Infrastructure Security · Topic 3 of 7

Load Balancer, API and DNS Security

Secure entry points with ALB and NLB TLS listeners, API Gateway authorizers and resource policies, mutual TLS, private APIs and Route 53 DNSSEC signing.

5 min

In a nutshell

Attach an ACM certificate and choose a security policy on ALB and NLB TLS listeners. SNI allows several certificates.
ALB can authenticate with Cognito or OIDC before reaching targets, and supports mutual TLS with a trust store.
NLB can pass TLS through to targets, preserving the client certificate handshake for the application.

What it is

Besides CloudFront and WAF, an application has other front doors: load balancers, APIs and DNS. Each has its own controls for encryption, authentication and exposure.

The exam asks you to pick the control that fits the requirement, such as client certificate authentication, private access to an API, or protection against DNS spoofing.

How it works

Elastic Load Balancing

Load balancer	Layer	Security features
Application Load Balancer (ALB)	7	TLS termination, security groups, WAF, authentication with Cognito or OIDC, mutual TLS
Network Load Balancer (NLB)	4	TLS listeners, security groups, passes through client IP, PrivateLink service
Gateway Load Balancer (GWLB)	3	Sends traffic to third party appliances for inspection

For TLS, attach an ACM certificate to the listener and select a security policy that defines the allowed protocol versions and ciphers. Multiple certificates on one listener work through SNI (Server Name Indication). Redirect HTTP port 80 to HTTPS with a listener rule.

An ALB can authenticate users before forwarding. It supports Amazon Cognito user pools and any OpenID Connect (OIDC) identity provider, and it passes verified claims to the target in headers. This keeps authentication code out of the application.

ALB mutual TLS (mTLS) verifies client certificates against a trust store, either in verify mode or in passthrough mode. Choose mTLS when devices or partners must present a certificate. For an NLB, you can pass TLS through to the target so the application does the mutual authentication.

Decide where TLS ends. Terminating at the load balancer lets WAF and routing inspect traffic. To keep traffic encrypted to the instance, re-encrypt to the target with HTTPS, or use TCP passthrough on an NLB.

Amazon API Gateway

API Gateway offers several ways to authenticate and authorize callers.

Method	When to choose it
IAM authorization (SigV4)	Callers are AWS principals, such as services or users with credentials
Amazon Cognito user pool authorizer	End users sign in with a user pool and present a token
Lambda authorizer	Custom logic, third party tokens or complex rules
JWT authorizer (HTTP APIs)	Validate an OIDC or OAuth 2.0 token without code
Resource policy	Allow or deny by source IP, VPC, VPC endpoint or account
Mutual TLS	Clients must present certificates on a custom domain

An API key is not an authentication method. It identifies a client for usage plans and throttling, and it is not a secret to rely on for access control.

A private API is reachable only through an interface VPC endpoint. Use a resource policy to allow calls only from that endpoint. Add throttling, request validation and a WAF web ACL for defence in depth.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Deny",
    "Principal": "*",
    "Action": "execute-api:Invoke",
    "Resource": "execute-api:/*",
    "Condition": { "StringNotEquals": { "aws:SourceVpce": "vpce-0123456789abcdef0" } }
  }]
}

This resource policy denies any call that does not arrive through the named endpoint, and a separate allow statement grants the access.

Route 53 and DNS

DNS can be spoofed, so Amazon Route 53 supports DNSSEC signing for public hosted zones. It adds signatures to your records, and resolvers that validate DNSSEC can detect forged answers.

DNSSEC signing in Route 53 uses a key signing key (KSK) based on an asymmetric AWS KMS key. The KMS key must be in us-east-1 and use the ECC_NIST_P256 key spec. After enabling signing, you add a DS (delegation signer) record at the parent zone, so the chain of trust is complete.

DNSSEC protects the integrity of answers. It does not encrypt queries, and it does not hide them.

Other DNS controls include private hosted zones, which resolve names only inside associated VPCs, and Route 53 Resolver DNS Firewall, covered on the network firewall page. Route 53 health checks with failover help availability but are not security controls.

Putting it together

Choosing

Requirement	Choose
Authenticate users with a corporate OIDC provider before the app	ALB authentication
Clients must present certificates	ALB mTLS or API Gateway mTLS
Only callers inside a VPC can call the API	Private API with a VPC endpoint and resource policy
Callers use AWS credentials	IAM authorization
Token from a third party identity provider	Lambda or JWT authorizer
Prevent forged DNS answers	Route 53 DNSSEC

What to remember for the exam

Attach an ACM certificate and choose a security policy on ALB and NLB TLS listeners. SNI allows several certificates.
ALB can authenticate with Cognito or OIDC before reaching targets, and supports mutual TLS with a trust store.
NLB can pass TLS through to targets, preserving the client certificate handshake for the application.
API Gateway authorization options are IAM, Cognito, Lambda authorizer, JWT authorizer and resource policy. API keys are not authentication.
Private APIs use an interface VPC endpoint and a resource policy with aws:SourceVpce.
API Gateway can use mutual TLS on a custom domain.
Route 53 DNSSEC signing needs an asymmetric KMS key in us-east-1 and a DS record at the parent.
DNSSEC gives integrity, not confidentiality.

Exam tip

When the requirement mentions "users sign in with a corporate identity provider and the application must not handle login", an ALB with OIDC authentication is the usual answer.

Common mistakes

Treating API keys as security. They help with throttling and usage plans, but they are not a safe way to control who may call the API.

Forgetting the DS record. DNSSEC signing without the DS record in the parent zone breaks the chain of trust, and validating resolvers may refuse the answers.

Placing the DNSSEC KMS key in the wrong Region. It has to be in us-east-1.

Assuming WAF protects NLB traffic. It does not, so inspect that traffic another way.

Watch out

Enabling DNSSEC signing and publishing a wrong DS record can make a domain fail to resolve for validating resolvers, so test on a non critical zone first.

Check yourself

Which API Gateway option limits calls to a specific VPC endpoint?
A resource policy with an aws:SourceVpce condition on a private API.
What does ALB mutual TLS verify?
The client certificate, checked against a trust store that you configure.
Where must the KMS key for Route 53 DNSSEC signing live?
In us-east-1, as an asymmetric ECC_NIST_P256 key.

Topic 3 of 7 in Infrastructure Security

Test yourself on Infrastructure Security

The full AWS SCS-C03 question bank has 858 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.