Title

AWS re:Invent 2023 - Enhance your app’s security & availability with Elastic Load Balancing (NET318)

Summary

• Presenters: John Zobrist (Customer Success Lead for ELB) and Satya Ramaseshnan (Product Lead for ELB).
• Topics Covered: Availability and security enhancements in Elastic Load Balancing (ELB).
• Scaling: ELB scales up aggressively and down cautiously, with Application Load Balancer (ALB) scaling up first and then out, while Network Load Balancer (NLB) and Gateway Load Balancer (GLB) use AWS Hyperplane for scaling.
• Health Checks: ELB performs health checks on nodes and targets, with the ability to configure health check intervals and thresholds.
• New Features: Target group fail open threshold, DNS failover thresholds, cross-zone load balancing, anomaly detection, and automatic target weights for ALB.
• Security: Emphasis on defense in depth, IP-based access controls, encryption in transit with TLS 1.3 and FIPS support, reliable authentication with mutual TLS, configuration correctness with IAM policies, and extending defense with third-party solutions.
• Third-Party Integrations: Gateway Load Balancer integrates with third-party appliances for security and analytics, and supports traffic inspection from on-premises through VPN or Direct Connect.

Insights

• Scaling Insights: ELB's scaling strategy is designed to handle traffic surges and maintain smooth workload performance. The use of AWS Hyperplane technology allows for transparent scaling and persistent flows, which is critical for maintaining uninterrupted service during scaling events.
• Health Checks Insights: The granularity of health checks and the inclusion of dependencies in health checks are crucial for ensuring that only healthy targets receive traffic. The introduction of anomaly detection and automatic target weights allows for more nuanced traffic routing based on target performance.
• Security Insights: AWS's approach to security within ELB involves a multi-layered strategy, including both network and application layer controls. The development of AWS's own TLS library (S2N) and cryptography module (AWS LC) underscores the commitment to security and performance.
• Configuration Correctness Insights: The use of IAM policies to prevent misconfigurations is a proactive approach to security. The introduction of additional condition keys for load balancer configurations allows for more granular control and adherence to security best practices.
• Extending Defense Insights: The Gateway Load Balancer's ability to integrate with third-party appliances and support for traffic inspection from on-premises environments highlights AWS's flexibility in accommodating hybrid cloud architectures and existing customer investments in security appliances.
• Overall: The enhancements in ELB focus on providing customers with tools to improve the availability and security of their applications, with a strong emphasis on scalability, health monitoring, encryption, authentication, and integration with third-party solutions.