Load Balancers

Question 1

Briefly explain the four load balancers and the key differences between them.

Answer 1

Classic: old, very few use cases.
Application Load Balancer: the new hotness. It’s layer 7 (http, https, websockets)
Network Load Balancer: for layer 4 (tcp, udp). Better performance and lower latency than ALB. Unlike ALB, has only one static IP per AZ.
Gateway Load balancer: for 3rd party “virtual appliances”. Gives you one gateway for distributing traffic between them.

Question 2

Explain layer 4 vs layer 7

Answer 2

Think of layer 7 as the outer layer of networking. That’s where you have high abstraction networking like http, https, websockets.

Layer 4 is deeper than layer 7; think tcp and udp packets.

Question 3

Can you load balance to multiple applications in the same machine (like docker images)

Answer 3

Yeah, ALB lets you do this.

Question 4

When would you want to use a classic load balancer?

Answer 4

Almost never. Use cases:
TCP/SSL listeners
Support for EC2-classic
Support for sticky sessions using application-generated cookies.

Question 5

How are cookies created for sticky sessions?

Answer 5

It’s done by the ALB automatically. In CLB you need to create them manually (within EC2 applications)

Question 6

How can you configure routing tables to diff target groups in an ALB?

Answer 6

Based on:

• the path in the URL
• the hostname in the URL
• query strings or headers

Question 7

What’s a good load balancer for microservices or container-based applications, and why?

Answer 7

ALB. It has port mapping feature to redirect to a dynamic port in ECS (elastic container service)

Question 8

What target groups can an ALB have?

Answer 8

• EC2 instances (can be managed by an ASG)
• ECS tasks (managed by ECS itself)
• Lambda functions: the HTTP request is translated into a JSON event
• IP addresses (must be private IPs)

Important thing to note is that have multiple target groups per ALB.

Question 9

Can you target lambda functions with an ALB?

Answer 9

Yep. The HTTP request is translated into a JSON event.

Question 10

How do health checks work with an ALB?

Answer 10

Health checks are associated with its individual target groups, not with the ALB itself.

Question 11

How can an application see the IP of the client who made an HTTP request?

Answer 11

It’s sent by the ALB as ‘x-forwarded-for-header’ (with similar ones for port and protocol)

Question 12

How do you change the hostname for an ALB?

Answer 12

Trick question; it has a fixed hostname. Same is true for a CLB.

Question 13

What do I need to know about NLB?

Answer 13

• extremely high performance
• less latency than ALB
• unlike ALB, it has one static IP per AZ; you can use an elastic IP for this too

Question 14

When is a NLB useful?

Answer 14

If you’re dealing with TCP/UDP traffic or need extreme performance.

Question 15

If you’re using an ALB, how can you ensure that a user’s requests go to the same instance?

Answer 15

You can enable stickiness, which uses a cookie with a TTL you configure.

This is useful for session data, but can cause a load imbalance.

Question 16

How does load balancing work between AZs?

Answer 16

Each load balancer instance distributes evenly across all registered instances in all AZ. Cross-zone load balancing is ALWAYS ON for ALBs, but can be toggled for ELBs.

Question 17

When do you need to pay data transfer fees?

Answer 17

Any time data is sent from one AZ to another. The one exception is that you don’t need to pay if you’re using an ALB (but do for an ELB).

Question 18

How are SSL certs managed in AWS?

Answer 18

ACM (amazon certificate manager). You can create them through ACM or upload your own.

Question 19

What is SNI? What is it used for?

Answer 19

Server name indication. Clients use SNI to indicate the hostname they want to reach in the initial SSL handshake. This lets the server respond with an SSL cert that matches their request, and means that we can load multiple certs onto one webserver.

SNI works for ALB, NLB, Cloudfront, but not CLB.

Question 20

What is connection draining?

Answer 20

Connection draining is the time to complete “in-flight requests” while the instance is de-registering or unhealthy. All new traffic is stopped, and existing requests are given time to complete before killing the instance.

Question 21

I’m worried about existing HTTP connections being lost when an ALB scales in. How can I protect against this?

Answer 21

Connection draining. A target won’t shut down while connections are still waiting for a reply. By default this is 300 seconds, can be 0-3600 seconds.

It’s sometimes called “deregistration delay”.

If it’s a web app you can probably get away with like 20 seconds.

Question 22

When would connection draining not be useful?

Answer 22

Any request that takes longer than an hour (3600 seconds).