---
title: Choosing Between AWS Network Load Balancer and Application Load Balancer for EKS Deployments Based on Specific Requirements
created: 2026-03-30
updated: 2026-03-30
type: summary
tags: ["aws", "eks", "networking", "notes", "telegram"]
external: http://go/ui/posts/2306/
status: inbox
---

Great question — the decision comes down to what layer you need AWS to operate at.

## Choose NLB when...

**Istio (or another service mesh) is handling your L7 routing**
Since Istio's VirtualService already does path routing, retries, header matching etc., there's no value in paying for ALB to duplicate that at the AWS layer.

**You need raw TCP/UDP passthrough**
- gRPC with HTTP/2 (ALB can do this but needs extra config)
- WebSockets at scale
- Non-HTTP protocols (databases, MQTT, game servers)
- mTLS end-to-end — NLB passes TLS through untouched; ALB terminates it

**Lower latency matters**
NLB is L4 — it doesn't inspect packets, just forwards them. Measurably lower latency than ALB at high throughput.

**Static IPs are required**
NLB supports Elastic IPs — useful for whitelisting by IP on the client side. ALB only gives you a hostname.

---

## Choose ALB when...

**No service mesh, and you need L7 routing in AWS**
Path-based (`/api` → service A, `/web` → service B) or host-based routing without Istio.

**AWS WAF integration is required**
WAF only attaches to ALB (and CloudFront). If you need to block malicious traffic at the AWS layer before it hits your cluster, ALB is mandatory.

**SSL termination at the AWS boundary is preferred**
ACM certificates attach natively to ALB — no cert management inside the cluster needed.

**You want AWS-native auth**
ALB supports OIDC and Cognito authentication as a listener rule — useful for internal tools without writing auth code.

---

## The most common EKS production patterns

```
# Pattern 1: Istio mesh (most common for microservices)
Internet → NLB → Istio IngressGateway → VirtualService routing → services

# Pattern 2: No mesh, simple routing
Internet → ALB (AWS LBC) → Kubernetes Ingress rules → services

# Pattern 3: WAF required + Istio
Internet → ALB → Istio IngressGateway → VirtualService routing → services
```

Pattern 3 is the only case where you'd run both — ALB purely for WAF/ACM at the edge, then hand off to Istio for all actual routing logic inside the cluster.

---

## Quick decision rule

> **Already using Istio?** → NLB, let Istio own L7.
> **Need AWS WAF?** → ALB (or ALB in front of Istio).
> **Neither, simple setup?** → ALB for its L7 features.

**No** — Option 1 (pure Istio Gateway) creates an **NLB (Network Load Balancer)**, not an ALB.

## Why NLB?

When `istio-ingressgateway` is installed, it creates a `LoadBalancer` type Service. EKS provisions whatever the default in-tree cloud controller gives you — which is an **NLB** (Layer 4).

```bash
kubectl get svc istio-ingressgateway -n istio-system -o jsonpath='{.metadata.annotations}'
# service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
```

---

## NLB vs ALB — why it matters

| | NLB (Istio default) | ALB (Option 2) |
|---|---|---|
| OSI Layer | L4 (TCP) | L7 (HTTP) |
| AWS WAF | ❌ | ✅ |
| Path-based routing in AWS | ❌ (Istio handles this) | ✅ |
| WebSocket | ✅ | ✅ |
| gRPC | ✅ | ✅ (with annotations) |
| SSL termination | At Istio gateway pod | At ALB |
| Cost | Lower | Higher |

With Istio + NLB, **all L7 routing logic lives inside Istio** (via VirtualService), so you don't need the ALB to do it. That's actually the point — Istio becomes your L7 router.

---

## If you specifically need an ALB

Annotate the `istio-ingressgateway` Service to force ALB provisioning via AWS Load Balancer Controller:

```yaml
apiVersion: v1
kind: Service
metadata:
  name: istio-ingressgateway
  namespace: istio-system
  annotations:
    kubernetes.io/ingress.class: alb
    service.beta.kubernetes.io/aws-load-balancer-type: "external"
    service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
```

Or use Option 2 (an `Ingress` resource in front of the gateway) if you want a proper ALB → Istio setup with full ALB feature access.
