ALB vs NLB vs GWLB — Load Balancer Decision Guide
Load balancer selection appears in 67 ANS-C01 questions plus heavily on SAA-C03 and SAP-C02. The exam tests when to use ALB vs NLB, GWLB for transparent inspection, target group types, cross-zone behavior, and advanced features like connection draining, slow start, and sticky sessions.
Path-based routing
Host-based routing
Header/query routing
WebSocket
Lambda targets
Cognito auth
Redirect/fixed response
Static IPs (1 per AZ)
Millions of req/sec
Ultra-low latency
Preserve source IP
PrivateLink compatible
Long-lived connections
Non-HTTP protocols
GENEVE encapsulation
Bumps-in-the-wire
Preserves all headers
Third-party appliances
Firewall/IDS/IPS
Scales appliance fleet
Gateway LB Endpoint
Detailed Comparison
| Feature | ALB | NLB | GWLB |
|---|---|---|---|
| Layer | 7 (HTTP/HTTPS) | 4 (TCP/UDP/TLS) | 3 (IP packets) |
| Static IP | No (use Global Accelerator for static IPs) | Yes (1 per AZ, EIP assignable) | No (uses GWLBe) |
| Performance | Millions req/sec | Millions req/sec, ultra-low latency (~100μs) | Millions pps |
| Source IP | X-Forwarded-For header | Preserved natively (target sees real client IP) | Preserved (transparent) |
| TLS termination | Yes (ACM certificate) | Yes (TLS listener) or passthrough | No (transparent) |
| Health checks | HTTP/HTTPS (path, status code) | TCP, HTTP, HTTPS | TCP, HTTP, HTTPS |
| PrivateLink | Not directly (needs NLB in front) | Yes (expose as VPC Endpoint Service) | Yes (GWLBe) |
| Cross-zone | Enabled by default (free) | Disabled by default (costs when enabled) | Disabled by default |
Target Group Types
| Type | Targets | Use Case |
|---|---|---|
| Instance | EC2 instance IDs | Standard EC2 workloads, ASG integration |
| IP | Private IP addresses | ECS (awsvpc mode), on-premises targets (via DX/VPN), cross-VPC |
| Lambda | Lambda function ARN | Serverless backends (ALB only) |
| ALB | ALB ARN (NLB → ALB chain) | Static IPs (NLB) + Layer 7 routing (ALB) combined |
Advanced Features
- Connection draining (deregistration delay): When target deregisters, existing connections complete (default 300s). Set lower for faster deployments.
- Slow start: New targets gradually receive traffic (avoids overwhelming cold instance). Ramps up over configurable duration.
- Sticky sessions: ALB uses cookie (application or duration-based). NLB uses source IP hash. Breaks even distribution — avoid if possible.
- Cross-zone LB: ALB: enabled by default (distributes evenly across all targets in all AZs). NLB: disabled by default (each AZ node only routes to targets in its AZ).
- mTLS: ALB supports mutual TLS (verify client certificates). Requires trust store configuration.
When to Chain NLB → ALB
- Problem: Need static IPs (NLB) + path-based routing (ALB)
- Solution: NLB (static IPs, PrivateLink compatible) → ALB target group → application targets
- Also for: Exposing ALB-backed services via PrivateLink (PrivateLink requires NLB/GWLB)
- Alternative: ALB + Global Accelerator (provides static IPs without NLB)
Exam Tips
| Exam | Key Points |
|---|---|
| ANS-C01 | “Static IP” → NLB or NLB→ALB. “Path-based routing” → ALB. “TCP/UDP non-HTTP” → NLB. “Preserve client IP without headers” → NLB. “Third-party firewall appliance” → GWLB. “PrivateLink” → NLB or GWLB endpoint. “Ultra-low latency” → NLB. “Lambda target” → ALB. “Cross-zone disabled by default” → NLB (gotcha). “mTLS client certs” → ALB. |
AWS Certification Exam Practice Questions
Question 1:
A financial services API requires: static IP addresses for client allowlisting, Layer 7 path-based routing for different API versions (/v1/* vs /v2/*), and TLS termination. No single AWS load balancer provides all three. What architecture satisfies all requirements?
- ALB with Global Accelerator (provides static IPs + Layer 7 routing)
- NLB (static IPs) with ALB as target (provides Layer 7 routing + TLS termination)
- NLB with TLS listener and path-based routing
- GWLB with ALB targets
Show Answer
Answer: B — NLB provides static IPs (one per AZ, EIP assignable) for client allowlisting. ALB as target group provides path-based routing (/v1/*, /v2/*) and TLS termination. The chain NLB→ALB combines both capabilities. Global Accelerator (A) also provides static IPs but the question implies direct IP allowlisting which NLB handles natively. NLB alone (C) doesn’t support path-based routing.
Question 2:
A gaming company’s servers handle millions of concurrent TCP connections on a custom protocol (not HTTP). They need the load balancer to preserve the client’s source IP address so game servers can identify players. Which load balancer type preserves source IP natively for TCP?
- ALB with X-Forwarded-For header
- NLB — preserves source IP natively for TCP targets (no proxy protocol or header needed)
- GWLB with GENEVE encapsulation
- Classic Load Balancer with proxy protocol
Show Answer
Answer: B — NLB operates at Layer 4 and preserves the source IP address natively for instance and IP targets. The game server sees the actual client IP without any headers or protocol modifications. ALB (A) replaces source IP with its own — requires X-Forwarded-For header parsing (only works for HTTP). For non-HTTP TCP protocols, NLB is the only option that preserves source IP without modification.
Question 3:
After deploying new instances into an ALB target group, the new instances are immediately overwhelmed with traffic and fail health checks. Existing instances are fine. How can the new instances be gradually introduced?
- Increase the health check interval to give instances more time
- Enable slow start mode on the target group — new targets receive gradually increasing traffic over a configurable duration
- Deploy one instance at a time with manual monitoring
- Reduce the connection timeout on the ALB
Show Answer
Answer: B — Slow start mode gradually increases the proportion of traffic sent to newly registered targets over a configurable duration (30-900 seconds). This gives the application time to warm caches, initialize connections, and reach steady state before receiving full load. Without slow start, new targets immediately receive their equal share — which can overwhelm cold instances.
Question 4:
A company has 4 instances: 3 in AZ-A, 1 in AZ-B. With NLB’s default cross-zone disabled, the single instance in AZ-B is overwhelmed (receiving 50% of traffic) while AZ-A instances are underutilized. How should this be resolved?
- Add more instances to AZ-B to handle 50% of traffic
- Enable cross-zone load balancing on the NLB — traffic distributes evenly across all 4 targets regardless of AZ
- Remove AZ-B from the NLB to stop routing there
- Switch to ALB which has cross-zone enabled by default
Show Answer
Answer: B — NLB cross-zone disabled means each AZ node routes only to targets in its AZ. With 2 AZ nodes: AZ-A node sends 50% to 3 instances (17% each), AZ-B node sends 50% to 1 instance (50% alone). Enabling cross-zone distributes across all 4 targets evenly (25% each). Note: NLB cross-zone has a data transfer charge. ALB (D) would also work but changes the load balancer type entirely.
Question 5:
A company wants to expose an internal ALB-backed microservice to partner accounts via PrivateLink. However, PrivateLink VPC Endpoint Services only support NLB or GWLB as the load balancer. How can they expose the ALB service via PrivateLink?
- PrivateLink now supports ALB directly
- Create an NLB with the ALB as a target (ALB-type target group), then create a VPC Endpoint Service pointing to the NLB
- Replace ALB with NLB for the microservice
- Use VPC Peering instead of PrivateLink
Show Answer
Answer: B — NLB supports ALB as a target type. Create NLB → target group type “ALB” → point to existing ALB. Then create VPC Endpoint Service backed by the NLB. Partners create Interface Endpoints to access the service. This preserves all ALB Layer 7 features (path routing, auth) while providing PrivateLink access. No need to replace the ALB (C).
Related Posts
- Three-Tier Web Architecture
- Network Firewall & GWLB
- Global Traffic Management
- Auto Scaling & Performance
References
- Application Load Balancer Guide
- Network Load Balancer Guide
- Gateway Load Balancer Guide
- NLB with ALB Target — AWS Blog
Frequently Asked Questions
ALB vs NLB — how do I choose?
ALB: When you need HTTP-aware features — path/host routing, header inspection, Lambda targets, WebSocket, Cognito auth, redirects. NLB: When you need TCP/UDP (non-HTTP), static IPs, ultra-low latency, source IP preservation, PrivateLink, or millions of connections. Rule of thumb: HTTP/HTTPS application → ALB. Everything else → NLB.
Why is NLB cross-zone disabled by default?
Two reasons: (1) Cost — cross-zone NLB incurs data transfer charges between AZs. ALB cross-zone is free. (2) Latency — without cross-zone, traffic stays in the same AZ (lower latency). For most applications, enable cross-zone for even distribution. Disable when cost-sensitive or when you want AZ-local routing (each AZ is independent).