Load Balancers in the VPC

Layer 4 versus layer 7

A load balancer spreads traffic across healthy targets in several AZs and gives clients one stable entry point. A layer-7 load balancer (AWS Application Load Balancer, Google Cloud Application Load Balancer, Azure Application Gateway) understands HTTP: it terminates TLS, routes by host name or path, rewrites headers and performs HTTP health checks. A layer-4 load balancer (AWS Network Load Balancer) forwards TCP or UDP connections without reading the payload, which suits non-HTTP protocols, very high connection rates and cases needing static IP addresses per AZ. Either can be internet-facing, with nodes in public subnets and public addresses, or internal, with only private addresses for service-to-service traffic. Targets themselves stay in private subnets. A common trap: with a layer-7 load balancer the backend sees the load balancer's address as the source, so the client's real IP must be read from the X-Forwarded-For header.

Receptionist versus post room

A layer-7 balancer is a receptionist who reads each visitor's request and sends them to the right department. A layer-4 balancer is a post room that forwards sealed envelopes to the next free desk without opening them.

Health checks need firewall rules too

Targets marked unhealthy for no obvious reason often have a security group that does not allow the load balancer's health-check traffic. Allow the health-check port from the load balancer's security group.

Quick check: You need to route /api/* and /images/* on the same hostname to different backend services. Which load balancer type fits?

• A layer-4 network load balancer
• A layer-7 application load balancer
• A NAT gateway
• A gateway VPC endpoint