sdlc.dev

AWS fundamentals path · The network · Topic 7 of 18

Load balancing: ALB, NLB and health checks

Not started

Elastic Load Balancing puts one stable entry point in front of many targets (instances, containers, IP addresses or Lambda functions), spreads requests across them, and stops sending traffic to targets that fail **health checks**. It runs as nodes in each zone you enable, so the balancer itself survives the loss of a zone, provided your targets are also spread across zones.

Why it matters: The load balancer is where users meet your system. Its health checks decide which targets get traffic, and badly tuned ones turn a small fault into an outage.

  1. 1ALB speaks HTTP

    An Application Load Balancer works at layer 7: it routes by host, path and headers, terminates TLS and supports HTTP/2, gRPC and WebSockets.

  2. 2NLB moves connections

    A Network Load Balancer works at layer 4 with TCP, UDP and TLS, has a static IP per zone, and adds very little latency.

  3. 3Health checks pick targets

    Targets that fail UnhealthyThresholdCount checks in a row stop getting new requests until they pass HealthyThresholdCount checks.

  4. 4All unhealthy means fail open

    If every target fails its health checks, the load balancer sends traffic to all of them anyway, rather than to none.

1

How it works

The explanation, with examples you can run.

Which one

Application Load BalancerNetwork Load Balancer
Layer7 (HTTP, HTTPS, gRPC, WebSockets)4 (TCP, UDP, TLS)
RoutingHost, path, headers, query strings, methodsPort and protocol only
AddressesDNS name; IPs can changeStatic IP per zone, optional Elastic IP
Typical useWeb apps and APIs, several services behind one nameNon-HTTP protocols, very high connection rates, fixed IPs for allow-lists

A Gateway Load Balancer also exists, for inserting third-party firewalls and appliances into traffic. Both ALB and NLB support security groups now, so the target's group can admit only the balancer's group.

Health checks

The balancer probes each registered target on a port and path you choose:

HealthCheckPath            /healthzHealthCheckIntervalSeconds 30   # default for instance and ip targetsHealthCheckTimeoutSeconds  5UnhealthyThresholdCount    2    # consecutive failures before out of serviceHealthyThresholdCount      5    # consecutive successes before back in serviceMatcher                    200  # HTTP codes that count as healthy

With these defaults, a target that dies keeps receiving traffic for up to about a minute, and a recovered one waits about two and a half minutes before it gets traffic again. Tighter intervals react faster but generate more probe load.

What the health check should test matters more than its timing. A check that queries a shared database marks every target unhealthy when the database is slow. The ALB then fails open and sends traffic to all targets regardless, which is better than nothing, but you have lost the ability to route around a genuinely broken instance. Keep the check about the target itself (is the process up and able to serve), and handle dependency failures in the application, for example with timeouts and degraded responses.

Other settings that matter

  • Deregistration delay (default 300 seconds) keeps in-flight requests going while a target is removed. Lower it for short requests so deploys are not slowed for minutes; make sure your app drains on SIGTERM within it.
  • Cross-zone load balancing is on for ALBs, off by default for NLBs; with it off, each zone's node only uses targets in its own zone, so uneven target counts give uneven load.
  • Slow start ramps traffic to new targets gradually, useful for apps with cold caches or JIT warm-up.
  • Idle timeout (60 seconds by default on ALB) closes quiet connections; keep your server's keep-alive timeout longer than it, or clients will see occasional 502s.
2

Check yourself

3 questions. Get them all right to finish this topic.

  1. 1.You need path-based routing (/api to one service, /static to another) and TLS termination. Which load balancer?
  2. 2.Your ALB health check calls /health, which queries the database. The database slows down and every target fails. What does the ALB do?
  3. 3.With ALB defaults for instance targets, roughly how long until a dead target stops getting traffic?

0 of 3 right so far. Get all three to finish this topic.

Go deeper