ELB and Auto-scaling Groups Flashcards
When we have an instance sitting behind an application load balancer what does an instance see in terms of the originating IP for each request?
Because load balancers intercept traffic between clients and servers, your server access logs contain only the IP address of the load balancer.
To see the IP address of the client, use the X-Forwarded-For request header. To see the protocol and port, use the X-Forwarded-Proto and X-Forwarded-Port
How would a distributed vs non distributed system be scaled (generally)
Distributed systems would generally be scaled horizontally. Non distributed systems would tend to scale vertically.
Which OSI layers do CLBs, ALBs and NLBs operate on?
CLB: 4(transport layer, TCP), 7(Application Layer)
NLB: 4
ALB: 7
Why would you use cross zone load balancing?
Cross-zone load balancing reduces the need to maintain equivalent numbers of instances in each enabled Availability Zone, and improves your application’s ability to handle the loss of one or more instances. However, AWS still recommend that you maintain approximately equivalent numbers of instances in each enabled Availability Zone for higher fault tolerance
By default, how often does an ELB make a health check?
every 5 seconds.
Which 3 protocols can an ALB support?
HTTP, HTTPS, Websockets
Is there a cost for traffic across AZ’s when using cross zone load balancing? Is this applicable to all load balancer types?
For ALB and CLB there is no charge
For an NLB there is.
For a public facing application or classic load balancer serving traffic from the web, what would the security group look like for:
The ELB public interface
The EC2 instance behind the ELB
?
For ELB Security Group:
Inbound HTTP port 80 source: 0.0.0.0/0
Inbound HTTPS port 443 source: 0.0.0.0/0
For Ec2
Inbound HTTP port 80 source: ELB’s Security Group ID
There are 6 components of an HTTP request that can be used in an ALB for routing - what are they?
You can route on: Host Header HTTP Header Path Query String Source IP Request Method (GET, POST, PUT etc)
Which load balancers have Cross AZ balancing enabled or disabled by default? Are there any costs in cross zone balancing?
NLB and CLB’s have cross AZ load balancing DISABLED by default.
ALBs can ONLY have cross AZ balancing enabled. There is no cost for cross AZ balancing for ALB’s and CLBs, but there is for an NLB
Generally, 50x and 40x errors refer to which side of an application stack?
50x - Application side
40x - Client Side
If your ELB can’t connect to your application instances what is the simplest likely explaination
Misconfigured security group on the application side is the most likely cause. I.e. we have not allowed inbound http traffic from the ELB’s security group.
Where does SSL termination occur in the following chain:
Client->ELB->Ec2 Instance (web server)
For each of the legs, is traffic HTTP or HTTPS?
Termination occurs on the ELB. This means traffic between client and ELB is HTTPS and traffic between the ELB and the Webserver is HTTP. The HTTP traffic is routed over the VPC so it is private but not encrypted.
How many SSL certificates can each load balancer type support? What is the format standard used to define the certificate?
ALB: Multiple - 25
NLB: Multiple - 25
CLB: One and only one per balancer
x509
What does SNI allow?
SNI allows multiple SSL certificates to be installed on a web server which allows multiple websites to be hosted on the same server
Which ELB’s support SNI? Are ELB’s the only thing that can support SNI?
NLB and ALB support SNI. As does cloud front.
What is cross zone load balancing?
With cross-zone load balancing, each load balancer distributes requests evenly across instances in all enabled Availability Zones. If cross-zone load balancing is disabled, each load balancer distributes requests evenly across the registered instances in its Availability Zone ONLY.
What 4 things can an application load balancer use as a target group?
EC2
ECS
Lambda
Private IP’s
We have a load balanced application talking to 3 instances. Currently we are using an ALB, so the inbound security group for each instance allows traffic into that instance based on the security group of the ALB (ALB_WEB_SG1) on port 80. Our integration is meant to integrate with a clients environment, so its been identified that we need a static IP to whitelist the application from the clients network. What load balancer would we need to use and what other changes will we need to make?
We would need a Network load balancer as this is the only one one with static IP (both ALB and CLB have a fixed host name). The issue is, our inbound security group for the instances limits traffic from the ALB_WEB_SG1 group. The NLB doesn’t have a security group AND as far as the instances are concerned the will see the ORIGIN IP. This means we need to change the instance security group to accept TCP inbound on port 80 from 0.0.0.0/0.
When accessing your site via an ELB, you receive an HTTP 503. What is the potential issue (two)?
Either the ELB is at capacity, or there are no registered targets.
Which 3 protocols can an NLB support?
TCP, TLS, UDP
What is the sequence for an SNI call at a high level?
During the handshake between the client and the server, the client provides the hostname as part of the negotiation. The ALB or NLB take the host name and determines the correct certificate to use for encryption between it and the client (or returns the default)
We’ve build a containerized application and we need to load balance across containers - what load balancer is the correct type?
Application load balancer via dynamic port mapping
Which 3 protocols can a CLB support?
HTTP, HTTPS, TCP
