Description in the deregistration delay section is not clear - looks like it was copied over from ALB. For NLB, "stops sending requests" could be changed to "stops opening new connections".

Document for NLB S3 access log does not say clearly that it only support SSE-S3, no other encryption option (like KMS) is supported.

Rather than:
Enable server-side encryption with Amazon S3-Managed Encryption Keys (SSE-S3)
which is on https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-access-logs.html#:~:text=that%20you%20specify.-,Enable%20server-side%20encryption%20with%20Amazon%20S3-Managed%20Encryption%20Keys%20(SSE-S3),-.

We can say:
Amazon S3-Managed Encryption Keys (SSE-S3) is required. No other encryption options are supported

Hello,
The table is confusing:

• e.g using bytes vs octets
  PP2_SUBTYPE_AWS_VPCE_ID (0x01)- using description such as "PP2_TYPE_AWS (0xEA)" and "" for both Type and Value.
• use of "length of value" and "value length" sentences in the same table

Thanks for reporting this. I also saw that you provided the same feedback through the feedback link on the HTML docs. I forwarded that feedback to the marketing team so they can update the site.

Originally posted by @julieso in awsdocs/elb-user-guide#1 (comment).

https://aws.amazon.com/elasticloadbalancing/features/#Product_comparisons

The table contains an error with regards to VPC security group option for the "Network Load Balancer"

The issue seems to be in the page source . Specifically with HTML element :

<tr> <td colspan="4" height="19" width="697" style="text-align: center;"><b>Security</b></td> </tr>

I believe you can fix this by modifying the page source as follows :

       <tr> 
       <td height="60" width="178">Security Groups</td> 
       <td width="158">✔</td> 
       <td width="152">&nbsp;</td> 
       <td width="209">✔</td> 
      </tr>

==

Regards,

Manuel Hubbard

Could you please clarify what happens to the existing non-idle connections once a target becomes unhealthy (due to http health check failure, etc)?
Do they stay open until closed by one of the parties?
"Deregistration delay" section implies that the connections are closed:

To ensure that existing connections are closed, you can ensure that the instance is unhealthy before you deregister it, or you can periodically close client connections.

https://github.com/awsdocs/elb-network-load-balancers-user-guide/blob/8c7ea44e1c34d8938050c5eeb71e63fb861d61a7/doc_source/load-balancer-target-groups.md#deregistration-delay