Loading…
While this loads — worth knowing
ElastiCache RedisnotElastiCache Memcached
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Loading…
While this loads — worth knowing
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Spreads incoming traffic across healthy targets in several Availability Zones, with four kinds of load balancer: Application, Network, Gateway and Classic.
Where ELB takes you7 steps, all open
Elastic Load Balancing spreads incoming traffic across targets, such as EC2 instances, containers and IP addresses, in one or more Availability Zones. It checks the health of its targets and sends traffic only to the healthy ones, and it scales its own capacity as traffic changes.
Four kinds under one name. Application Load Balancers work at layer 7 and read HTTP. Network Load Balancers work at layer 4, with TCP, UDP and TLS. Gateway Load Balancers put firewalls and other appliances in the path, at layer 3. Classic Load Balancers are the previous generation, and AWS recommends moving off them.
A receptionist reads what each visitor asks for and sends them to the right department. A switchboard connects calls by number, as fast as they come, without listening in. A security desk sits in the path of everyone entering and checks each of them before they go on. Every one of them stops sending people to staff who are off sick.
Application Load BalancerNetwork Load BalancerGateway Load BalancerListenerTarget groupUnhealthy targetTargets see the load balancer's address, not the client's. An Application Load Balancer adds the client's address to the X-Forwarded-For header, and a server that needs it reads it there.
Public face, private targets. An internet-facing load balancer's nodes have public addresses; an internal one's have only private ones. Both reach their targets on private addresses, so the targets need no public IP at all. A multi-tier application can use both: an internet-facing one for the web tier, and an internal one in front of the application servers.
Is there a listener on this protocol and port?
An HTTPS listener ends TLS with its certificate, picked by SNI when it holds several.
Checked in priority order. The first whose conditions match decides what happens, and the default rule takes the rest.
A healthy target is picked, round robin by default.
The request arrives with the client's address in X-Forwarded-For.
Pick a case to follow the request through each check.
One target group, two targets in each zone
CustomersServed by Target 1 and Target 2 and Target 3 and Target 4
Click a node to make it fail. The timings in the log are the real ones, played 10× faster.
About a minute to notice. With the defaults, an Application Load Balancer checks each target every 30 seconds and takes it out after two failures in a row. Nothing here replaces a target: that is Auto Scaling's job.
Cross-zone load balancing. It is always on for an Application Load Balancer, so every node sends to targets in every zone. On a Network or Gateway Load Balancer it is off by default: each node sends only to targets in its own zone, so a zone with fewer targets gives each of them a bigger share.
A zone with no healthy target. A Network Load Balancer takes that zone's address out of DNS. Clients that ignore the TTL and keep using the old address fail.
Removing a target gently. A deregistering target gets no new requests, and requests already in flight have 300 seconds by default to finish.
Targets accept traffic only from the load balancer. Put the load balancer's security group as the source in the targets' security group, so nothing reaches them around it. A Network Load Balancer can have security groups too, but only if one is associated when it is created.
End TLS with an ACM certificate. An HTTPS listener holds a default certificate and, through SNI, a list for other domains. ACM renews the certificates it issued.
Filter at layer 7 with AWS WAF. A web ACL on an Application Load Balancer allows or blocks requests by its rules.
Sign users in before routing. An Application Load Balancer can authenticate users through corporate or social identities before a request reaches a target.
Internal where you can. An internal load balancer has only private addresses, so only clients that can reach the VPC can use it.
By the hour, and by capacity used. A load balancer is charged for each hour or partial hour it runs, plus the capacity units it uses, measured per minute.
An Application Load Balancer's capacity unit has four dimensions: new connections, active connections, bytes processed and rule evaluations. You pay only on the one with the highest usage.
Blocked traffic is free on a Network Load Balancer. Traffic its security group's inbound rules block is not charged.
One Application Load Balancer can serve many applications. Host and path rules put several sites or services behind one load balancer instead of one each.
Prices change, so none are printed here. Check the Elastic Load Balancing pricing page on aws.amazon.com.
| Type | Works at | Traffic | Choose it when |
|---|---|---|---|
| Application Load Balancer | Layer 7 | HTTP, HTTPS, HTTP/2, gRPC, WebSockets | Routing by path, host, header or query string; Lambda targets; signing users in |
| Network Load Balancer | Layer 4 | TCP, UDP, TLS, QUIC | Millions of requests a second, static or Elastic IP addresses, protocols other than HTTP |
| Gateway Load Balancer | Layer 3 | All IP packets, to appliances over GENEVE | Firewalls, intrusion detection or deep packet inspection in the path |
| Classic Load Balancer | Previous generation | TCP, HTTP and HTTPS listeners | Only to keep an old setup running: AWS recommends migrating |
| Type | Cross-zone load balancing | Security groups |
|---|---|---|
| Application Load Balancer | Always on at the load balancer; can be turned off per target group | Yes |
| Network Load Balancer | Off by default | Only if associated when it is created |
| Gateway Load Balancer | Off by default | Not covered here |
| Classic Load Balancer | On when created in the console, off from the API or CLI | Not covered here |
route /api and /images to different serversAn Application Load Balancer with path rules
Only layer 7 reads the URL path. A Network Load Balancer never sees it.
fixed IP addresses for the load balancer, for a customer's firewallA Network Load Balancer, with an Elastic IP address per subnet
An ALB is reached through a DNS name whose addresses change as it scales; an NLB has a static address in each zone.
millions of requests per second over TCP or UDPA Network Load Balancer
It works at layer 4 and is built for volatile workloads at that scale.
put third-party firewall appliances in the path of all trafficA Gateway Load Balancer
It works at layer 3 and reaches the appliances over GENEVE on port 6081.
the application logs show only the load balancer's IP addressRead the X-Forwarded-For header
An Application Load Balancer puts the client's address there by default.
users lose their session when their requests reach another serverSticky sessions
A cookie binds each user's session to one target, for between 1 second and 7 days.
requests fail while an instance is being removedThe deregistration delay
A deregistering target gets no new requests, and those in flight get 300 seconds by default.
behind an NLB, one zone has two targets and the other eight, and the two are overloadedTurn on cross-zone load balancing
It is off by default on a Network Load Balancer, so each node sends only to its own zone's targets.
HTTPS for several domains on one load balancerSeveral certificates on one HTTPS listener, chosen by SNI
The listener presents the certificate that matches the host name the client asks for.
A company runs a multiplayer game server that uses UDP. Players' networks allow traffic only to a fixed list of IP addresses, and the game sees sudden spikes to millions of requests per second. Which load balancer should a solutions architect choose?
One domain serves a website and an API. Requests whose path starts with /api must go to a separate group of API servers and the rest to the web servers, and TLS must end before the servers. What sits between the customers and the API servers?
6081.30 s, out after 2 failures, back after 5 successes.300 s by default.This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.
Next: WAFA web application firewall that inspects the HTTP and HTTPS requests reaching CloudFront, a load balancer or an API, and allows, blocks or counts each one by your rules.
Open WAFEvery fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.