Five functional categories, three clouds, a dozen-plus SKUs — and one architectural fork that splits the hyperscalers down the middle. Here's the map.
Strip the vendor names away and every hyperscaler's load balancing portfolio resolves to the same five functional patterns.
The first dividing line between the three clouds isn't a feature — it's a philosophy.
A single anycast IP fronts backends across multiple regions natively. No bolt-on required — this is the base behavior of GCP's global external Application Load Balancer.
Each load balancer lives in one region. Global reach requires a separate edge layer — AWS Global Accelerator or Azure Front Door — stacked in front.
The second fork: who has a purpose-built primitive for transparently steering traffic through third-party firewalls and IDS appliances.
Gateway Load Balancer (AWS) and Azure Gateway Load Balancer are dedicated L3 primitives — purpose-built, standardized, route-table integrated.
Closest pattern uses Private Service Connect producer/consumer architecture — fundamentally different mechanics, and considerably less standardized.
the mental model: if you remember nothing else — GCP optimizes for "one IP, anywhere." AWS and Azure optimize for "one region, then layer global on top." Appliance insertion is AWS and Azure's answer to a problem GCP hasn't formally solved yet.
Every product name, every layer, every status flag. Including two Azure retirements that matter right now.
the flattest portfolio — four types, no internal tiering, consumption-based capacity units
| sku | layer | mechanism | status |
|---|---|---|---|
| ALB | L7 | HTTP/HTTPS/WebSocket/gRPC, path/host/header routing → EC2, IP, Lambda, ECS/EKS | default choice |
| NLB | L4 | flow-hash TCP/UDP/TLS, static IP per AZ, source IP preserved, millions of conns/sec | current |
| GWLB | L3 | GENEVE encapsulation (port 6081), GWLBe (PrivateLink-based), transparent appliance insertion | current |
| CLB | L4/L7 | round-robin or least-outstanding-requests, no WAF, no WebSocket/HTTP2 | legacy |
| global accelerator | L4 | static anycast IPs at the edge → NLB / ALB / EC2 / EIP. accelerates any TCP/UDP, not just HTTP | separate product |
Hourly base (~$0.0225/hr) + capacity-unit consumption — LCU for ALB, NLCU for NLB, GLCU for GWLB.
Global Accelerator is the only global-edge product across all three clouds that accelerates any TCP/UDP app — not just HTTP.
the most tiered lineup — and the most recently re-tiered, with two retirements live right now
two retirements to check before you advise anyone: Basic Load Balancer retired 30 sep 2025. Application Gateway v1 (Standard/WAF) retired 28 apr 2026. Any customer running either needs a migration plan now.
| sku | layer | mechanism | status |
|---|---|---|---|
| standard lb | L4 | TCP/UDP, zone-redundant, outbound rules, HTTPS health probes | current default |
| basic lb | L4 | regional only, no zones, no SLA | retired 9/2025 |
| gateway lb | L3 | GENEVE, chains to Standard LB frontend + Private Link consumer model — close port of AWS GWLB | current |
| app gateway v2 standard_v2 / waf_v2 |
L7 | HTTP(S)/WebSocket/HTTP2, path/host routing, autoscaling, dedicated subnet | current |
| app gateway v1 | L7 | no autoscale, manual sizing | retired 4/2026 |
| front door standard / premium |
L7 global | CDN + WAF + global HTTP routing, anycast. premium adds private link origins, bot protection | current |
| traffic manager | DNS | DNS-level geo/priority/performance routing — not a data-plane proxy | distinct category |
Front Door (edge/global) vs. App Gateway (regional/VNet-injected). Teams often reach for App Gateway when they actually need Front Door for global HA.
v2 added autoscaling — the single biggest functional gap that made v1 unsuitable for modern production workloads.
the most unified mental model — three primitives, multiple deployment scopes, global-first
| sku | layer / scope | mechanism | status |
|---|---|---|---|
| global ext. app lb | L7 · global | anycast IP, GFE + Envoy, native multi-region backends | flagship |
| classic app lb | L7 · global/regional | GFE-based legacy — global in Premium Tier, regional-only in Standard Tier | legacy |
| regional ext. app lb | L7 · regional | Envoy-based, single-region backends | current |
| cross-region internal app lb | L7 · multi-region internal | Envoy-based, HA / failover across regions | current |
| regional internal app lb | L7 · regional internal | Envoy + Andromeda stack | current |
| proxy network lb global / regional / internal |
L4 (TCP/SSL proxy) | terminates TCP/SSL, non-HTTP(S) traffic | current |
| passthrough network lb external / internal |
L4 | Direct Server Return, Maglev (ext) / Andromeda (int), broadest protocol range — TCP/UDP/SCTP/ESP/AH/GRE | current |
Network Service Tiers. Premium routes over Google's private backbone; Standard routes over public internet. Not every LB type supports Standard — a real design constraint, not just a cost lever.
Post-quantum key exchange on SSL policies is rolling out now — default-on phased in oct 2026 → oct 2027. Worth tracking for PQC-readiness conversations.
When to actually reach for each pattern, regardless of vendor.
Every category is converging conceptually. The implementations remain stubbornly vendor-specific.
Five categories, three clouds, a dozen-plus SKUs — and the one category without a true equivalent everywhere is appliance insertion. AWS and Azure both built dedicated GENEVE-based primitives because centralized inline inspection chaining was painful enough to warrant new infrastructure. GCP's gap is itself a signal: even the hyperscalers are acknowledging that bump-in-the-wire appliance chaining is a tax worth engineering around.