Check ID: elb_connection_draining_enabled
Provider: AWS
Service: elb
Severity: MEDIUM
Categories: resilience
Resource type: AwsElbLoadBalancer

What this check verifies

Classic Load Balancer has connection draining enabled, so deregistering or unhealthy instances stop receiving new requests while existing connections are allowed to complete within the configured drain window.

Risk

Without connection draining, instance removals or health failures can terminate in-flight requests, leading to partial transactions, broken sessions, and inconsistent application state. This reduces availability and can impact data integrity during deployments, scaling, or failover events.

Recommendation

Enable connection draining on all Classic Load Balancers and set a drain interval aligned to typical request latency. Coordinate autoscaling and deployments to allow graceful instance shutdowns. Monitor errors and retries to validate behavior and adjust the timeout conservatively to protect availability and integrity.

Remediation

aws elb modify-load-balancer-attributes --load-balancer-name <example_resource_name> --load-balancer-attributes '{"ConnectionDraining":{"Enabled":true}}'

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elb_connection_draining_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks