Mastering AWS Load Balancing: Implementation & Configuration Strategy

This study guide covers the configuration and implementation of AWS Elastic Load Balancing (ELB) solutions, focusing on architectural patterns, OSI model integration, and high-availability design for the Advanced Networking Specialty exam.

Learning Objectives

After studying this module, you should be able to:

• Select the appropriate load balancer type (ALB, NLB, GWLB) based on specific application requirements and OSI layers.
• Configure target groups, listeners, and routing algorithms to optimize traffic distribution.
• Implement high-availability patterns using cross-zone load balancing and Auto Scaling integration.
• Design secure connectivity using TLS termination, TLS passthrough, and AWS WAF integration.
• Evaluate connectivity patterns for internal vs. external traffic management.

Key Terms & Glossary

• Listener: A process that checks for connection requests using the protocol and port you configure.
• Target Group: A logical grouping of targets (instances, IP addresses, or Lambdas) that receive traffic from the load balancer.
• Sticky Sessions (Session Affinity): A mechanism that binds a user's session to a specific target to ensure all requests from that user during the session are sent to the same target.
• Cross-Zone Load Balancing: A feature that allows the load balancer to distribute traffic evenly across all registered targets in all enabled Availability Zones.
• SNI (Server Name Indication): An extension to TLS that allows multiple certificates to be served on a single listener based on the hostname.

The "Big Idea"

At its core, load balancing in AWS is about abstraction and decoupling. By placing a load balancer in front of your compute resources, you decouple the client-side connection from the backend processing. This allows for horizontal scaling (Auto Scaling), seamless updates (Blue/Green deployments), and resilient failover without the user ever knowing the backend infrastructure has changed.

Formula / Concept Box

Hierarchical Outline

1. ELB Fundamentals
   • Abstraction: Front-end interface for backend compute (EC2, Containers, Lambda).
   • Health Checks: Automated monitoring to ensure traffic only reaches healthy targets.
2. Application Load Balancer (L7)
   • Path-based Routing: Routing based on URL paths (e.g., /api vs /images).
   • Host-based Routing: Routing based on host headers (e.g., app.example.com).
   • Security: Integrated with AWS WAF and ACM for certificate management.
3. Network Load Balancer (L4)
   • Static IPs: Supports Elastic IPs for whitelist-heavy environments.
   • Performance: Ideal for low-latency, high-throughput TCP/UDP traffic.
   • Preservation: Preserves client IP addresses natively.
4. Gateway Load Balancer (L3)
   • Security Appliances: Deploys and manages 3rd party virtual appliances (Firewalls, IDS/IPS).
   • GENEVE Protocol: Uses port 6081 to encapsulate original IP traffic.
5. Advanced Configurations
   • Proxy Protocol: Adds a header to carry client connection information (original IP/port) for NLB/CLB.
   • TLS Termination vs. Passthrough: Termination decrypts at the LB; Passthrough sends encrypted traffic to targets.

Visual Anchors

Load Balancer Selection Flowchart

Load Balancer Architecture Components

\begin{tikzpicture}[node distance=2cm, every node/.style={rectangle, draw, rounded corners, minimum width=2.5cm, minimum height=1cm, align=center}] \node (client) {Internet Client}; \node (lb) [right of=client, xshift=2cm, fill=blue!10] {Elastic Load \ Balancer}; \node (tg) [right of=lb, xshift=2.5cm, fill=green!10] {Target Group \ (Instances/IPs)}; \node (asg) [below of=tg, yshift=0.5cm, dashed] {Auto Scaling \ Group};

\end{tikzpicture}

Definition-Example Pairs

• Path-based Routing: Directing traffic to different target groups based on the URI in the request.
  • Example: Requests for example.com/orders go to a high-memory cluster, while example.com/static go to an S3-backed target.
• TLS Termination: The load balancer decrypts incoming HTTPS traffic using an SSL certificate before sending it to the backend.
  • Example: An ALB handles the heavy CPU work of SSL decryption, allowing backend EC2 instances to process only plain HTTP/80 traffic, simplifying certificate management.
• Internal Load Balancer: A load balancer that has a private IP address and is only accessible from within the VPC or via VPN/Direct Connect.
  • Example: A microservice architecture where the 'Orders' service needs to talk to the 'Inventory' service without ever exposing traffic to the public internet.

Worked Examples

Scenario: High Throughput & Whitelisting

Problem: A financial firm requires a load balancer that can handle millions of requests per second for a proprietary TCP-based trading protocol. Additionally, their partners require a static IP address to configure their firewall whitelists.

Solution Breakdown:

1. Type Selection: ALB is ruled out because it's L7 and doesn't support static IPs. NLB is selected for L4 performance and static IP support.
2. Configuration: Create an NLB. Assign Elastic IP addresses to each subnet/AZ the NLB is active in.
3. Target Group: Set the protocol to TCP on the target port used by the trading application.
4. Health Check: Configure a TCP health check to ensure the trading service is responding.

Checkpoint Questions

1. Which load balancer should you use if you need to route traffic based on the User-Agent HTTP header?
2. How does a Gateway Load Balancer (GWLB) communicate with its target security appliances?
3. What is the main benefit of enabling Cross-Zone Load Balancing when you have an uneven number of targets across Availability Zones?
4. If an application requires the Client's source IP address but is sitting behind an NLB that is not using the 'IP' target type, what configuration must be enabled?

▶Click to see answers

1. ALB (it performs L7 inspection).
2. Using the GENEVE protocol on port 6081.
3. It ensures even distribution of traffic across all instances in the region, preventing any single instance from being overloaded due to AZ-level traffic imbalances.
4. Proxy Protocol v2 must be enabled on the NLB and supported by the target software.

Muddy Points & Cross-Refs

• SNI vs. Multiple Listeners: Students often confuse these. Use SNI when you have multiple domains on one IP/Listener. Use multiple listeners only if you need different ports (e.g., 80 and 443).
• Security Group Differences: Remember that NLBs do not have Security Groups (they rely on the Target's Security Group and NACLs), whereas ALBs have their own Security Groups.
• Cross-Ref: For global distribution, look at Global Accelerator (Anycast IPs) which can point to ALBs/NLBs in multiple regions to reduce latency.

Comparison Tables

Internal vs. External Load Balancers

[!IMPORTANT] When integrating an ALB with AWS WAF, remember that the WAF inspection occurs before the traffic is routed to the target group, providing a layer of protection against SQL injection and Cross-Site Scripting (XSS).