an LCU. A Gateway Load Balancer is only for inserting third-party virtual appliances (firewalls, IDS/IPS) inline — not for application traffic.

Key Trade-Offs:

• Features (ALB) vs. Raw Performance (NLB): ALB provides intelligent, application-level routing and features. NLB prioritizes extreme performance and static IPs for network-level traffic.

Reflection Question: How does strategically choosing between an ALB (Layer 7) and an NLB (Layer 4) impact an application's resilience and performance under varying traffic patterns and protocol requirements?