Load balancing & DNS · Prasanta Kumar Behera

Get traffic to your services on AWS: when to use an Application or Network Load Balancer, target groups and health checks, TLS with ACM, and Route 53 records, aliases and routing policies for failover and gradual migrations.

ALB vs NLB

	Application LB (ALB)	Network LB (NLB)
Layer	7 (HTTP/HTTPS, gRPC, WebSockets)	4 (TCP, UDP, TLS)
Routing	Host, path, headers, methods, weights	Port-based
TLS	Terminates (ACM certificates)	Pass-through, or TLS termination
Static IPs	No	Yes (one Elastic IP per AZ)
Client IP	`X-Forwarded-For` header	Preserved for instance targets; PROXY protocol v2 option
Extras	WAF integration, OIDC authentication	Very high throughput, low latency

An ALB is a hotel receptionist who reads your booking ("conference room B, 3rd floor") and sends you to the right place. An NLB is a traffic light at the car park: it doesn't read anything, just sends cars through quickly, and always stays at the same address. Route 53 is the city's address book that tells everyone how to find the hotel.

Target groups and health checks

A load balancer sends traffic to target groups: instances, IP addresses (e.g. pods), or Lambda functions. Health checks decide which targets receive traffic:

$ aws elbv2 describe-target-health --target-group-arn arn:aws:elasticloadbalancing:…:targetgroup/web/…
TargetHealth: {State: unhealthy, Reason: Target.ResponseCodeMismatch, Description: "Health checks failed with these codes: [404]"}

The Reason is usually enough: wrong path, wrong port, security group blocking the LB, or an app that isn't ready. Point health checks at a real readiness endpoint (/healthz), not /.

Cross-zone load balancing spreads traffic evenly across all targets in all AZs. It's on by default for ALB, off by default for NLB (and cross-AZ traffic can cost money).

TLS with ACM

AWS Certificate Manager issues free public certificates for use with ALB/NLB/CloudFront and renews them automatically (DNS validation via Route 53 is easiest). ACM certificates can't be exported to your own servers; for those, use cert-manager (see Kubernetes Security, lesson 02).

Route 53

Hosted zones: public (internet) or private (attached to VPCs).
Alias records: point names, including the apex (example.com), at load balancers, CloudFront and other AWS targets.
Routing policies:

Policy	Use
Simple	One answer
Weighted	Gradual migrations and canaries (90/10 between old and new)
Failover	Primary/secondary with health checks
Latency	Nearest region for the user
Geolocation	By user location (compliance, content)

TTL controls how long resolvers cache answers. Lower it before a planned migration, then raise it again.

Try it: ALB, NLB and DNS (sandbox account)

Behind the ASG from lesson 03, create an ALB with a target group and health check on /. Break the health check path (/nope) and read the target health reason; fix it.
Request an ACM certificate for a test domain (if you have one in Route 53, use DNS validation) and add an HTTPS listener.
Create an NLB with an Elastic IP in each AZ, pointing at the same instances on port 80. Compare dig results for the ALB and NLB DNS names over a few minutes.
Create weighted records (90/10) between two endpoints and query them repeatedly.
Delete everything afterwards (load balancers and EIPs cost money).

Going deeper: edges on AWS

For Kubernetes, the AWS Load Balancer Controller creates ALBs/NLBs from Ingress, Gateway and Service objects, with IP targets pointing straight at pods (see Amazon EKS in Production).
Put AWS WAF on public ALBs for common attack patterns and rate limiting; Shield adds DDoS protection.
Use deregistration delay and readiness to drain connections during deployments.
For global applications, CloudFront or Global Accelerator in front of regional load balancers improves latency and failover.

Recap

ALB = L7 routing and TLS; NLB = L4, static IPs, extreme throughput.
Target groups + health checks; the target health reason explains failures.
ACM for managed, auto-renewing certificates on AWS load balancers.
Route 53: aliases at the apex, weighted and failover routing, and TTLs managed around changes.

This site is a public version of my personal engineering knowledge hub. It intentionally excludes confidential company information and internal operational details.