Managing Web Traffic with Application Load Balancers (Layer 7)

An Application Load Balancer (ALB) operates at Layer 7 of the OSI model. Because it understands HTTP and HTTPS traffic, it can make intelligent routing decisions based on the content of the request, such as the URL path, the hostname, or HTTP headers.

Key Features of an ALB

• SSL/TLS Termination: The ALB can hold your SSL certificates (e.g., Let's Encrypt or custom certificates) and decrypt incoming traffic before passing it as plain HTTP to your backend instances. This offloads CPU work from your servers.
• Path-Based Routing: Route /api/* traffic to your backend API cluster, and /images/* traffic to a different set of static file servers.
• Hostname Routing: Host multiple domains (e.g., app1.com and app2.com) on the same load balancer and route traffic to entirely different Target Groups using SNI.

Creating an Application Load Balancer

1. Navigate to Networking > Application Load Balancers in the LYNIO Console.
2. Click Create ALB.
3. Select the VPC and Subnet where it should be deployed.

Configuring HTTPS Listeners & Certificates

To serve secure web traffic:

1. Under Listeners, add an HTTPS listener on Port 443.
2. The console will prompt you to select an SSL Certificate.
3. You can either select an existing certificate from your LYNIO Certificate Manager, or provision a new free Let's Encrypt certificate directly from the dropdown.

Target Groups & Backends

Before creating rules, you must define where the traffic goes:

• A Target Group is a logical grouping of one or more backend Compute Instances.
• Each Backend within a Target Group has a designated port (e.g., 80 or 8080) where it listens for traffic.
• You can mix and match instances from different subnets within the same Target Group.

Setting Up Routing Rules

Instead of blindly forwarding traffic, ALBs use rules:

1. Go to the Routing Rules tab of your ALB.
2. Define a default Target Group (where traffic goes if no specific rules match).
3. Add a specific rule. For example:
   • Condition: Path starts with /api
   • Action: Forward to API-Target-Group

Advanced Security & Performance

Application Load Balancers provide advanced features to secure your applications at the edge.

Rate Limiter Profiles

To protect your backends against DDoS attacks, brute-force attempts, or abusive scraping, you can attach a Rate Limiter Profile to your ALB.

• You define the maximum number of requests allowed per IP address within a specific time window.
• When the limit is exceeded, the ALB automatically drops or throttles further requests from that IP, returning an HTTP 429 (Too Many Requests) status.

Ciphersuite Profiles

For strict compliance and security requirements, you can control the exact TLS parameters used by your ALB's HTTPS listeners using a Ciphersuite Profile.

• You can enforce modern encryption by disabling older protocols (like TLS 1.0 or 1.1) and only allowing TLS 1.2 and TLS 1.3.
• You can specify the exact cryptographic ciphers supported, ensuring your applications meet rigorous security audits.

Health Checks

For ALBs, health checks are typically performed via HTTP. The ALB will send an HTTP GET request to a specific path (e.g., /health) on your instances. If the instance responds with a 200 OK status, it is marked as healthy and receives traffic.