Night 11 — ELB theory (ALB vs NLB vs GWLB)

~2 hr, no AWS spend. Theory + paper diagram + quiz. Study VPC from Nights 9–10 stays up for Night 12.

Block 1 (~50 min) — Which load balancer when?

Decision tree (memorize)

What are you balancing?
│
├─ HTTP/HTTPS web app or API (path/host routing, WAF, Cognito)?
│     → Application Load Balancer (ALB) — Layer 7
│
├─ Raw TCP/UDP/TLS passthrough, static IP, ultra-low latency, millions RPS?
│     → Network Load Balancer (NLB) — Layer 4
│
└─ Inline third-party firewall/IDS/IPS appliances (GENEVE)?
      → Gateway Load Balancer (GWLB) — NOT for general apps

ALB — Application Load Balancer (Layer 7)

Not for: non-HTTP protocols (raw MQTT, custom TCP game protocol) — use NLB.

Exam traps:

• ALB terminates TLS or passes through (HTTPS listener → HTTP target is common).
• ALB is Regional — one per Region; use Route 53 for multi-Region.
• Cross-zone load balancing is on by default (can disable to save cross-AZ data charges).
• Sticky sessions — duration-based cookie (AWSALB); useful for legacy stateful apps.

NLB — Network Load Balancer (Layer 4)

Not for: path-based routing, WAF at L7 (use ALB or CloudFront+WAF in front).

Exam traps:

• NLB cross-zone load balancing is off by default — enable if you want even AZ spread (adds cross-AZ cost).
• Health checks can be TCP, HTTP, or HTTPS — but routing is still L4.
• PrivateLink and NLB: NLB is a common NLB-as-a-service endpoint target.

GWLB — Gateway Load Balancer

Architecture sketch (draw on paper):

Client / workload subnet
        │
        ▼
  GWLB Endpoint (VPC subnet)
        │
        ▼
  Gateway Load Balancer
        │
        ▼
  Appliance fleet (3rd-party AMIs in dedicated subnets)
        │
        ▼
  Return via GWLB → original destination

Not for: distributing HTTP traffic to web servers — that is ALB/NLB.

Exam traps:

• GWLB uses GENEVE, not HTTP headers.
• Deploy GWLB endpoint in each VPC that sends traffic for inspection.
• Distinct from Network Firewall (managed) and NAT Gateway.

Classic Load Balancer

Legacy — exam may mention “migrate to ALB/NLB.” No new features.

Block 2 (~40 min) — Target groups + health checks

Target group basics

Health checks — what the exam tests

Failure modes (troubleshoot order):

1. Security group — LB SG must reach target port; target SG must allow LB node IPs (or reference LB SG on ALB).
2. NACL blocking health check return traffic.
3. Wrong path / wrong port / app returns 301 instead of 200.
4. Target in wrong subnet (no route from LB).
5. Grace period — new ASG instance still booting; health check fails until HealthCheckGracePeriod elapses.

ALB + Auto Scaling (tie to your Week 2 VPC)

Internet → IGW → public subnets → ALB (nodes in public or private)
                                      │
                         listener rules → target groups
                                      │
                         private subnets → EC2/ECS tasks

For Fargate behind ALB: tasks in private subnets, ALB in public (or internal ALB in private for corp). Task SG: inbound only from ALB SG on app port.

Listener rules (ALB only)

Priority order — first match wins:

1. Host api.globalskiatlas.com → TG-api
2. Path /health → TG-health (or fixed response)
3. Default → TG-web

5 flashcards (write tonight)

1. ALB vs NLB — L7 HTTP routing vs L4 TCP/UDP + static IP?
2. GWLB — what traffic and what encapsulation?
3. Health check SG — who must allow whom?
4. Cross-zone — ALB default on, NLB default off — cost implication?
5. Deregistration delay — what happens during ASG scale-in?

Paper diagram (15 min)

Extend week2-vpc-plan.md with:

• ALB spanning public-a + public-b
• Target group → Fargate tasks in private-a / private-b
• SG arrows: ALB-SG → Fargate-SG:8080
• Health check path /health on task port

Block 3 (~30 min) — Quiz

File: night-11-quiz.json — 20 timed scenario questions (resilience domain, ~32 min at 96 sec each).

Answer without night-11-quiz-answers.json first. Score on the study site: /aws-solutions-architect-study/quiz?night=11.

Resilience domain map (what else shows up with ELB)

Night 12 preview

EventBridge cron → ecs:RunTask for Iceland pipeline. ELB not required for batch RunTask; ALB matters when you expose a long-running service.