Skip to content

Elastic Load Balancing (ELB)

Elastic Load Balancing distributes incoming traffic across targets in one or more Availability Zones, and stops sending traffic to a target when its health check fails.

There are four types.

  1. Application Load Balancer (ALB) — layer 7, application-aware. For HTTP and HTTPS, with routing on host, path, header, method, query string and source IP.
  2. Network Load Balancer (NLB) — layer 4. For TCP, UDP and TLS, at very high connection rates and very low latency.
  3. Gateway Load Balancer (GWLB) — layer 3. For inserting third-party virtual appliances, such as firewalls and intrusion detection, transparently into a traffic path.
  4. Classic Load Balancer (CLB) — the original, spanning layers 4 and 7. Retained for existing deployments only.
FeatureApplication (ALB)Network (NLB)Gateway (GWLB)Classic (CLB)
OSI layer7 (application)4 (transport)3 (network)4 and 7
ProtocolsHTTP, HTTPS, gRPC, WebSocketTCP, UDP, TLSIP, with GENEVE to the appliancesTCP, SSL/TLS, HTTP, HTTPS
Latency addedSub-millisecondSub-millisecond, and the lowest of the fourLowSub-millisecond
ThroughputHighHighest; millions of requests per secondHighModerate
Static IPNoYes, one per Availability ZoneYesNo
Elastic IPNoYesNoNo
Path and host-based routingYesNoNoNo
Redirects and fixed responsesYesNoNoNo
HTTP/2 and gRPCYesNoNot applicableNo
WebSocketYesYesNot applicableLimited
TLS terminationYesYesNot applicableYes
Server Name IndicationYesYesNot applicableNo
User authentication (OIDC, Cognito)YesNoNoNo
AWS WAF integrationYesNoNoNo
Sticky sessionsYesYes, per target groupNot applicableYes
Connection drainingYes (deregistration delay)Yes (deregistration delay)Not applicableYes
Health checksHTTP, HTTPS, gRPC, TCPTCP, HTTP, HTTPSTCP, HTTP, HTTPSTCP, HTTP, HTTPS, SSL
Cross-zone load balancingOn at the load balancer; can be turned off per target groupOff by defaultOff by defaultOff by default via API/CLI, on by default via the console
Target typesinstance, ip, lambdainstance, ip, albinstance, ipEC2 instances
Transparent network gatewayNoNoYesNo
Use forHTTP and HTTPS applications, microservices, containersTCP and UDP workloads, extreme performance, static IP requirementsThird-party firewalls, IDS/IPS, deep packet inspectionExisting deployments only — use ALB or NLB for anything new

ALB and NLB register targets in target groups, and a target group has a type:

  • instance — an EC2 instance ID; the load balancer reaches it on its primary private address.
  • ip — a private IPv4 or IPv6 address. This is what reaches targets in a peered VPC, on-premises over Direct Connect or VPN, or in a container with its own address. Registering 10.0.1.23 directly is normal and supported; a fully qualified domain name is not required.
  • lambda — an ALB can invoke a Lambda function as a target.
  • alb — an NLB can forward to an Application Load Balancer, which is how you put a static IP address in front of an ALB.

With cross-zone load balancing on, every load balancer node distributes across targets in all enabled Availability Zones. With it off, each node distributes only to targets in its own zone.

The difference matters when zones hold different numbers of targets. Two zones, one with two targets and one with eight: with cross-zone on, each of the ten targets receives 10% of traffic; with it off, the two targets in the first zone take 25% each and the eight in the second take 6.25% each.

Defaults differ by type, and ALB’s changed: cross-zone is always on at the ALB level but can be turned off per target group. NLB and GWLB default to off and can be turned on. Turning it off keeps traffic zonal, which reduces cross-zone data transfer charges and contains the blast radius of a zone failure — at the cost of needing balanced capacity in every zone.

Load balancer nodes scale with traffic and consume private addresses from the subnets they are placed in. Leave headroom: a subnet that is nearly full prevents the load balancer scaling up, and the symptom is a capacity failure rather than an address error.

An ALB requires at least two Availability Zones. All four types require the target’s Availability Zone to be enabled on the load balancer, or registered targets there receive nothing.

Sticky sessions bind a client to one target for the life of a session, using a cookie on an ALB or CLB and source-IP affinity on an NLB. They are necessary for applications that keep session state in memory — a shopping basket, a login session — and they undermine even distribution, complicate deployments and make a target failure user-visible.

Where you can, keep session state outside the instance in ElastiCache or DynamoDB and leave stickiness off.

  • HTTP or HTTPS with any routing requirement, WAF, or authentication → ALB
  • TCP or UDP, millions of connections, or a static IP address → NLB
  • Traffic that must pass through a third-party appliance → GWLB
  • Nothing new → CLB

An ALB behind an NLB is a common pairing when an HTTP application needs both layer 7 routing and a static IP.