Skip to main content
HashnodeAisalkyn's blogAisalkyn's blog

Command Palette

Search for a command to run...

8 day load balancing

Scalability vs. High Availability

Understanding the difference between scalability and high availability is crucial for AWS concepts and certifications. Here's a clear breakdown:

1. Scalability

Definition: The ability of a system to handle an increased load by adding resources.

  • Vertical Scalability (Scaling Up/Down)

    • Example: Upgrading a t2.micro instance to a t2.large.

    • Increases instance size (CPU, RAM).

    • Suitable for non-distributed systems like RDS and ElastiCache.

    • Limitation: Hardware limit on the maximum upgrade.

  • Horizontal Scalability (Scaling Out/In)

    • Example: Adding multiple EC2 instances to handle traffic.

    • Ideal for distributed systems (web servers, app servers).

    • Scale out (add instances) or scale in (remove instances).

2. High Availability (HA)

Definition: Ensures your system remains operational even if one component fails.

  • Achieved by deploying resources in multiple Availability Zones (AZs).

  • Provides failover capability — if one AZ goes down, another handles the load.

  • HA can be:

    • Passive (e.g., RDS Multi-AZ with standby instance).

    • Active (e.g., EC2 instances across multiple AZs actively serving traffic).

Key Differences

AspectVertical ScalingHorizontal ScalingHigh Availability
MethodIncrease instance sizeAdd more instancesDeploy in multiple AZs
Common Use CaseDatabases (e.g., RDS)Web servers, modern appsCritical systems needing uptime
LimitationsHardware limitsRequires app support for distributed architectureRequires AZ-aware architecture

Call Center Analogy

  • Vertical Scaling: Replacing a junior operator with a senior operator (one person handles more calls).

  • Horizontal Scaling: Hiring multiple operators to handle more calls simultaneously.

  • High Availability: Placing operators in different buildings (AZs) so one group remains active if the other fails.

AWS Examples

  • Vertical Scaling: Upgrading an EC2 instance from t2.nano to u-t12tb1.metal.

  • Horizontal Scaling: Adding instances in an Auto Scaling Group behind a Load Balancer.

  • High Availability: Distributing instances across Multiple AZs using an Auto Scaling Group or Load Balancer.

Key Tip for Exams

  • Scalability: Focuses on capacity expansion.

  • High Availability: Focuses on resilience and uptime.

Load Balancing in AWS

What is Load Balancing?

A load balancer is a server (or set of servers) that distributes incoming network traffic across multiple backend servers (EC2 instances).

Why Use a Load Balancer?

✅ Distributes traffic efficiently across multiple instances.
✅ Ensures high availability by automatically bypassing unhealthy instances.
✅ Provides a single point of access for your application.
✅ Supports SSL termination, stickiness, and public/private traffic separation.
✅ Integrated with various AWS services for scalability and monitoring.

Types of AWS Load Balancers

Load BalancerProtocols SupportedRecommended Use
Classic Load Balancer (CLB)HTTP, HTTPS, TCP, SSLLegacy use (deprecated)
Application Load Balancer (ALB)HTTP, HTTPS, WebSocketBest for web applications
Network Load Balancer (NLB)TCP, TLS, UDPBest for high-performance, low latency
Gateway Load Balancer (GWLB)IP Protocol (Layer 3)Best for virtual appliances like firewalls

🔹 ALB – Ideal for dynamic web apps (supports URL-based routing).
🔹 NLB – Ideal for performance-critical applications.
🔹 GWLB – Ideal for managing network appliances.

Health Checks

Health checks ensure that the load balancer only routes traffic to healthy instances.

  • Protocol: Typically HTTP

  • Port: E.g., 4567

  • Path: E.g., /health

  • Instances failing health checks are marked unhealthy, preventing traffic from reaching them.

Security Best Practices

  1. Load Balancer Security Group:

    • Allow port 80 (HTTP) and port 443 (HTTPS) from 0.0.0.0/0 (open to the internet).

  2. EC2 Security Group:

    • Allow port 80 (HTTP) only from the load balancer’s security group (not from 0.0.0.0/0).

Key Concepts for Exam Preparation

  • Scaling Integration: Combine load balancers with Auto Scaling Groups for seamless scalability.

  • Internal vs External Load Balancer: Choose internal for private apps and external for public-facing services.

  • SSL Termination: Offloads SSL certificate management to the load balancer for enhanced security.

Key Tip for AWS Exams

💡 Use Application Load Balancer for web apps and Network Load Balancer for performance-intensive workloads.
💡 Remember the security group linking concept for secure traffic control

Application Load Balancer (ALB) in AWS

What is an Application Load Balancer (ALB)?

An ALB is a Layer 7 (HTTP/HTTPS) load balancer designed for modern web applications, offering intelligent routing capabilities.

Key Features of ALB

✅ Path-based routing – Route traffic based on URL paths like /users or /posts.
✅ Host-based routing – Route traffic based on hostnames like one.example.com or other.example.com.
✅ Query string and header routing – Direct traffic based on query parameters or custom headers.
✅ Container and ECS support – ALB can route to dynamic ports for ECS tasks.
✅ HTTP/2 and WebSocket support – Modern protocols for improved performance.
✅ SSL Redirection – Automatically redirect HTTP traffic to HTTPS.
✅ Multiple Applications on One ALB – Reduces costs by routing different services via the same ALB.

Target Groups in ALB

A target group is a logical grouping of:

  • EC2 instances (e.g., web servers).

  • ECS tasks (for containerized applications).

  • Lambda functions (for serverless architecture).

  • Private IP addresses (e.g., for on-premises servers).

✅ Health checks are performed at the target group level to ensure only healthy instances receive traffic.

Example ALB Configuration

  • Route 1: /users → Target Group 1 (User Application)

  • Route 2: /search → Target Group 2 (Search Application)

  • Both services operate behind the same ALB.

Client IP and Headers

Since ALB performs connection termination, the backend EC2 instances don't directly see the client IP. Instead, the real client IP is passed via HTTP headers:

  • X-Forwarded-For → Client IP

  • X-Forwarded-Port → Client's port

  • X-Forwarded-Proto → Protocol used (HTTP/HTTPS)

🔹 Example:

  • Client IP: 12.34.56.78

  • ALB IP forwards traffic to EC2 instances, and the original client IP is preserved via X-Forwarded-For.

Security Best Practices

  • ALB Security Group: Open port 80 (HTTP) and port 443 (HTTPS) to 0.0.0.0/0.

  • EC2 Security Group: Only allow incoming traffic from the ALB Security Group for enhanced security.

Key Tip for Exams

💡 Use ALB for routing to multiple microservices behind a single load balancer.
💡 Use path-based routing or host-based routing to efficiently manage complex web architectures.

Key Takeaways: Load Balancer Advanced Concepts

1. Network Security with Security Groups

✅ Restrict Direct Access to EC2 Instances

  • Step 1: Go to the EC2 Security Group.

  • Step 2: Edit inbound rules.

  • Step 3: Remove the existing HTTP rule that allows traffic from "Anywhere".

  • Step 4: Add a new rule allowing HTTP traffic only from the Load Balancer’s Security Group.

Result:
✅ Direct access to EC2 instances via public IP will now be blocked.
✅ Access through the Load Balancer will still work.

2. Application Load Balancer (ALB) Rules

✅ Custom Routing Rules for Traffic Control

  • Step 1: Go to the ALB’s Listener section.

  • Step 2: Add a new rule and provide conditions.

  • Step 3: Example Conditions:

    • Path-based Routing — e.g., /error

    • Host-based Routing — e.g., myapp.example.com

    • HTTP Method Filtering — e.g., GET or POST

  • Step 4: Select the desired Action:

    • Forward traffic to a specific target group.

    • Redirect to a URL.

    • Return a Fixed Response like 404 Not Found.

Result:
✅ Improved security and traffic control.
✅ Custom error pages or content-specific routing.

Best Practices for Load Balancer Security

✅ Use HTTPS instead of HTTP.
✅ Enable WAF (Web Application Firewall) for added security.
✅ Regularly audit security groups to ensure least privilege access.

This guide outlines the step-by-step process for setting up an Application Load Balancer (ALB) in AWS to distribute traffic across two EC2 instances. Here's a summarized checklist for your reference:

Step 1: Launch Two EC2 Instances

  • Go to Launch Instances.

  • Set the name of the first instance as My First Instance.

  • Use Amazon Linux 2 with t2.micro instance type.

  • Proceed without a key pair; use EC2 Instance Connect if needed.

  • Use an existing security group called Launch Wizard 1 that allows HTTP and SSH traffic.

  • Add EC2 User Data script for automated instance setup.

  • Launch both instances and rename the second one as My Second Instance.

#!/bin/bash
# Update the package list
apt update -y

# Install Apache
apt install apache2 -y

# Create a simple web page
echo "<h1>Hello World from $(hostname)</h1>" > /var/www/html/index.html

# Start and enable Apache to launch at boot
systemctl start apache2
systemctl enable apache2

Step 2: Verify EC2 Instances

  • Copy the IPv4 addresses of both instances.

  • Visit the IP addresses to confirm you see the "Hello World" page for each instance.

Step 3: Create an Application Load Balancer (ALB)

  • Go to Load Balancers and select Application Load Balancer.

  • Name it DemoALB.

  • Set the scheme to Internet-facing and address type to IPv4.

  • Deploy the load balancer across all availability zones.

  • Create a new security group called demo-sg-load-balancer that allows HTTP traffic only.

Step 4: Configure Listeners and Routing

  • Set the listener for HTTP on port 80.

  • Create a Target Group named demo-tg-alb:

    • Set protocol to HTTP and port to 80.

    • Register both EC2 instances as targets.

  • Link the target group to your load balancer's listener.

Step 5: Final Steps

  • Create the load balancer and wait for it to become active.

  • Copy the DNS name of the load balancer and test it in a browser.

  • Refresh the page to observe load balancing in action.

Step 6: Testing Failover

  • Stop one of the EC2 instances and check the Target Group to see its status change to Unhealthy.

  • Refresh the load balancer URL to confirm that only the healthy instance is serving traffic.

  • Restart the stopped instance and confirm it returns to a Healthy state in the target group.

✅ Key Learning Points

  • ALB effectively balances traffic between healthy instances.

  • Target Groups ensure proper health checks and failover capabilities.

Key Concepts Covered in Advanced Load Balancer Setup

This guide covers two essential improvements for your Application Load Balancer (ALB):

1️⃣ Restrict Direct Access to EC2 Instances

Objective: Only allow traffic to reach your EC2 instances through the ALB for improved security.

Steps:

  1. Go to AWS Console → EC2 → Security Groups.

  2. Find the launch-wizard-1 security group used by your EC2 instances.

  3. In the Inbound Rules tab:

    • Delete the existing HTTP rule that allows traffic from 0.0.0.0/0.

    • Add New Rule:

      • Type: HTTP

      • Source: Select Custom → Choose the Security Group ID of your ALB (e.g., demo-sg-load-balancer).

  4. Click Save Rules.

Result:

✅ Access to your EC2 instances via their public IP will now be blocked.
✅ Access via the Load Balancer DNS will still work.

2️⃣ Add Custom Rules to the Load Balancer Listener

Objective: Implement routing logic using custom rules (e.g., /error triggers a custom error page).

Steps:

  1. Go to Load Balancers in AWS.

  2. Select your ALB → Under Listeners, click on the listener for port 80.

  3. In the Rules section, click Add Rules.

  4. Add the following:

    • Condition: Path → /error

    • Action: Return a fixed response

      • Status Code: 404 - Not Found

      • Content Type: text/plain

      • Response Body: "Not Found. Custom Error"

  5. Set Priority to 5.

  6. Click Next, then Save Rule.

Result:

✅ Requests to http://<ALB-DNS>/error will return:

Not Found. Custom Error

Summary of Key Benefits

✅ Improved Security by restricting direct EC2 access.
✅ Enhanced User Experience by handling custom paths with rules.
✅ Flexible Routing Options for scaling multi-application environments.

Key Concepts of Network Load Balancer (NLB)

The Network Load Balancer (NLB) is designed for Layer 4 (TCP/UDP) traffic and is ideal for handling high-performance scenarios.

1️⃣ Key Features of Network Load Balancer

✅ Layer 4 Load Balancer – Operates at the transport layer, ideal for TCP and UDP traffic.
✅ Extreme Performance – Can handle millions of requests per second with ultra-low latency.
✅ Static IP Support – Assigns one static IP per AZ, or you can attach Elastic IPs for better control.
✅ Cross-Zone Load Balancing – Distributes traffic evenly across all registered targets in multiple AZs.
✅ Target Types: Supports:

  • EC2 Instances

  • Private IP Addresses (e.g., on-premises servers)

  • Application Load Balancer as a target for enhanced flexibility.

2️⃣ When to Use a Network Load Balancer

🟠 When you need to handle TCP or UDP traffic.
🟠 When your application demands high throughput and low latency.
🟠 When you require static IP addresses for your application.
🟠 When integrating on-premises servers via Private IPs.

3️⃣ Health Check Protocols in NLB

✅ Supports:

  • TCP

  • HTTP

  • HTTPS

Even though NLB operates at Layer 4, it can still perform HTTP/HTTPS health checks.

4️⃣ Common Use Case: Combining NLB with ALB

🔥 Use NLB in front of an ALB to:

  • Gain fixed IP addresses for clients.

  • Maintain complex routing rules via ALB for HTTP/HTTPS traffic.

5️⃣ Important Exam Tips

✅ TCP/UDP traffic? → Use Network Load Balancer
✅ Need Static IPs? → Use Network Load Balancer
✅ Extreme Performance & Ultra-low Latency? → Use Network Load Balancer
✅ Complex HTTP rules with static IPs? → Combine NLB with ALB

🚀 Quick Setup Steps for NLB

  1. Go to Load Balancers → Create Load Balancer.

  2. Select Network Load Balancer.

  3. Set the scheme to Internet-facing or Internal.

  4. Assign Elastic IPs for each AZ (recommended for static IPs).

  5. Create a Target Group for your backend instances (choose TCP or UDP).

  6. Register your EC2 Instances or Private IPs as targets.

  7. Configure Listener Rules to forward traffic to your target group.

  8. Deploy the NLB and test using the assigned DNS name or Elastic IP.

Step-by-Step Guide: Creating a Network Load Balancer (NLB) in AWS

This guide outlines how to create a Network Load Balancer (NLB), set up proper security groups, and troubleshoot common issues.

1️⃣ Create a Network Load Balancer

Steps:

  1. Go to AWS Console → EC2 → Load Balancers.

  2. Click Create Load Balancer → Select Network Load Balancer.

  3. Name it DemoNLB.

  4. Scheme: Choose Internet-facing.

  5. IP Address Type: Select IPv4.

  6. Network Mapping:

    • Select your VPC.

    • Choose all available subnets (each represents an Availability Zone).

    • Use Elastic IPs for static IPs (optional but recommended).

2️⃣ Create a Security Group for NLB

  1. Go to Security Groups.

  2. Click Create Security Group.

  3. Name it demo-sg-nlb.

  4. Inbound Rules:

    • Type: HTTP

    • Port: 80

    • Source: Anywhere (0.0.0.0/0)

  5. Outbound Rules: Leave default settings.

  6. Attach this security group to your Network Load Balancer.

3️⃣ Configure Listener and Target Group

Create Target Group:

  1. Go to Target Groups → Click Create Target Group.

  2. Name it demo-tg-nlb.

  3. Target Type: Select Instances.

  4. Protocol: Choose TCP on port 80.

  5. Select the VPC where your instances are running.

  6. Health Check Protocol: Choose HTTP for health checks.

  7. Set:

    • Healthy Threshold = 2

    • Timeout = 2 seconds

    • Interval = 5 seconds

  8. Click Next and register your two EC2 instances as targets.

  9. Click Create Target Group.

Attach Target Group to NLB:

  1. Go back to your Network Load Balancer.

  2. Select the NLB you created.

  3. Under Listeners, click Add Listener.

  4. Set:

    • Protocol: TCP

    • Port: 80

  5. Forward requests to your newly created Target Group (demo-tg-nlb).

  6. Click Save.

4️⃣ Update EC2 Security Group

Your EC2 instances may still be blocking the NLB's traffic. To fix this:

  1. Go to your EC2 Instance.

  2. Find the Launch Wizard Security Group used by your instances.

  3. Click Edit Inbound Rules.

  4. Add a new rule:

    • Type: HTTP

    • Port Range: 80

    • Source: Select demo-sg-nlb (Your NLB's Security Group).

  5. Click Save Rules.

5️⃣ Testing

  1. Go to your NLB in the AWS Console.

  2. Copy the DNS Name.

  3. Paste it into your browser:

     http://<NLB-DNS-Name>

  4. Refresh multiple times — you should see alternating IPs or Hello World messages from both instances.

6️⃣ Troubleshooting

❗️ If instances show as Unhealthy:

  • Verify that your EC2 security group allows HTTP traffic from the NLB.

  • Confirm the Health Check Path matches the web server’s root path (/).

  • Ensure the Target Group is linked to the correct NLB Listener.

7️⃣ Clean-Up (To Avoid Extra Costs)

  • Delete the NLB.

  • Optionally delete the:

    • Target Group.

    • NLB Security Group.

✅ Key Learnings

  • NLB is ideal for TCP/UDP traffic and provides static IPs.

  • It supports high-performance use cases with low latency.

  • Security group adjustments are crucial for ensuring successful communication.

Gateway Load Balancer (GWLB) Explained

The Gateway Load Balancer (GWLB) is a specialized load balancer in AWS designed for network traffic inspection and security appliances.

1️⃣ Key Features of Gateway Load Balancer

✅ Layer 3 Load Balancer – Operates at the IP packet level.
✅ Transparent Traffic Flow – Acts as a single entry and exit point for your VPC traffic.
✅ Supports GENEVE Protocol – Uses port 6081 for communication with appliances.
✅ Ideal for Security Solutions – Integrates seamlessly with third-party firewalls, intrusion detection systems (IDS/IPS), and deep packet inspection (DPI) tools.
✅ Highly Scalable – Distributes traffic across multiple security appliances in a Target Group.

2️⃣ When to Use a Gateway Load Balancer

🟠 When you need to route all incoming VPC traffic through security appliances for inspection.
🟠 When integrating third-party solutions like:

  • Firewall

  • Intrusion Detection/Prevention Systems (IDS/IPS)

  • Deep Packet Inspection (DPI) 🟠 When ensuring secure traffic filtering before requests reach your ALB or backend instances.

3️⃣ How Gateway Load Balancer Works

  1. Users send requests to your application.

  2. The VPC Route Table redirects this traffic to the Gateway Load Balancer.

  3. The GWLB:

    • Distributes traffic across registered security appliances (target group).

    • The appliances inspect the traffic for security threats.

    • If the traffic is clean, it’s forwarded back to the GWLB.

    • If the traffic is malicious, it may be dropped by the appliance.

  4. The GWLB sends the approved traffic to the backend Application Load Balancer (ALB) or directly to your EC2 instances.

4️⃣ Target Groups for GWLB

✅ EC2 Instances (registered by Instance ID).
✅ Private IP Addresses (ideal for on-premises appliances).

5️⃣ Key Exam Tips

✅ GENEVE Protocol (Port 6081) → Gateway Load Balancer
✅ Traffic Inspection Requirement → Gateway Load Balancer
✅ Firewall or IDS/IPS Integration → Gateway Load Balancer
✅ Layer 3 (IP Level) Traffic Handling → Gateway Load Balancer

🚀 Summary

The Gateway Load Balancer simplifies network security by integrating security appliances directly into your VPC. It’s the ideal solution for ensuring all network traffic undergoes deep inspection before reaching critical resources.