Elastic Load Balancer Types

Choose Layer 7 or Layer 4

An Application Load Balancer (ALB) handles HTTP and HTTPS at Layer 7 and routes by host, path, header, method or query string to target groups. It supports WebSockets, HTTP/2 and gRPC, and targets such as instances, IPs, and Lambda functions.

flowchart LR
  C["Client<br/>HTTPS"] --> L["Listener :443<br/>ALB"]
  L --> R{"Rules<br/>by priority"}
  R -- "/api/*" --> T1["Target group api<br/>port 8080"]
  R -- "host img.example.com" --> T2["Target group images"]
  R -- "default" --> T3["Target group web"]
  T1 --> H["Health checks<br/>per target"]
  %% step C: The client connects to the load balancer's DNS name.
  %% step L: A listener accepts connections on a protocol and port, here HTTPS 443.
  %% step R: Rules are checked in priority order; the first match decides.
  %% step T1: Requests for /api go to the API instances.
  %% step T2: A host-based rule sends a different domain to another group.
  %% step T3: The default action catches everything else.
  %% step H: Each target group checks its own targets and only sends to healthy ones.

The load balancer family

An NLB handles TCP, TLS, and UDP at Layer 4, preserves source IP, and has a static IP per AZ; it fits UDP, millions of requests per second, or partners who allowlist IPs. An ALB uses DNS and does not promise static frontend IPs; always point clients at its DNS name (or a Route 53 Alias), never at resolved IPs. Gateway Load Balancer transparently inserts third-party security appliances into the traffic path.

Building blocks

• Listener — protocol and port, plus rules and a default action (forward, redirect, fixed response).
• Target group — a set of targets plus health check settings; one target group per service.
• Target types — instance, ip (including on-premises IPs and containers), lambda (ALB only), or an ALB behind an NLB.

A common pattern is an HTTP :80 listener that only redirects to HTTPS :443.

Headers and client IPs

Health checks evaluate each target. An ALB adds X-Forwarded-For, X-Forwarded-Proto, and X-Forwarded-Port; applications should use trusted proxy headers instead of logging the LB address. Configure the web server to trust them only from the load balancer.

CLB is the previous generation; new workloads choose ALB or NLB unless maintaining legacy.

Traps: choosing ALB when a partner needs a fixed IP; hard-coding the ALB's IPs; expecting an NLB to route by URL path.