Scalability & Elastic Load Balancers

Availability & Scalability

Scalability is the ability of a system to handle greater load by adapting.

High Availability (HA) means running your application in at least 2 Availability Zones, so it survives the loss of a data center.

Vertical vs Horizontal Scaling

Elastic Load Balancers (ELB) Overview

An ELB distributes incoming traffic across multiple downstream targets (EC2, containers, IP addresses) across multiple AZs.

Application Load Balancer (ALB) — Layer 7

• Ideal for: Microservices, container based apps (Docker), web applications.
• Protocols: HTTP, HTTPS, HTTP/2, WebSocket, gRPC.

Listeners & Rules

An ALB is “smart”: one listener can route to many target groups. A single listener on port 443 can send traffic to different backends based on rules.

Target Groups can point at: EC2 instances, ECS tasks, Lambda functions, and private IP addresses.

Network Load Balancer (NLB) — Layer 4

• Ideal for: Real time data, gaming, finance, raw TCP/UDP traffic.
• Protocols: TCP, UDP, TCP_UDP, TLS.
• Performance: Millions of requests per second at ultra low latency.

Key Features

• Static IP: NLB gives you one static IP per AZ. An ALB does not — it only gives you a DNS name.
• Cross-Zone Load Balancing: Disabled by default (to save cost). You must enable it.
• One listener → one target group: NLB is a pass through. It does not inspect paths or headers.

NLB in Front of an ALB

Pattern: Client → NLB → ALB → EC2. Two reasons this shows up on the exam:

1. You need a fixed static IP (an NLB feature) and HTTP path based routing (an ALB feature).
2. You want to use AWS PrivateLink, which requires an NLB, to expose a web app sitting behind an ALB.

Gateway Load Balancer (GLB) — Layer 3

• Use Case: Deploying, scaling, and managing 3rd party virtual appliances — firewalls, IDS/IPS, deep packet inspection.
• Flow:
  1. Traffic enters the VPC.
  2. The route table sends it to the GLB Endpoint.
  3. GLB forwards it to the 3rd party appliance.
  4. The appliance inspects it and sends it back.
  5. Traffic continues to the application.
• Protocol: GENEVE on port 6081.
• Transparent: Source and destination IPs are preserved, so the application still sees the original client IP.

Key ELB Features & Mechanics

Sticky Sessions (Session Affinity)

Ensures a client always reconnects to the same backend instance.

Cross-Zone Load Balancing

• Without it: Traffic is split evenly between AZs, not instances. If AZ A has 1 instance and AZ B has 9, that single instance gets 50% of all traffic.
• With it: Traffic is split evenly across all instances, regardless of AZ.

SSL/TLS Certificates & SNI

• SSL Termination: The load balancer handles encryption/decryption, offloading that CPU work from your EC2 instances.
• SNI (Server Name Indication):
  • Problem: One ALB listener on port 443, but multiple domains (a.com, b.com) each with their own certificate.
  • Solution: The client states which hostname it wants during the TLS handshake, and the ALB loads the correct certificate for it.

Connection Draining (Deregistration Delay)

When an instance is marked unhealthy or is scaling in:

1. The ELB stops sending it new requests.
2. It waits for existing in-flight requests to finish.
3. That wait is the deregistration delay, defaulting to 300 seconds.

The instance shows as Draining during this window. This is what prevents users seeing “Connection Reset” during a deployment or scale in.

Advanced Exam Scenarios

Client IP Preservation (X-Forwarded-For)

• Problem: When an ALB forwards traffic, the EC2 instance sees the ALB’s private IP as the source, not the user’s.
• Solution: The application reads the X-Forwarded-For header for the real client IP. X-Forwarded-Port and X-Forwarded-Proto give you the original port and protocol.
• NLB: Preserves the client IP automatically when the target type is Instance ID. If the target type is IP address, you must enable preservation manually.

Security Group Chaining

To guarantee nobody bypasses the load balancer and hits EC2 directly:

1. ALB security group: Allow inbound HTTP/HTTPS from 0.0.0.0/0.
2. EC2 security group: Allow inbound HTTP only from the ALB’s Security Group ID.

Never use IP ranges for the EC2 SG here — always reference the ALB’s SG ID.

Weighted Target Groups (Blue/Green)

Assign weights to target groups on a single listener to shift traffic gradually. Start V1 (blue) at 90% and V2 (green) at 10%, watch the error rate, then move to 50/50 and finally 0/100.

WAF Integration

• ALB: Supports WAF natively — attach a Web ACL to block SQL injection or XSS.
• NLB: Does not support WAF. Put CloudFront or an ALB in front of it.

Access Logs

ELBs can capture client IP, latency, request path, and response codes.

• Storage: An S3 bucket.
• Requirement: A bucket policy allowing the ELB service to write. Not enabled by default.

Slow Start Mode

When a new target joins the group, the LB ramps traffic to it linearly instead of all at once — this stops a cold instance from being overwhelmed before its caches warm up.