AWS Global Accelerator: Network Performance and Availability

You've spent weeks optimizing your application code, but users in Sydney are still staring at loading spinners. The problem isn't your app—it's the internet. Public internet routing is unpredictable, prone to congestion, and can take minutes to fail over when a region goes down. AWS Global Accelerator fixes this by putting your traffic on AWS's private backbone from the moment it enters the network. It's not a CDN (that's CloudFront) and it's not a DNS-based routing service (that's Route 53). It's a network layer service that gives you static anycast IPs, instant regional failover, and consistent performance. I've seen it cut latency by 40% for a global trading platform and prevent a 5-minute outage from becoming a 30-minute one during an AZ failure. If you're running latency-sensitive or globally distributed workloads, this is the service you're probably not using but should be.

Why Global Accelerator Exists

AWS Global Accelerator (AGA) solves a fundamental problem: the internet is unpredictable. When users connect to your application via an ALB or NLB, traffic traverses the public internet, subject to BGP path selection, ISP congestion, and packet loss. AGA bypasses this by directing traffic to the nearest edge location (anycast IP), then tunneling it over the AWS global network to your origin. This reduces latency by 30-60% and provides instant failover if an endpoint becomes unhealthy. For production workloads, AGA is not optional—it's a necessity for global user bases.

aws globalaccelerator create-accelerator \
  --name prod-accelerator \
  --ip-address-type IPV4 \
  --enabled

Architecture: Listeners, Endpoint Groups, and Endpoints

AGA has three layers: listeners (ports/protocols), endpoint groups (regions), and endpoints (resources). A listener defines the port and protocol (TCP/UDP) that clients connect to. Each listener routes to one or more endpoint groups, which are tied to an AWS region. Each endpoint group contains endpoints like ALBs, NLBs, Elastic IPs, or EC2 instances. Traffic is distributed across endpoint groups based on weights and health checks. This architecture allows fine-grained control over traffic routing, including failover and blue/green deployments.

aws globalaccelerator create-listener \
  --accelerator-arn arn:aws:globalaccelerator::123456789012:accelerator/abc123 \
  --port-ranges From=80,To=80 \
  --protocol TCP \
  --client-affinity NONE

Health Checks and Failover Behavior

AGA performs health checks on endpoints every 10 seconds by default. If an endpoint fails, AGA stops routing traffic to it and fails over to healthy endpoints in the same or other endpoint groups. The failover is near-instantaneous because AGA operates at the network layer—no DNS propagation delays. However, health checks only test TCP connectivity, not application health. For application-level health, you must configure your ALB/NLB health checks separately. AGA's health checks are lightweight and designed for fast detection of network-level failures.

aws globalaccelerator create-endpoint-group \
  --listener-arn arn:aws:globalaccelerator::123456789012:listener/def456 \
  --endpoint-group-region us-east-1 \
  --endpoint-configurations EndpointId=arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-alb/1234567890abcdef,Weight=128,ClientIPPreservationEnabled=true \
  --health-check-port 80 \
  --health-check-protocol TCP \
  --health-check-interval-seconds 10 \
  --threshold-count 3

Traffic Flow and Client IP Preservation

By default, AGA preserves the client IP address when forwarding traffic to endpoints. This is critical for logging, rate limiting, and geo-blocking. When client IP preservation is enabled, the endpoint sees the original client IP in the packet headers. However, this requires that the endpoint (e.g., ALB) supports proxy protocol or X-Forwarded-For headers. For NLB, you must enable proxy protocol v2. Without preservation, the endpoint sees the AGA edge IP, which breaks many security and analytics use cases.

aws globalaccelerator update-endpoint-group \
  --endpoint-group-arn arn:aws:globalaccelerator::123456789012:endpoint-group/ghi789 \
  --endpoint-configurations EndpointId=arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-alb/1234567890abcdef,Weight=128,ClientIPPreservationEnabled=true

Weighted Routing and Blue/Green Deployments

AGA supports weighted routing across endpoint groups and endpoints. You can assign weights (0-255) to control traffic distribution. This enables blue/green deployments: create a new endpoint group with weight 0, gradually increase weight as you validate, and finally set old group to 0. Unlike DNS-based weighting, AGA's weighting is instant because it's at the network layer. You can also use weights for canary releases, A/B testing, or regional load balancing.

# Step 1: Add new endpoint group with weight 0
aws globalaccelerator create-endpoint-group \
  --listener-arn arn:aws:globalaccelerator::123456789012:listener/def456 \
  --endpoint-group-region us-west-2 \
  --endpoint-configurations EndpointId=arn:aws:elasticloadbalancing:us-west-2:123456789012:loadbalancer/app/my-alb-v2/abcdef123456,Weight=0,ClientIPPreservationEnabled=true \
  --health-check-port 80

# Step 2: Gradually increase weight (e.g., to 10)
aws globalaccelerator update-endpoint-group \
  --endpoint-group-arn arn:aws:globalaccelerator::123456789012:endpoint-group/new-ghi789 \
  --endpoint-configurations EndpointId=arn:aws:elasticloadbalancing:us-west-2:123456789012:loadbalancer/app/my-alb-v2/abcdef123456,Weight=10,ClientIPPreservationEnabled=true

# Step 3: After validation, shift all traffic to new group and remove old

Integration with AWS WAF and Shield

AGA integrates with AWS WAF and Shield Advanced for DDoS protection. You can associate a WAF web ACL with your AGA listener to filter malicious traffic before it reaches your origin. This is more efficient than WAF at the ALB because it blocks traffic at the edge, reducing load on your backend. Shield Advanced provides additional DDoS mitigation and cost protection. However, WAF rules that inspect request body or headers may add latency; use rate-based rules and IP sets for edge blocking.

aws wafv2 associate-web-acl \
  --web-acl-arn arn:aws:wafv2:us-east-1:123456789012:global/webacl/my-waf/abc123 \
  --resource-arn arn:aws:globalaccelerator::123456789012:accelerator/abc123

Cost Optimization and Reserved Capacity

AGA pricing consists of an hourly fee per accelerator plus data transfer costs per GB. Data transfer over the AWS global network is cheaper than internet transfer, but AGA adds a premium. For high-traffic workloads, costs can add up. To optimize, use reserved capacity (1-year or 3-year terms) for predictable traffic, which reduces hourly fees by up to 40%. Also, consider using AGA only for regions with high latency or reliability requirements—not for all traffic.

aws globalaccelerator purchase-reserved-accelerator \
  --accelerator-arn arn:aws:globalaccelerator::123456789012:accelerator/abc123 \
  --term 1year \
  --payment-option ALL_UPFRONT

Monitoring and Troubleshooting with CloudWatch and Flow Logs

AGA publishes CloudWatch metrics: AcceleratorBytesIn/Out, AcceleratorPacketsIn/Out, and HealthCheckEndpointStatus. Use these to monitor throughput and endpoint health. For deeper troubleshooting, enable VPC Flow Logs on the endpoints to see traffic patterns. AGA does not support its own flow logs, but you can correlate CloudWatch metrics with endpoint logs. Common issues: health check failures due to security groups, client IP preservation misconfiguration, and weight misalignment.

aws cloudwatch put-metric-alarm \
  --alarm-name AGA-HealthCheck-Failure \
  --alarm-description "Alarm when any endpoint group has unhealthy endpoints" \
  --metric-name HealthCheckEndpointStatus \
  --namespace AWS/GlobalAccelerator \
  --statistic Minimum \
  --period 60 \
  --evaluation-periods 2 \
  --threshold 1 \
  --comparison-operator LessThanThreshold \
  --dimensions Name=Accelerator,Value=arn:aws:globalaccelerator::123456789012:accelerator/abc123 Name=EndpointGroup,Value=arn:aws:globalaccelerator::123456789012:endpoint-group/ghi789 \
  --alarm-actions arn:aws:sns:us-east-1:123456789012:my-topic

Limitations and Gotchas

AGA has several limitations: it only supports TCP and UDP (no HTTP/2 multiplexing at edge), maximum of 10 accelerators per account (soft limit), and endpoints must be in the same AWS account. Also, AGA does not support custom domain names on the accelerator IPs—you must use CNAME or Route53 alias. Client IP preservation requires proxy protocol for NLB. And AGA cannot be used with CloudFront directly; you must choose one or the other for a given origin.

aws route53 change-resource-record-sets \
  --hosted-zone-id ZONEID \
  --change-batch '{
    "Changes": [
      {
        "Action": "UPSERT",
        "ResourceRecordSet": {
          "Name": "app.example.com",
          "Type": "A",
          "AliasTarget": {
            "HostedZoneId": "Z2B2E5Z8U4YQ1O",
            "DNSName": "abc123.awsglobalaccelerator.com",
            "EvaluateTargetHealth": false
          }
        }
      }
    ]
  }'

Real-World Production Architecture

A typical production setup: Route53 alias points to AGA anycast IP. AGA listener on port 443 routes to two endpoint groups: us-east-1 (primary, weight 100) and eu-west-1 (secondary, weight 0). Each endpoint group has an ALB with EC2 targets. WAF web ACL attached to AGA blocks SQL injection and rate-limits. CloudWatch alarms monitor health check status. During a us-east-1 outage, we shift weight to eu-west-1. This architecture provides low latency, automatic failover, and DDoS protection.

resource "aws_globalaccelerator_accelerator" "prod" {
  name            = "prod-accelerator"
  ip_address_type = "IPV4"
  enabled         = true
}

resource "aws_globalaccelerator_listener" "https" {
  accelerator_arn = aws_globalaccelerator_accelerator.prod.id
  port_ranges {
    from_port = 443
    to_port   = 443
  }
  protocol = "TCP"
}

resource "aws_globalaccelerator_endpoint_group" "us_east" {
  listener_arn = aws_globalaccelerator_listener.https.id
  endpoint_group_region = "us-east-1"
  health_check_port     = 443
  health_check_protocol = "TCP"
  endpoint_configuration {
    endpoint_id = aws_lb.primary.arn
    weight      = 100
    client_ip_preservation_enabled = true
  }
}

resource "aws_globalaccelerator_endpoint_group" "eu_west" {
  listener_arn = aws_globalaccelerator_listener.https.id
  endpoint_group_region = "eu-west-1"
  health_check_port     = 443
  health_check_protocol = "TCP"
  endpoint_configuration {
    endpoint_id = aws_lb.secondary.arn
    weight      = 0
    client_ip_preservation_enabled = true
  }
}