Card 05/ 09
Which Layer a Cloud Component Works At
A security group, a network load balancer, an application load balancer and a CDN each read a different header.
A cloud component works at the layer of the deepest header it reads. A route table reads destination IP addresses, layer 3. A security group and a network load balancer read addresses and ports, layer 4. An application load balancer and a CDN read HTTP, the path, host and headers, layer 7. The layer decides what each component can do and which errors it can produce.
| Component | Reads | Layer | So it can |
|---|---|---|---|
| Route table | Destination IP address | 3 | Send a packet to a gateway or another network |
| Security group | IP addresses, protocol and port | 3 and 4 | Allow or drop traffic, remembering open connections |
| Network load balancer | IP addresses and TCP or UDP ports | 4 | Spread connections without reading their content |
| Application load balancer | HTTP method, host, path and headers | 7 | Route by path, end TLS, answer with HTTP errors |
| CDN, such as CloudFront | HTTP request and cache headers | 7 | Cache responses near users and end TLS |
The name misleads for the network load balancer. "Network" suggests layer 3, but it balances TCP and UDP connections by port, so it is a layer 4 device. It passes the bytes through untouched, which is why it can carry any protocol and preserve the client's address.
Layer 7 components end the connection. An application load balancer accepts the client's TCP and TLS connection, reads the HTTP request, then opens its own connection to a target. Two connections, not one, which is why it can route by path and why it reports its own errors: a 502 Bad Gateway when the target's reply is unusable or the connection to it fails, a 503 when it has no healthy target, and a 504 when the target does not answer in time.
Layer 4 filters do not answer back. A security group drops traffic it does not allow without a reply, so a blocked port looks like a timeout, never a refusal.
The layer sets where to look. An HTTP error with the load balancer's own page means the fault is between it and the target, not between the client and it.
So place each component by the header it reads, and its abilities and errors follow.
← → move through sections and cards