Elastic Load Balancing
Distribute requests
Distributes requests across multiple EC2 instances/containers/IPs, runs health checks and skips unhealthy targets. Includes ALB (HTTP), NLB (TCP/UDP), GWLB.
- Cost$$ Medium
- Difficulty●●●●●
- Costs money when idle?Yes
- Managed by AWS
- In examsCLF · SAA · DVA · SOA
Think of it asLike a receptionist directing customers to whichever counters are free.
Where does ELB fit?
ELB
A real example, step by step
- A web app runs on 3 EC2 instances in 3 AZs and needs a single address for users.
- You create an Application Load Balancer, attach an ACM certificate for HTTPS and point your domain at it with Route 53.
- The ALB spreads requests across the 3 instances; the /api path goes to the API instances, everything else to the web instances.
- Health checks run every 30 seconds; if an instance stops responding, the ALB stops sending it requests.
- Combined with Auto Scaling, failed instances are replaced and new ones are registered with the load balancer automatically.
When to use it
✓ Use it when
You have 2 or more servers/containers serving the same app.
✗ Avoid it when
Purely serverless APIs → API Gateway.
Common uses
- Load-balance web/API traffic to EC2 or ECS (ALB)
- Path/host-based routing for microservices
- Low-latency TCP/UDP, static IPs (NLB)
- Insert virtual firewalls into network traffic (GWLB)
ELB, API Gateway or CloudFront?
| ELB |  API Gateway |  CloudFront | |
|---|---|---|---|
| What it does | Spreads traffic to instances/containers in a region | API front door: auth, rate limiting, transformation | CDN that caches content near users |
| Layer | HTTP (ALB) or TCP/UDP (NLB) | HTTP | HTTP |
| Billing | Hourly + capacity units | Per request | Data transferred + requests |
| Best for | Web apps on EC2/ECS with heavy traffic | Serverless APIs with Lambda | Static content, global users |
What does it cost?
- Pricing model: ALB: ~$0.0225/hour + ~$0.008/LCU-hour (LCUs are based on new connections, active connections, bandwidth and rule count).
- Free tier: Older accounts: 750 hours + 15 LCUs for 12 months.
A separate ALB per environment/service (consolidate with rules instead); forgotten load balancers created by Kubernetes; a load balancer's public IPv4 addresses are billed too.
Path- or host-based routing, sticky sessions, attaching WAF → ALB. Static IPs, TCP/UDP, ultra-low latency → NLB. Sending traffic through third-party firewall appliances → Gateway Load Balancer.
Try real exam questions
1A company has a three-tier environment on AWS that ingests sensor data from its users' devices. The traffic flows through a Network Load Balancer (NLB) then to Amazon EC2 instances for the web tier, and finally to EC2 instances for the application tier that makes database calls. What should a solutions architect do to improve the security of data in transit to the web tier?
- AConfigure a TLS listener and add the server certificate on the NLB.
- BConfigure AWS Shield Advanced and enable AWS WAF on the NLB.
- CChange the load balancer to an Application Load Balancer and attach AWS WAF to it.
- DEncrypt the Amazon Elastic Block Store (Amazon EBS) volume on the EC2 instances using AWS Key Management Service (AWS KMS).
Show answer
Correct answer: A
Add a TLS listener and certificate on the NLB to encrypt traffic to the web tier. WAF and Shield defend against attacks but don't encrypt; encrypting EBS protects data at rest, not data in transit.
2A company runs a web application on Amazon EC2 instances in an Auto Scaling group that has a target group. The company designed the application to work with session affinity (sticky sessions) for a better user experience. The application must be available publicly over the internet as an endpoint. A WAF must be applied to the endpoint for additional security. Session affinity (sticky sessions) must be configured on the endpoint. Which combination of steps will meet these requirements? (Choose two.)
- ACreate a public Network Load Balancer. Specify the application target group.
- BCreate a Gateway Load Balancer. Specify the application target group.
- CCreate a public Application Load Balancer. Specify the application target group.
- DCreate a second target group. Add Elastic IP addresses to the EC2 instances.
- ECreate a web ACL in AWS WAF. Associate the web ACL with the endpoint.
Show answer
Correct answer: C, E
A public Application Load Balancer supports sticky sessions and can have an AWS WAF web ACL attached. NLBs and Gateway Load Balancers can't have WAF attached.
Frequently asked questions
What is the difference between ALB, NLB and Gateway Load Balancer?
ALB works at the HTTP/HTTPS layer and routes by path, host name or header. NLB works at the TCP/UDP layer with very low latency and static IPs. Gateway Load Balancer sends traffic through security appliances such as third-party firewalls.
Does a load balancer stop sending traffic to unhealthy instances?
Yes. Health checks test each target regularly, and targets that fail stop receiving new requests. Combined with Auto Scaling, unhealthy instances are also replaced with new ones.
How is Elastic Load Balancing priced?
By the hours each load balancer runs plus capacity units (LCUs for ALB, NLCUs for NLB) that reflect connections, requests and data processed. An unused load balancer still costs hourly, so delete it.
What do AWS exams ask about load balancers?
Choosing ALB, NLB or GWLB for the requirement, attaching an ACM certificate for HTTPS, cross-zone load balancing, sticky sessions, and using NLB when you need static IPs or non-HTTP protocols.