Elastic Load Balancing (ELB) spreads traffic across healthy targets in multiple Availability Zones. Overview is in 3. AWS Compute; network context is in 5. AWS Networking.

Load balancer types at a glance

flowchart LR
    U[Clients] --> L[Listener :443]
    L --> RU{Rules}
    RU -- host api.example.com --> TG1[Target group: API]
    RU -- path /static/* --> TG2[Target group: static]
    RU -- default --> TG3[Target group: web]
    TG1 --> T1[ECS tasks / EC2 / IP]
    TG2 --> T2[Lambda]
    TG3 --> T3[EC2 instances]

Core Concepts

Application Load Balancer

Routing conditions

Rule actions

$ aws elbv2 create-listener --load-balancer-arn $ALB_ARN \
    --protocol HTTP --port 80 \
    --default-actions 'Type=redirect,RedirectConfig={Protocol=HTTPS,Port=443,StatusCode=HTTP_301}'

Features

• TLS termination with ACM certificates; many certificates on one listener using SNI; pick a security policy (TLS 1.2+ / 1.3)
• Sticky sessions by cookie (duration-based or application-based)
• Slow start ramps a new target up gradually
• Deregistration delay (connection draining, default 300 s) lets in-flight requests finish
• WAF integration, HTTP/2, gRPC, WebSocket
• Adds headers: X-Forwarded-For (client IP), X-Forwarded-Proto, X-Forwarded-Port
• Idle timeout default 60 s; raise it for long requests and keep the backend keep-alive higher than the ALB value to avoid 502s
• Access logs to S3, connection logs, CloudWatch metrics

Health checks

Protocol: HTTP    Path: /health    Port: traffic-port
Healthy threshold: 2    Unhealthy threshold: 3    Interval: 15 s    Success codes: 200-299

Make /health cheap and honest (checks critical dependencies but is not a heavy query). A target failing checks is taken out; if all targets fail, the ALB sends traffic to all of them (fail-open).

Network Load Balancer

• Layer 4: very high throughput, millions of requests per second, ultra-low latency
• Static IP per AZ (and optional Elastic IP), good when partners allow-list addresses
• Preserves the client source IP (for instance targets)
• TLS listeners can terminate TLS; UDP supported
• Enables AWS PrivateLink (expose a service to other VPCs / accounts via a VPC endpoint service)
• Health checks: TCP, HTTP or HTTPS
• Security groups on NLBs are supported (configure them at creation)

Choose NLB for TCP / UDP, fixed IPs or PrivateLink; ALB for anything HTTP that needs smart routing.

Gateway Load Balancer

Transparent insertion of third-party virtual appliances (firewalls, IDS / IPS, deep packet inspection):

flowchart LR
    I[Traffic] --> GE[Gateway Load Balancer endpoint]
    GE --> GW[Gateway Load Balancer]
    GW --> A1[Appliance 1]
    GW --> A2[Appliance 2]
    A1 --> GW
    GW --> GE --> W[Workload]

Uses the GENEVE protocol on port 6081 and scales appliances horizontally.

Cross-Zone Load Balancing

Without cross-zone, each AZ node only sends to targets in its own AZ, so uneven target counts per AZ cause uneven load.

Security

• Security groups: ALB group allows 443 from the internet; the target group's security group allows traffic only from the ALB's security group
• Place targets in private subnets; the load balancer is the only public entry
• Redirect HTTP to HTTPS, use modern TLS policies, add WAF for web protection
• Mutual TLS (mTLS) with a trust store is available on ALB
• See 4. Cloud Security and 3. HTTP Security Headers and CSP

ELB with Other Services

Troubleshooting

$ aws elbv2 describe-target-health --target-group-arn $TG_ARN
$ aws elbv2 describe-load-balancers