Home / AWS

AWSCheat sheetIntermediate

Advisory: ALB, NLB, API Gateway, CloudFront or Global Accelerator - choosing the AWS entry point

The front door of an AWS workload decides its security controls, failover and much of its latency. Choose by protocol, global vs regional reach and API management needs, combine services in proven layers, and settle WAF placement, origin protection, timeouts and certificates during design.

Deepak Bhardwaj3 min read

Applies toApplication Load Balancer, Network Load Balancer, Amazon API Gateway (REST, HTTP, WebSocket APIs), Amazon CloudFront, AWS Global Accelerator, AWS WAF

Quick map

Need Service
HTTP(S) routing to containers/instances in a region ALB
TCP/UDP, static IPs, very high throughput, PrivateLink provider NLB
API features: auth, usage plans/keys, throttling, request validation, direct service integrations API Gateway
Global edge caching, TLS at edge, DDoS absorption for web CloudFront
Static anycast IPs and fast regional failover for TCP/UDP or HTTP Global Accelerator

API Gateway flavours

REST API HTTP API WebSocket API
Features Richest: usage plans, API keys, request validation, caching, WAF, private APIs Simpler, lower cost, JWT authorizers Persistent connections
Use for Partner/public APIs needing management features Internal or simple Lambda/HTTP backends Chat, live updates

Check the current feature comparison. HTTP APIs gained features over time but still differ.

Proven layers

Users ─► CloudFront (+WAF) ─► ALB ─► ECS/EKS/EC2              (web apps)
Users ─► CloudFront (+WAF) ─► API Gateway ─► Lambda           (serverless APIs)
Clients ─► Global Accelerator ─► NLB/ALB in two regions        (static IPs, fast failover)
Partners ─► API Gateway (REST, usage plans) ─► VPC link ─► NLB/ALB ─► services
Internal ─► internal ALB / private API Gateway via VPC endpoint

Design decisions to settle early

Topic Decide
WAF placement CloudFront (global) and/or ALB/API Gateway (regional). One owner for rules
Origin protection ALB only reachable from CloudFront (managed prefix list in SG + secret header), S3 via OAC
TLS ACM certificates (us-east-1 for CloudFront), renewal monitoring
Timeouts CloudFront origin timeout, ALB idle timeout, API Gateway integration timeout, backend keep-alive aligned
Auth Cognito/OIDC on ALB, JWT authorizers on HTTP API, Lambda authorizers
Failover Route 53 health checks, CloudFront origin groups, Global Accelerator endpoint weights
Limits API Gateway throttling and payload limits, ALB rules per listener

Traps

Trap Note
API Gateway in front of long-running requests Integration timeout limits; use async patterns
CloudFront caching APIs with auth headers Cache key and Cache-Control: private discipline
NLB where you need HTTP features ALB (or NLB → ALB target for static IPs + L7)
Public ALB reachable directly while "behind" CloudFront Lock it down
One giant ALB for all environments Separate by environment and exposure

Design review questions

  • Draw the request path: every hop, its timeout, TLS termination and health check.
  • Where are rate limits applied, and what happens to a client that exceeds them?
  • How is the entry point itself monitored (5xx at each layer, latency, WAF blocks)?
  • How does it fail over between AZs and regions, and was it tested?

Tip

Most entry-point incidents come from mismatched timeouts and forgotten origin exposure. A single diagram with timeouts and allowed sources per hop prevents both.

Checklist

  • Protocol and reach (global/regional) decided
  • API management needs mapped to the right API Gateway type
  • WAF placement and ownership
  • Origins locked to the entry point
  • Timeouts, certificates and auth documented
  • Failover tested

Related fixes