PlayCloudLabs
Sign in
  1. Learn
  2. AWS
  3. Networking & content delivery
  4. ELB
AWSGCP laterAzure later

ELBElastic Load Balancing

Networking & content deliveryCore service · full depthFree while we build the libraryChecked against AWS docs · 15 Sept 2026

Spreads incoming traffic across healthy targets in several Availability Zones, with four kinds of load balancer: Application, Network, Gateway and Classic.

In the examsSolutions Architect – AssociateHIGHSolutions Architect – ProfessionalHIGHDeveloper – AssociateMEDSysOps Administrator – AssociateHIGHSecurity – SpecialtyMED

Where ELB takes you7 steps, all open

  1. I know the problem it solves
  2. I can picture it
  3. I know how it scales
  4. I know how it fails
  5. I know when to choose it
  6. I can use it in a design
  7. I can answer an exam question

What & why

One front door for many targets

Elastic Load Balancing spreads incoming traffic across targets, such as EC2 instances, containers and IP addresses, in one or more Availability Zones. It checks the health of its targets and sends traffic only to the healthy ones, and it scales its own capacity as traffic changes.

Four kinds under one name. Application Load Balancers work at layer 7 and read HTTP. Network Load Balancers work at layer 4, with TCP, UDP and TLS. Gateway Load Balancers put firewalls and other appliances in the path, at layer 3. Classic Load Balancers are the previous generation, and AWS recommends moving off them.

Reach for it when

  • several instances or containers should look like one endpoint
  • unhealthy targets must stop getting traffic without anyone acting
  • TLS should end at the load balancer, not on every server
  • an Auto Scaling group's instances come and go

It is the wrong tool when

  • users should be sent to one of several Regions: that is Route 53 in front
  • one server only needs a name: that is a Route 53 record
  • content should be cached near users: that is CloudFront

Mental model

A receptionist, a switchboard and a security desk

A receptionist reads what each visitor asks for and sends them to the right department. A switchboard connects calls by number, as fast as they come, without listening in. A security desk sits in the path of everyone entering and checks each of them before they go on. Every one of them stops sending people to staff who are off sick.

The receptionistreads the request and routes by its contentApplication Load Balancer
The switchboardconnects by address and port, very fastNetwork Load Balancer
The security desksends every packet through an applianceGateway Load Balancer
The door visitors usethe protocol and port it acceptsListener
A departmenttargets that share one health checkTarget group
Staff off sicktargets failing their checksUnhealthy target

How it works

Zones, listeners and target groups
  1. Enable zonesIt places a load balancer node in each Availability Zone you enable. An Application Load Balancer needs at least two.
  2. Add listenersA listener checks for connections on a protocol and port. On an Application Load Balancer, its rules, in priority order, decide where each request goes.
  3. Register targetsInto target groups: by instance, IP address, Lambda function for an ALB, or an ALB behind an NLB. Each target group has its own health checks.
  4. Point a name at itClients use its DNS name, which answers with the nodes' addresses and a TTL of 60 seconds. A Route 53 alias record puts your own domain on it.
ALB health check
Every 30 sinstance and IP targets, by default
Out of service after
2 failuresback in after 5 successes
Deregistration delay
300 sdefault, for in-flight requests
DNS TTL
60 sso node addresses can change quickly
Sticky sessions
1 s to 7 dayscookie duration on an ALB
Gateway Load Balancer
GENEVE, 6081the protocol and port to appliances

Architecture

One listener, two target groups

Architecture

TLS ends at the load balancer with an ACM certificate, a web ACL filters requests, and listener rules send each request to a target group by its path.

TLS ends at the load balancer with an ACM certificate, a web ACL filters requests, and listener rules send each request to a target group by its path.

Targets see the load balancer's address, not the client's. An Application Load Balancer adds the client's address to the X-Forwarded-For header, and a server that needs it reads it there.

Public face, private targets. An internet-facing load balancer's nodes have public addresses; an internal one's have only private ones. Both reach their targets on private addresses, so the targets need no public IP at all. A multi-tier application can use both: an internet-facing one for the web tier, and an internal one in front of the application servers.

Traffic simulation

Follow a request through an ALB
  1. Listener

    Is there a listener on this protocol and port?

  2. TLS

    An HTTPS listener ends TLS with its certificate, picked by SNI when it holds several.

  3. Listener rules

    Checked in priority order. The first whose conditions match decides what happens, and the default rule takes the rest.

  4. Target group

    A healthy target is picked, round robin by default.

  5. Target

    The request arrives with the client's address in X-Forwarded-For.

Pick a case to follow the request through each check.

Failure simulation

Lose targets, then a zone

One target group, two targets in each zone

CustomersServed by Target 1 and Target 2 and Target 3 and Target 4

AZ a

AZ b

Click a node to make it fail. The timings in the log are the real ones, played 10× faster.

  1. Everything is up. Take a node or a whole zone down.

About a minute to notice. With the defaults, an Application Load Balancer checks each target every 30 seconds and takes it out after two failures in a row. Nothing here replaces a target: that is Auto Scaling's job.

Cross-zone load balancing. It is always on for an Application Load Balancer, so every node sends to targets in every zone. On a Network or Gateway Load Balancer it is off by default: each node sends only to targets in its own zone, so a zone with fewer targets gives each of them a bigger share.

A zone with no healthy target. A Network Load Balancer takes that zone's address out of DNS. Clients that ignore the TTL and keep using the old address fail.

Removing a target gently. A deregistering target gets no new requests, and requests already in flight have 300 seconds by default to finish.

Security

What reaches the targets, and how

Targets accept traffic only from the load balancer. Put the load balancer's security group as the source in the targets' security group, so nothing reaches them around it. A Network Load Balancer can have security groups too, but only if one is associated when it is created.

End TLS with an ACM certificate. An HTTPS listener holds a default certificate and, through SNI, a list for other domains. ACM renews the certificates it issued.

Filter at layer 7 with AWS WAF. A web ACL on an Application Load Balancer allows or blocks requests by its rules.

Sign users in before routing. An Application Load Balancer can authenticate users through corporate or social identities before a request reaches a target.

Internal where you can. An internal load balancer has only private addresses, so only clients that can reach the VPC can use it.

Cost

How you are charged, not what it costs today

By the hour, and by capacity used. A load balancer is charged for each hour or partial hour it runs, plus the capacity units it uses, measured per minute.

An Application Load Balancer's capacity unit has four dimensions: new connections, active connections, bytes processed and rule evaluations. You pay only on the one with the highest usage.

Blocked traffic is free on a Network Load Balancer. Traffic its security group's inbound rules block is not charged.

One Application Load Balancer can serve many applications. Host and path rules put several sites or services behind one load balancer instead of one each.

Prices change, so none are printed here. Check the Elastic Load Balancing pricing page on aws.amazon.com.

Comparison

Four load balancers
TypeWorks atTrafficChoose it when
Application Load BalancerLayer 7HTTP, HTTPS, HTTP/2, gRPC, WebSocketsRouting by path, host, header or query string; Lambda targets; signing users in
Network Load BalancerLayer 4TCP, UDP, TLS, QUICMillions of requests a second, static or Elastic IP addresses, protocols other than HTTP
Gateway Load BalancerLayer 3All IP packets, to appliances over GENEVEFirewalls, intrusion detection or deep packet inspection in the path
Classic Load BalancerPrevious generationTCP, HTTP and HTTPS listenersOnly to keep an old setup running: AWS recommends migrating
TypeCross-zone load balancingSecurity groups
Application Load BalancerAlways on at the load balancer; can be turned off per target groupYes
Network Load BalancerOff by defaultOnly if associated when it is created
Gateway Load BalancerOff by defaultNot covered here
Classic Load BalancerOn when created in the console, off from the API or CLINot covered here

SAA traps

The phrase in the question, and what it means
route /api and /images to different serversAn Application Load Balancer with path rules

Only layer 7 reads the URL path. A Network Load Balancer never sees it.

fixed IP addresses for the load balancer, for a customer's firewallA Network Load Balancer, with an Elastic IP address per subnet

An ALB is reached through a DNS name whose addresses change as it scales; an NLB has a static address in each zone.

millions of requests per second over TCP or UDPA Network Load Balancer

It works at layer 4 and is built for volatile workloads at that scale.

put third-party firewall appliances in the path of all trafficA Gateway Load Balancer

It works at layer 3 and reaches the appliances over GENEVE on port 6081.

the application logs show only the load balancer's IP addressRead the X-Forwarded-For header

An Application Load Balancer puts the client's address there by default.

users lose their session when their requests reach another serverSticky sessions

A cookie binds each user's session to one target, for between 1 second and 7 days.

requests fail while an instance is being removedThe deregistration delay

A deregistering target gets no new requests, and those in flight get 300 seconds by default.

behind an NLB, one zone has two targets and the other eight, and the two are overloadedTurn on cross-zone load balancing

It is off by default on a Network Load Balancer, so each node sends only to its own zone's targets.

HTTPS for several domains on one load balancerSeveral certificates on one HTTPS listener, chosen by SNI

The listener presents the certificate that matches the host name the client asks for.

Scenario

Exam style, marked when you answer

A company runs a multiplayer game server that uses UDP. Players' networks allow traffic only to a fixed list of IP addresses, and the game sees sudden spikes to millions of requests per second. Which load balancer should a solutions architect choose?

Practice

Fill the gap, the way the challenges work

One domain serves a website and an API. Requests whose path starts with /api must go to a separate group of API servers and the rest to the web servers, and TLS must end before the servers. What sits between the customers and the API servers?

Web client· CustomersPick a service belowEC2· API servers

Quick revision

The night before the exam
ALB
Layer 7: path, host, header and query rules; Lambda targets; AWS WAF.
NLB
Layer 4: TCP, UDP, TLS; a static IP per zone; millions of requests a second.
GWLB
Layer 3: appliances in the path, over GENEVE on port 6081.
CLB
The previous generation: migrate off it.
Health checks
ALB: every 30 s, out after 2 failures, back after 5 successes.
Cross-zone
Always on for an ALB; off by default for an NLB and a GWLB.
Client IP
In the X-Forwarded-For header, behind an ALB.
Draining
The deregistration delay, 300 s by default.

This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.

Next: WAFA web application firewall that inspects the HTTP and HTTPS requests reaching CloudFront, a load balancer or an API, and allows, blocks or counts each one by your rules.

Open WAF

Checked against

Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.

Still there?

You have been away for a while. We have saved what you were working on in this browser. In 60 seconds you will be signed out to keep your account safe.