Aws Lb

---
name: aws-lb
description: "Expert coverage of AWS Elastic Load Balancing (Application Load Balancer/ALB, Network Load Balancer/NLB, and Gateway Load Balancer/GWLB): L7/L4/L3 load balancing, target groups, routing rules, health checks, WAF integration, PrivateLink, GENEVE encapsulation, and IaC deployment. Use for \"ALB\", \"NLB\", \"GWLB\", \"AWS load balancer\", \"Application Load Balancer\", \"Network Load Balancer\", \"Gateway Load Balancer\", \"ELB\", \"target group\", \"AWS WAF ALB\". Do NOT use for cross-vendor comparison, platform selection, or category-wide architecture -- use the `load-balancing` skill."
license: MIT
---

# AWS Elastic Load Balancing

This skill covers AWS Elastic Load Balancing across all three load balancer types. Areas of expertise include:

- ALB (Application Load Balancer): L7 HTTP/HTTPS/gRPC routing, path/host/header-based rules, weighted target groups, Lambda targets, WAF integration, Cognito auth, URL rewrite
- NLB (Network Load Balancer): L4 TCP/UDP/TLS, static IPs, PrivateLink, ultra-low latency, TLS passthrough, weighted target groups, QUIC pass-through
- GWLB (Gateway Load Balancer): L3 transparent appliance insertion, GENEVE encapsulation, symmetric hashing, security appliance fleet scaling
- Target groups: Instance, IP, Lambda, ALB-type targets, health check configuration
- Health checks: HTTP, HTTPS, TCP, gRPC checks with configurable thresholds
- Integration: AWS WAF, ACM certificates, CloudWatch, Access Logs, Route 53
- IaC: CloudFormation, Terraform (aws_lb, aws_lb_target_group, aws_lb_listener), CDK

## How to Approach Tasks

1. **Classify** the request:
   - **Architecture** -- Load `references/architecture.md` for ALB/NLB/GWLB internals
   - **LB selection** -- Which LB type for the use case (L7 vs L4 vs appliance insertion)
   - **Routing rules** -- ALB listener rules, path/host/header matching, weighted routing
   - **Target groups** -- Target type selection, health check design, cross-zone behavior
   - **Security** -- WAF integration, TLS/mTLS, Cognito authentication
   - **PrivateLink** -- NLB as PrivateLink endpoint, cross-account service exposure
   - **Appliance insertion** -- GWLB with firewall/IDS/IPS, GENEVE configuration
   - **IaC** -- CloudFormation, Terraform, CDK templates

2. **Identify the right LB type**:
   - Need L7 (HTTP/HTTPS) routing? --> **ALB**
   - Need L4 (TCP/UDP), static IPs, or PrivateLink? --> **NLB**
   - Need transparent security appliance insertion? --> **GWLB**

3. **Load context** -- Read `references/architecture.md` for deep AWS LB knowledge.

4. **Analyze** -- Apply AWS-specific reasoning. Consider AZ distribution, cross-zone settings, target group draining, and cost implications.

5. **Recommend** -- Provide actionable guidance with AWS CLI commands, Terraform, or CloudFormation templates.

6. **Verify** -- Suggest validation (describe-target-health, CloudWatch metrics, access logs).

## Application Load Balancer (ALB)

ALB operates at **Layer 7** (HTTP/HTTPS/gRPC):

### Routing Rules

| Match Type | Description | Example |
|---|---|---|
| **Path-based** | URL path pattern | `/api/*` -> API target group |
| **Host-based** | Host header value | `api.example.com` -> API targets |
| **Header-based** | HTTP header value | `X-Version: v2` -> v2 targets |
| **Query string** | URL parameters | `?version=2` -> v2 targets |
| **Source IP** | Client CIDR | `10.0.0.0/8` -> internal targets |
| **HTTP method** | Request method | `POST` -> write targets |

### Weighted Target Groups

Distribute traffic across multiple target groups by percentage:

```
Listener Rule:
  Action: forward
  Target Groups:
    - blue-tg:  weight 90 (90%)
    - green-tg: weight 10 (10%)
```

Enables blue/green and canary deployments without DNS changes.

### Target Types

| Type | Description | Use Case |
|---|---|---|
| **Instance** | EC2 instance ID | Standard EC2 workloads |
| **IP** | Direct IP routing | On-premises via VPN/DX, ECS tasks, containers |
| **Lambda** | Invoke Lambda per request | Serverless backends |
| **ALB** | Another ALB as target (via NLB) | NLB static IP + ALB L7 routing |

### Key Integrations

- **AWS WAF v2** -- OWASP protection, custom rules, bot control, account takeover prevention
- **Amazon Cognito** -- Offload user authentication; redirect to login, validate JWT
- **AWS Certificate Manager (ACM)** -- Free TLS certificates auto-renewed and deployed
- **Access Logs** -- Per-request logs to S3 (client IP, latency, response code, SSL cipher)
- **CloudWatch** -- Metrics: RequestCount, TargetResponseTime, HTTPCode_Target_5XX_Count

### ALB Features (2025+)

- **Target Optimizer** -- Routes AI/ML workloads requiring single-task concurrency to appropriate targets; prevents GPU contention
- **URL/Host Header Rewrite** -- Regex-based rewrite of request URL and host header before forwarding to backend

### ALB Configuration (Terraform)

```hcl
resource "aws_lb" "app" {
  name               = "app-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.alb.id]
  subnets            = var.public_subnet_ids
}

resource "aws_lb_target_group" "app" {
  name     = "app-tg"
  port     = 8080
  protocol = "HTTP"
  vpc_id   = var.vpc_id

  health_check {
    path                = "/healthz"
    healthy_threshold   = 2
    unhealthy_threshold = 3
    interval            = 15
    timeout             = 5
    matcher             = "200"
  }
}

resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.app.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  certificate_arn   = aws_acm_certificate.app.arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.app.arn
  }
}

resource "aws_lb_listener_rule" "api" {
  listener_arn = aws_lb_listener.https.arn
  priority     = 100

  action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.api.arn
  }

  condition {
    path_pattern {
      values = ["/api/*"]
    }
  }
}
```

## Network Load Balancer (NLB)

NLB operates at **Layer 4** (TCP/UDP/TLS):

### Key Capabilities

| Capability | Description |
|---|---|
| **Static IP per AZ** | Each AZ gets one static IP (Elastic IP optional) |
| **Ultra-low latency** | Sub-millisecond latency; no L7 inspection overhead |
| **TLS termination** | Terminate TLS with ACM certificate |
| **TLS passthrough** | Forward encrypted traffic without termination |
| **PrivateLink** | NLB is the entry point for PrivateLink services |
| **Cross-zone** | Enable/disable per NLB; affects AZ distribution |
| **Weighted target groups** | Blue/green for TCP services (Nov 2025) |
| **QUIC pass-through** | Forward QUIC (UDP 443) to targets unmodified |
| **ALB as target** | Register ALB as NLB target (static IP + L7 routing) |

### When to Use NLB over ALB

- Clients need **fixed IP addresses** (firewall rules, DNS pinning)
- **TCP/UDP** services (databases, game servers, IoT, MQTT)
- **Ultra-low latency** requirements (financial trading, real-time)
- **PrivateLink** service exposure across VPCs/accounts
- **TLS passthrough** (backend handles TLS directly)
- **Very high throughput** (millions of requests per second)

### NLB + ALB Pattern

```
Internet
    |
    v
NLB (static IPs, Elastic IPs)
    |
    v
ALB (L7 routing, WAF, Cognito)
    |
    v
Target Groups (EC2, ECS, Lambda)
```

Register ALB as an NLB target to combine static IPs (NLB) with L7 routing (ALB).

## Gateway Load Balancer (GWLB)

GWLB enables transparent **L3 appliance insertion**:

### How GWLB Works

```
Traffic Flow:
  VPC Route Table -> GWLB Endpoint
      -> GWLB (GENEVE encapsulation)
      -> Security Appliance (IDS/IPS/NGFW)
      -> GWLB (decapsulation)
      -> Original Destination
```

### GENEVE Encapsulation

- Wraps original packets in GENEVE (UDP 6081)
- Preserves original source/destination IP for security inspection
- **TLV format**: Option Class `0x0108`
- Appliances must support GENEVE decapsulation/encapsulation

### Key Features

| Feature | Description |
|---|---|
| **Symmetric hashing** | Forward and return paths guaranteed to same appliance |
| **Auto-scaling** | Security appliances in ASG behind GWLB |
| **Cross-AZ** | Distribute across appliances in multiple AZs |
| **Health checks** | TCP or HTTP checks against appliance management plane |

### Use Cases

- Third-party firewalls (Palo Alto, Fortinet, Check Point)
- IDS/IPS (deep packet inspection)
- Network packet capture for compliance
- DLP (Data Loss Prevention) appliances

## Health Checks

| LB Type | Protocols | Min Interval | Notes |
|---|---|---|---|
| **ALB** | HTTP, HTTPS | 5 seconds | Configurable path, port, codes, thresholds |
| **NLB** | TCP, HTTP, HTTPS, gRPC | 10 seconds | TCP check is fastest |
| **GWLB** | TCP, HTTP | 10 seconds | Against appliance management plane |

### Health Check Best Practices

- Use `/healthz` or `/health` dedicated endpoint (not homepage)
- Set healthy threshold to 2 (fast recovery)
- Set unhealthy threshold to 3 (avoid transient failures)
- Match expected HTTP status codes explicitly (200-299 or specific code)
- For NLB TCP health checks: verify both port and application readiness

## Cross-Zone Load Balancing

| Setting | ALB | NLB | GWLB |
|---|---|---|---|
| **Default** | Enabled (always on) | Disabled | Disabled |
| **Behavior when enabled** | Even distribution across all AZs | Even distribution; may increase cross-AZ data transfer cost | Even distribution to appliances |
| **Behavior when disabled** | N/A | Each AZ independently distributes to local targets only | Each AZ routes to local appliances |

**Cost note**: Cross-zone traffic on NLB incurs inter-AZ data transfer charges. Evaluate cost vs distribution evenness.

## Common Pitfalls

1. **ALB for TCP services** -- ALB only supports HTTP/HTTPS/gRPC. Use NLB for raw TCP/UDP services.

2. **NLB without cross-zone** -- With cross-zone disabled (default), uneven target distribution across AZs causes hot spots. Enable cross-zone or balance targets evenly.

3. **GWLB appliance GENEVE mismatch** -- Appliances must support GENEVE encapsulation with AWS TLV format. Verify appliance compatibility before deployment.

4. **Slow health check intervals** -- NLB minimum interval is 10 seconds. With unhealthy threshold of 3, detection takes 30+ seconds. Plan for this in failover scenarios.

5. **Security group omission on ALB** -- ALB requires security groups allowing inbound traffic. NLB does not use security groups (traffic passes through). Common confusion when switching between LB types.

6. **ACM certificate not in same region** -- ACM certificates must be in the same region as the ALB/NLB. For CloudFront, certificates must be in us-east-1.

7. **PrivateLink requires NLB** -- PrivateLink services require NLB as the endpoint. ALB and GWLB cannot serve as PrivateLink endpoints directly.

8. **Ignoring access logs** -- ALB access logs provide essential debugging data (latency, error codes, client IPs). Enable from Day 1 and configure S3 lifecycle for cost management.

## Reference Files

Load these when you need deep knowledge:

- `references/architecture.md` -- ALB/NLB/GWLB internals, target group mechanics, health check deep dive, GENEVE protocol, cross-zone behavior, integration patterns. Read for "how does X work" questions.