Check ID:
Provider: AWS
Service:
Severity: MEDIUM
Categories:
Resource type:
elb_connection_draining_enabledProvider: AWS
Service:
elbSeverity: MEDIUM
Categories:
resilienceResource type:
AwsElbLoadBalancerWhat this check verifies
Classic Load Balancer has connection draining enabled, so deregistering or unhealthy instances stop receiving new requests while existing connections are allowed to complete within the configured drain window.Risk
Without connection draining, instance removals or health failures can terminate in-flight requests, leading to partial transactions, broken sessions, and inconsistent application state. This reduces availability and can impact data integrity during deployments, scaling, or failover events.Recommendation
Enable connection draining on all Classic Load Balancers and set a drain interval aligned to typical request latency. Coordinate autoscaling and deployments to allow graceful instance shutdowns. Monitor errors and retries to validate behavior and adjust thetimeout conservatively to protect availability and integrity.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://aws.amazon.com/blogs/aws/elb-connection-draining-remove-instances-from-service-with-care/
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/ELB/elb-connection-draining-enabled.html
- https://docs.aws.amazon.com/securityhub/latest/userguide/elb-controls.html#elb-7
- https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/config-conn-drain.html
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = elb_connection_draining_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks