Pick the balancer by which headers and ports you must inspect, not by the logo on the console. Layer-4 NLB paths stay cheap when you only need port and IP affinity, health on TCP, and TLS passthrough to the backend that owns the certificate. Layer-7 ALB paths earn their cost when you need host or path rules, header-based canaries, or to terminate TLS once at the edge and speak plain to a private target group. Mixing both usually means the wrong layer is rewriting Host or draining mid-flight.
Ops prove-out after a cutover: send a sticky canary Host through the new listener and confirm target health, certificate SAN, and drain behaviour under a rolling replace. Watch connection resets while targets leave the pool — a spike usually means the idle timeout or deregistration delay is shorter than your long poll. After switching layers, compare p99 and active flow count at the same RPS; if L7 latency jumps with no backend change, you are paying for inspection you do not use.
Edge Ops
Pick the balancer by which headers and ports you must inspect, not by the logo on the console. Layer-4 NLB paths stay cheap when you only need port and IP affinity, health on TCP, and TLS passthrough to the backend that owns the certificate. Layer-7 ALB paths earn their cost when you need host or path rules, header-based canaries, or to terminate TLS once at the edge and speak plain to a private target group. Mixing both usually means the wrong layer is rewriting Host or draining mid-flight.
Ops prove-out after a cutover: send a sticky canary Host through the new listener and confirm target health, certificate SAN, and drain behaviour under a rolling replace. Watch connection resets while targets leave the pool — a spike usually means the idle timeout or deregistration delay is shorter than your long poll. After switching layers, compare p99 and active flow count at the same RPS; if L7 latency jumps with no backend change, you are paying for inspection you do not use.