AWS Application Load Balancer

What AWS Application Load Balancer actually is

AWS Application Load Balancer (ALB) is a managed Layer 7 load balancer: it terminates HTTP/HTTPS connections, reads the request, and routes it to a target based on what is inside — host header, path, query string, HTTP header, or method. Targets are EC2 instances, containers, IP addresses, or Lambda functions. It launched in August 2016 at the AWS Summit in New York, replacing content-blind round-robin with rules-based routing, and the Classic Load Balancer it sits alongside has been in maintenance mode ever since.

The feature set is what you would expect from a decade of iteration: host- and path-based routing for microservices, HTTP/2 and gRPC listeners, WebSocket support, TLS offloading with SNI, sticky sessions, slow start, redirects and fixed-response actions, desync mitigation mode, mutual TLS, and built-in user authentication against OIDC providers. Native IPv6 support is there (dualstack), AWS WAF attaches directly at the listener, and request tracing headers let you follow a call across services. In our view, if your routing logic is "send /api to the API pool and / to the web pool," an ALB does it with less configuration than any open-source alternative we have used — and it integrates with ECS, EKS, Auto Scaling, Certificate Manager and CloudFormation without glue code.

This is also where Lambda-as-a-target and the AWS WAF integration make ALB the default ingress for container platforms in the AWS ecosystem. We compare it against other ingress options in our /category/load-balancers category.

Pricing: what you really pay

Two meters, and the second one is the one that surprises people.

Meter one: $0.0225 per hour (partial hours billed as full hours) for each running Application Load Balancer. Meter two: $0.008 per LCU-hour. An LCU is the maximum of four averaged dimensions: new connections (25 per second per LCU), active connections (3,000 per minute per LCU), processed bytes in GB for HTTP(S) traffic, and rule evaluations. You pay for the highest dimension, not the sum.

AWS's own worked examples are the most honest documentation here. A modest service (one new connection per second, 100 requests per second, 1 KB responses) consumes 1.08 LCUs on the processed-bytes dimension: $0.00864/hour in LCU charges, $22.42/month total with the hourly fee. A busier one at 100 requests per second with 10 KB responses runs 12.6 LCUs: $0.1233/hour, $88.78/month — which works out to about $0.34 per million requests. Those are real, published numbers, and they are the best way we know to sanity-check a bill before it arrives. Our practical method: take last month's requests per second and average response size, compute the processed-bytes dimension in GB, divide by 60 for the per-minute average, and compare all four dimension results — the largest one is your LCU rate. Teams that skip this step find out from the invoice.

New accounts get 750 hours per month shared between Classic and Application load balancers plus 15 LCUs for ALB for twelve months. Since July 15, 2025 new AWS customers instead receive up to $200 in Free Tier credits applicable to eligible services including ELB, usable within twelve months. Standard AWS data transfer charges and public IPv4 address charges ($0.005/hour per public IPv4 in most regions) come on top, and WAF, Shield Advanced and Route 53 each bill separately. Load Balancer Capacity Unit Reservation lets you pre-purchase LCU-hours (the pricing page's example: 200 reserved LCU-hrs at $1.60/hour plus on-demand overflow) for steadier workloads.

Performance & infrastructure

ALB runs everywhere AWS does: the current global footprint is 39 geographic regions and 124 Availability Zones, with more announced. Deploy one ALB across two or more AZs and it health-checks targets, drains connections and fails over automatically. There is no instance size to pick — capacity scales with traffic and the LCU meter follows it. We have not run ALB through our /benchmarks suite; latency is dominated by TLS termination and target response time, not by the balancer.

Reliability is the strongest dimension of this product. The Elastic Load Balancing SLA carries a Multi-AZ commitment of 99.99% monthly uptime, with service credits of 10%, 30% or 100% depending on how far below that a month falls, and a separate 99.9% commitment for a balancer deployed in a single AZ. That is the highest published load balancer SLA in the mainstream market, and the credit tiers are spelled out rather than buried.

Operationally, ALB behaves like a mature piece of plumbing. Health checks run per target with configurable thresholds, connection draining (deregistration delay) keeps in-flight requests alive while targets leave service, cross-zone load balancing spreads traffic evenly across AZs at no extra charge, and idle connection timeout is configurable for long-lived connections. Access logs land in S3, and every rule change is visible in CloudTrail. In the incidents we have reviewed, most "ALB problems" turned out to be health check thresholds that were too aggressive or target groups that failed open on misconfiguration — the balancer itself is rarely the culprit.

Security posture: Shield Standard DDoS protection (network and transport layer) is enabled automatically for all AWS customers at no additional charge; Shield Advanced is the paid tier for application-layer mitigation with a one-year commitment. Security groups, ACM certificates, and TLS policy configuration all attach at the listener.

Where it falls short

LCU pricing is legible in hindsight and hard to forecast in advance. In our experience the failure mode is not the $0.0225 hourly fee — it is a spike in processed bytes or a rule set that grows past a handful of rules per request, and an invoice that quietly doubles. The pricing calculator exists for a reason; use it before production.

Operating an ALB competently requires knowing AWS: VPC design, target groups, health check tuning, security group scoping, WAF rule groups and CloudWatch metrics. None of it is difficult; all of it is specific to AWS. Teams without that familiarity underestimate the ramp, and the console's error messages on listener rules are famously terse.

Support is a separate purchase. AWS Basic Support is free and means documentation plus forums; anything resembling a response-time commitment starts with the Business tier, priced as a percentage of monthly spend with a floor. Factor that into any cost comparison against a provider that bundles support — an ALB bill plus Business support is a different number than the pricing page alone suggests.

Vendor lock-in is real. ALB's rule grammar, target registration and WAF integration do not port to other clouds; a migration means re-implementing routing elsewhere. Multi-AZ is effectively mandatory to get the 99.99% SLA, which means two AZs' worth of design even for a small deployment. And there is no free ride for idle projects: an ALB left running bills 24/7 at $0.0225/hour — roughly $16.42 a month before any traffic — so dev environments should be torn down when unused.

Who should pick this

Our pick for teams already on AWS running containerized or microservice architectures who need Layer 7 routing with WAF integration. If you are on ECS or EKS, ALB is the path of least resistance and usually the right answer. Routing rules deserve one more word, because they are the part teams underestimate. A listener holds an ordered rule list; each rule combines conditions (host, path, header, query string, source IP, method) with an action (forward to a target group, redirect, return a fixed response, or authenticate). Rules are evaluated in order and the first match wins, so a rule set of any size needs an explicit ordering convention — we keep "most specific first" as a house rule and enforce it in review. Beyond the fifth rule per request the rule-evaluation dimension of the LCU starts to matter, which is where cost and design choices quietly meet.

It is also the natural ingress for a shop that wants authentication, certificate management and DDoS baseline handled by the platform rather than by nginx or HAProxy that someone then has to patch.

We would not pick it when the workload is TCP/UDP at high connection rates (Network Load Balancer is the correct tool there, with static IPs and lower per-unit cost), nor for a single-server hobby project (a reverse proxy on the box is cheaper and simpler), for latency-critical UDP or raw TCP workloads (look at Network Load Balancer instead), or for teams that must stay cloud-portable — Envoy, HAProxy or a managed alternative like Cloudflare's load balancing keeps the routing layer movable. And we would think twice before putting ALB in front of an infrequent internal tool; the hourly charge dwarfs the value.

Key takeaways

• Layer 7 managed load balancer since August 2016: host/path/header routing, HTTP/2, gRPC, WebSockets, native IPv6, WAF integration, Lambda targets.
• Pricing is $0.0225 per hour plus $0.008 per LCU-hour, where an LCU is the maximum of new connections, active connections, processed bytes and rule evaluations.
• AWS's own examples: $22.42/month for a light service, $88.78/month at 100 requests per second — roughly $0.34 per million requests.
• Multi-AZ SLA is 99.99% with 10/30/100% service credits; single-AZ deployments only get 99.9%.
• Free tier: 750 shared CLB/ALB hours plus 15 LCUs monthly for twelve months; new accounts since July 2025 get up to $200 in Free Tier credits.
• Budget for data transfer, public IPv4 addresses and the idle hourly charge — an unused ALB still costs about $16.42/month.

Sources

• https://aws.amazon.com/elasticloadbalancing/pricing/
• https://aws.amazon.com/elasticloadbalancing/sla/
• https://aws.amazon.com/elasticloadbalancing/application-load-balancer/
• https://aws.amazon.com/elasticloadbalancing/features/
• https://aws.amazon.com/shield/pricing/
• https://aws.amazon.com/about-aws/global-infrastructure/
• https://aws.amazon.com/about-aws/whats-new/2016/08/announcing-application-load-balancer-for-elastic-load-balancing
• https://en.wikipedia.org/wiki/Amazon_Web_Services