Elastic Load Balancing
Managed load balancer that spreads incoming traffic across healthy targets in multiple Availability Zones.
Verified against AWS documentation · 2026-09-09
Key facts
- 01One DNS name in front of many targets — health checks decide who gets traffic, unhealthy targets are skipped automatically
- 02ALB = Layer 7 (HTTP/HTTPS), routes on path, host, or header. NLB = Layer 4 (TCP/UDP/TLS), extreme performance, static IP per AZ
- 03GWLB = Layer 3 gateway that fronts third-party firewall and inspection appliances. CLB = previous generation
- 04Regional, not global: you enable AZs and ELB puts a node in each. Auto Scaling registers and deregisters instances for you; ACM certs terminate HTTPS at the load balancer
- 05Reality check: CLB inside a VPC still runs and isn't retired, but AWS labels it previous generation and recommends migrating — treat it as the legacy option, never the right answer for a new build
Exam triggers
Phrases and scenarios that point here.
- "Distribute traffic", "single point of contact", "survive an AZ failure" → ELB across multiple AZs
- Route /api and /images to different backends, or host-based routing for microservices → ALB
- "Static IP for partner allow-listing", "millions of requests per second", "UDP", "lowest latency" → NLB
- All traffic must pass a third-party firewall appliance before reaching workloads → GWLB
Not this service
- Add or remove capacity as demand changes → EC2 Auto Scaling (ELB spreads traffic, it never creates servers)
- Cache and serve content close to users at the edge → CloudFront
Use cases
- 01Public web app where an internet-facing ALB fronts an Auto Scaling group spanning two AZs — one instance dies and users never notice
- 02Three-tier setup: internet-facing ALB for the web tier, internal ALB for the app tier, so app servers never need a public IP
- 03Path-based routing where /api, /admin, and /static hit different target groups behind one domain and one certificate
- 04Game server or IoT broker on raw TCP/UDP where partners need a fixed IP to allow-list in their own firewall → NLB
- 05Rolling deploys: new instances register and start taking traffic once health checks pass, old ones drain in-flight connections before shutdown
How it's charged
- 01Two parts: a flat hourly charge per load balancer (partial hours round up to a full hour) plus capacity units metered per minute
- 02Capacity units are LCU (ALB), NLCU (NLB), GLCU (GWLB) — you pay only for the single highest dimension in the hour (new connections, active connections, processed bytes, plus rule evaluations on ALB), not the sum of them
- 03CLB is the exception: hourly plus per-GB of data processed, no capacity units
- 04An idle load balancer with zero traffic still bills its hourly charge — forgotten test ALBs quietly reappear on the bill every month
- 05Public IPv4 addresses and standard data transfer are billed separately, on top of the ELB line item
