← All cloud projects
CASE STUDY us-east-1 2026
CLOUD PROJECT · 2026

Path-based and host-based routing on one load balancer

Two instances, one load balancer, and the same fleet addressed two different ways — first by URL path, then by host header. Short project, but it's the vocabulary the deployment and troubleshooting work depends on, and the health-check detail is the part people get wrong.

ALBTarget GroupsEC2S3IAMRoute 53

Built, measured and torn down on 5 August 2026 in us-east-1. Total cost $0.14. The infrastructure no longer exists — the code and write-up are in the repo.

The setup

Two instances in different availability zones, each pulling its site content from S3 at boot through an instance profile scoped to that one bucket — not S3FullAccess, which is what the source material attaches. Two target groups. One load balancer.

Then the same fleet addressed two ways:

Path-based. /red* → the red target group, /blue* → blue. One hostname, routing decided by URL.

Host-based. The path rules deleted and replaced with host-header conditions — red.lab.andruxa.dev and blue.lab.andruxa.dev → their respective groups, with Route 53 alias records pointing both names at the same balancer.

ClientAWS CloudRoute 53alias recordsus-east-1ALBlistener rulesAZ aEC2 instanceredIAM roleinstance profileAZ bEC2 instanceblueS3 bucketcolour pagesDNSaliasred TGblue TGat bootat boot404

Request path: client → Route 53 alias → ALB listener rules → red or blue target group → its EC2 instance, and no match → a fixed 404 back to the client. Boot path: each instance pulls its page from S3 through a bucket-scoped instance profile.

requestfailure / failover Hover, tap or Tab to a component to see what it does and why. Swipe sideways for the whole diagram.

The detail worth keeping

Health checks should ask for something specific. Each target group checks its own colour’s page — /red/index.html, not /. A check on / passes whenever the web server is up, which means a target can be “healthy” while serving nothing the rule will ever route to it. Pointing the check at the actual content is the difference between knowing the server is running and knowing the application works.

The default action matters as much as the rules. I set the listener’s default to a fixed 404 response rather than forwarding to a target group. The source material forwards by default, which means a request that matches no rule still gets a page — so a broken or missing rule looks like success. An explicit 404 makes rule misses visible immediately.

Where the source material was incomplete

The exercise depends on a code bundle that wasn’t in the course export — user-data scripts, a bucket policy, and the two pages. Rather than chase the download I wrote the four files, which took ten minutes and meant they live in the repo instead of a zip file someone has to find.

What it cost

$0.14 for the afternoon. The load balancer is the only meaningful component: ~$16/month if left running, billed for existing whether or not a single request arrives. That’s the pattern behind most of these projects — the compute is pennies, the load balancer is the meter.