Load Balancing and Auto Scaling
6 pages · ~5 min✓ Reviewed
Builds on RDS and DynamoDB. Next up: Route 53 and CloudFront.
Choosing a Load Balancer: ALB, NLB, GWLB
1. Layers and Jobs
- ALB = Layer 7: HTTP, HTTPS, gRPC, WebSocket
- ALB routes by host, path, header, query string
- ALB can authenticate with Cognito or OIDC
- NLB = Layer 4: TCP, UDP, TLS; millions of req/s, ultra-low latency
- NLB: one static IP per AZ (Elastic IP optional), keeps client source IP
- GWLB = Layer 3: GENEVE on port
6081
- Clienttraffic in
- GWLBtransparent
- Appliance fleetfirewall, IDS/IPS
- Appafter inspection
2. Comparison
| ALB | NLB | GWLB | |
|---|---|---|---|
| Layer | L7 | L4 | L3 |
| Use for | Smart routing, web apps | Raw speed, static IPs, PrivateLink | Inline security appliances |
3. Only One Can
ALB IPs change
Use the ALB DNS name, never hardcode its IPs.
Target Groups and Health Checks
1. Target Groups
- Target group = the set of targets a listener forwards to
- Target types: instance, IP, Lambda (ALB), ALB (as an NLB target)
- One target can sit in several groups
2. Health Checks
- Settings: protocol, path (
/health), port, interval, timeout, success codes (default200) - Healthy / unhealthy threshold = consecutive passes / fails needed to flip state
- Probepath + port
- Fails x thresholdunhealthy
- Out of rotationno traffic
- Passes x thresholdhealthy
- Back in rotationtraffic returns
- All targets unhealthy → LB fails open and routes to all (zonal failover)
- A last-resort fallback, not a fix
3. Draining and Mistakes
- Deregistration delay (default
300s) lets in-flight requests finish - Short requests: lower it, e.g.
30s
Listeners, Rules and Routing
1. Listeners
- Listener = protocol + port the LB checks for connections
- ALB: HTTP, HTTPS
- NLB: TCP, UDP, TLS
- HTTPS listener needs an ACM certificate
2. Rules and Actions
- ALB rule = priority + conditions + action
- Conditions:
host-header,path-pattern,http-header,query-string,source-ip - Lowest number is checked first, default rule last
- Rule 10
- Rule 20
- Default rule
| Action | Use |
|---|---|
forward | weighted target groups: canary, blue-green |
redirect | HTTP 80 to HTTPS 443 |
fixed-response | static reply |
authenticate-cognito / oidc | sign-in first |
Auto Scaling Groups and Launch Templates
1. Launch Template: What to Launch
- AMI, instance type, key pair, security groups
- IAM instance profile and user data
- Versioned: point the ASG at
$Latestor$Default
2. ASG: How Many and Where
- Capacity: min <= desired <= max
- Subnets across several AZs, plus the launch template
- Attached target groups receive new instances
- Health check type ELB, not the default EC2
- So instances failing the load balancer check get replaced
- Set a grace period so boot time is not counted as failure
3. Everyday Commands
bash
aws autoscaling create-auto-scaling-group --auto-scaling-group-name web \ --launch-template LaunchTemplateName=web,Version='$Latest' \ --min-size 2 --max-size 6 --desired-capacity 2 \ --health-check-type ELB --health-check-grace-period 300 aws autoscaling update-auto-scaling-group --desired-capacity 4 aws autoscaling describe-auto-scaling-instances aws autoscaling start-instance-refresh # rolling AMI update
4. Templates vs Launch Configurations
| Launch template |
|---|
Scaling Policies, Cooldowns and Multi-AZ, Cheat Sheet
1. Scaling Policies
| Policy | Trigger | Verdict |
|---|---|---|
| Target tracking | Pick metric + target | Best choice |
| Step scaling | Alarm + step adjustments | Good |
| Simple scaling | Alarm, then cooldown wait | Avoid |
- Target:
ASGAverageCPUUtilization= 50% - For web traffic: ALBRequestCountPerTarget
- ASG creates and manages the alarms; out fast, in slowly
- Step: CloudWatch alarm; CPU 60-70% add 1, above 70% add 3
2. Cooldown and Warmup
- Cooldown (default 300s) blocks the next simple-scaling action
- Target tracking and step use instance warmup, a separate setting
- Warmup keeps new instances out of metrics until ready
3. Multi-AZ and Cheat Sheet
Check yourself
An app on an ASG instance crashes, but the instance keeps running. The ALB marks it unhealthy. The ASG health check type is the default. What happens?
- Nothing: the default type
EC2only checks the instance, so the ASG never replaces it. - Set the health check type to
ELB.
The health check path is /admin, which returns a 302 to a login page. What happens to the targets?
- The default success code is 200, so every healthy target is marked unhealthy.
- With all targets unhealthy, the load balancer fails open and routes to all of them.
- Use a public
/healthpath that returns 200.
Rule priority 10 is /api/* to group A. Priority 20 is /api/v2/* to group B. Where does /api/v2/users go?
- Group A: the lowest number is evaluated first and
/api/*matches. - Give the specific rule the lower number.