Elastic Load Balancing spreads traffic across healthy targets so a single server failure does not take your application down. AWS offers three current load balancer types (plus the retired Classic Load Balancer), and they solve different problems. Choosing well affects features, latency and your bill.
The quick comparison
| Application LB | Network LB | Gateway LB | |
|---|---|---|---|
| OSI layer | 7 (HTTP/HTTPS, gRPC, WebSocket) | 4 (TCP, UDP, TLS) | 3 (IP packets, GENEVE) |
| Routing by | Host, path, headers, query, method, source IP | Port and protocol | Sends all traffic to appliances |
| Static IP | No (DNS name; use Global Accelerator for static IPs) | Yes, one per AZ, Elastic IPs supported | n/a |
| Targets | Instances, IPs, Lambda | Instances, IPs, an ALB | Virtual appliances |
| Client IP preserved | In X-Forwarded-For header | Yes, natively (for instance targets) | Yes |
| Typical use | Web apps, APIs, microservices | Extreme performance, non-HTTP, PrivateLink | Firewalls, IDS/IPS inspection |
Application Load Balancer (ALB)
The ALB understands HTTP. That lets it make smart decisions per request:
- Path-based routing:
/api/*to the API service,/images/*to the media service. - Host-based routing:
shop.example.comandadmin.example.comon one load balancer. - Weighted target groups for blue/green and canary releases.
- TLS termination with free ACM certificates, redirects from HTTP to HTTPS, fixed responses, and authentication with Cognito or an OIDC provider.
- AWS WAF integration to block common web attacks and rate-limit abusive clients.
- Lambda targets for serverless backends.
Choose the ALB for almost any web application or HTTP API.
Network Load Balancer (NLB)
The NLB works on connections, not requests. It is built for very high throughput and low latency and keeps a connection pinned to one target for its lifetime. Pick it when you need:
- Static IPs per AZ, for example because a partner allow-lists your addresses.
- Non-HTTP protocols: databases, MQTT, game servers, SMTP, custom TCP or UDP.
- Client IP preservation without parsing headers.
- AWS PrivateLink: to publish a service to other VPCs or accounts privately, the service must sit behind an NLB.
NLBs also support security groups now, and can terminate TLS, but they do not route by path or host.
Gateway Load Balancer (GWLB)
The GWLB is for a specific job: inserting third-party network appliances (firewalls, intrusion detection, deep packet inspection) transparently into traffic flows. It distributes packets across a fleet of appliances using the GENEVE protocol, and you route traffic to it through Gateway Load Balancer endpoints in your route tables. If you are not deploying virtual appliances, you do not need it.
Health checks: the feature that keeps you up
Each target group runs health checks and only sends traffic to healthy targets. Get them right:
- Use a dedicated endpoint like
/healththat checks the app can serve requests, but not every downstream dependency (or one slow database takes the whole fleet out of rotation). - Tune the healthy and unhealthy thresholds and interval for how fast you need to react.
- The target's security group must allow the health check from the load balancer.
- Combine with Auto Scaling group health checks of type ELB so failed instances are replaced, not just ignored.
Cross-zone load balancing
With cross-zone load balancing, each load balancer node spreads traffic across targets in all enabled AZs, not just its own. It is always on for ALBs and off by default for NLBs (where cross-AZ traffic is billed). If an NLB's AZs have uneven target counts, traffic will be uneven unless you enable it.
Pricing in brief
All three bill per hour plus a usage dimension measured in capacity units (LCUs for ALB, NLCUs for NLB, GLCUs for GWLB) based on new connections, active connections, processed bytes and, for ALB, rule evaluations. A single ALB with many listener rules is usually cheaper than many small ALBs.
Design examples
- E-commerce web app: ALB with HTTPS, WAF, path routing to two ECS services.
- IoT ingestion over MQTT: NLB with TLS listener in front of broker instances.
- SaaS exposing a private API to customers: NLB plus a PrivateLink endpoint service.
- Centralized inspection VPC: GWLB in front of a firewall fleet, with endpoints in each spoke.
Practice it
Build an ALB with Auto Scaling in Build a Scalable Web Application Using ALB and Auto Scaling Group, route by path in Path-Based Microservices Behind One ALB, and publish a private service in AWS PrivateLink: Publish a Service Behind an NLB. Debug a real outage in API Returns 503 Service Unavailable.
FAQ
What does a 502 or 503 from an ALB mean?
503 usually means no healthy targets are registered. 502 means a target returned an invalid response or closed the connection. 504 means the target did not answer within the idle timeout.
Can I put an NLB in front of an ALB?
Yes, ALB-type target groups let an NLB forward to an ALB. It combines static IPs or PrivateLink with layer 7 routing.
Should I still use the Classic Load Balancer?
No. It is a previous generation; migrate to ALB or NLB.