Review the ALB’s Description tab, which provides a summary of key settings such as:
Scheme (Internet-facing or internal).
VPC and Availability Zones (AZs) used.
Security groups associated with the ALB.
Listeners:
Select the Listeners tab to view the configured listeners (e.g., HTTP, HTTPS) and associated rules. Listener rules define how traffic is routed to target groups.
Target Groups:
In the left-hand navigation, go to Target Groups to explore the backend instances or containers that the ALB routes traffic to. Select a target group to view its health check settings, targets, and attributes.
3. Exploring the AWS Well-Architected Framework Pillars
Under the Target Groups section, select a target group and review its Health check settings. Ensure health checks are properly configured to automatically monitor and maintain the health of target instances.
Monitoring:
In the Monitoring tab of the selected ALB, check key CloudWatch metrics such as Request Count, Active Connection Count, Target Response Time, and HTTP Code metrics. These metrics help monitor the ALB's performance and identify issues early.
Logging:
Check if Access Logs are enabled under the Attributes section of the load balancer. Access logs provide detailed information about requests processed by the ALB, which is essential for operational monitoring and troubleshooting.
In the Description tab, review the Security groups associated with the ALB. Ensure that the security groups are configured with the principle of least privilege, allowing only necessary inbound traffic (e.g., HTTP/HTTPS ports).
Listener Settings:
In the Listeners tab, verify that HTTPS is used as the listener protocol, enforcing encrypted connections. If HTTPS is used, check that an SSL/TLS certificate is attached to secure data in transit.
Access Logs:
Under the Attributes section, check if Access logs are enabled. Logs should be sent to an S3 bucket to facilitate security audits and trace user activities.
In the Description tab, review the Availability Zones to ensure the ALB is configured across multiple Availability Zones. This setup provides high availability and fault tolerance, ensuring that traffic is balanced across healthy instances in different AZs.
Health Checks:
Under Target Groups, inspect the health check configuration. Properly configured health checks with appropriate intervals and thresholds improve reliability by automatically removing unhealthy targets from the load balancer’s routing.
Failover and Traffic Routing:
Examine the Listeners and their Rules to understand how traffic is routed to different target groups. Ensure that rules provide a clear fallback mechanism, such as routing to a default target group when specific conditions are not met.
In the ALB's Attributes section, check the Idle timeout setting. A shorter idle timeout can help reduce costs by closing inactive connections, particularly for applications with short-lived connections.
Target Group Efficiency:
Review the number of targets in each target group under the Target Groups section. Ensure that instances are optimally utilized and that there are no underutilized resources that could be decommissioned or scaled down to reduce costs.
Access Logs:
If Access logs are enabled, ensure the S3 bucket used for logging is configured to transition older logs to cost-effective storage classes like S3 Glacier. This minimizes long-term storage costs.
Under the Listeners tab, review the listener rules to ensure that they are optimally configured for routing requests based on path patterns, host headers, or HTTP methods. Proper routing helps direct traffic efficiently to the right target group, improving application performance.
Load Balancer Attributes:
In the Attributes section of the load balancer, check for settings like Cross-Zone Load Balancing. When enabled, this feature ensures that traffic is evenly distributed across targets in all enabled Availability Zones, optimizing performance.
Monitoring Metrics:
In the Monitoring tab, look at metrics like Target Response Time and HTTP Code 4XX/5XX Count. These metrics help identify potential performance bottlenecks, allowing for proactive optimizations.
Log in to the AWS Management Console of securitytooling account.
AWS Config:
If AWS Config is enabled, use it to review compliance with organizational policies related to ALBs. For example, verify that all ALBs are configured with secure listener protocols (HTTPS) and that logging is enabled.
Security Hub:
If AWS Security Hub is available, navigate to it and review any security findings related to the ALB configurations, such as unsecured HTTP listeners or overly permissive security groups.