Back to Checks
aws

Classic Load Balancer has connection draining enabled

elb_connection_draining_enabled
Service: elbSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsElbLoadBalancer

Classic Load Balancer has connection draining enabled, so deregistering or unhealthy instances stop receiving new requests while existing connections are allowed to complete within the configured drain window.

Prowler logoProwlerprowler-provider-aws

Risk

Without connection draining, instance removals or health failures can terminate in-flight requests, leading to partial transactions, broken sessions, and inconsistent application state. This reduces availability and can impact data integrity during deployments, scaling, or failover events.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elb_connection_draining_enabled

Recommendation

Enable connection draining on all Classic Load Balancers and set a drain interval aligned to typical request latency. Coordinate autoscaling and deployments to allow graceful instance shutdowns. Monitor errors and retries to validate behavior and adjust the timeout conservatively to protect availability and integrity.

Remediation

CLI

aws elb modify-load-balancer-attributes --load-balancer-name <example_resource_name> --load-balancer-attributes '{"ConnectionDraining":{"Enabled":true}}'

Terraform

# Terraform: Enable connection draining on a Classic Load Balancer
resource "aws_elb" "<example_resource_name>" {
  name               = "<example_resource_name>"
  availability_zones = ["us-east-1a"]

  listener {
    lb_port           = 80
    lb_protocol       = "http"
    instance_port     = 80
    instance_protocol = "http"
  }

  connection_draining = true  # CRITICAL: enables connection draining so existing connections complete
  # connection_draining_timeout can be omitted (defaults to 300s)
}

NativeIaC

# CloudFormation: Enable connection draining on a Classic Load Balancer
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      Listeners:
        - InstancePort: 80
          LoadBalancerPort: 80
          Protocol: HTTP
      AvailabilityZones:
        - us-east-1a
      ConnectionDrainingPolicy:
        Enabled: true  # CRITICAL: turns on connection draining so in-flight requests complete
        # Timeout is optional; default 300s is used if omitted

Other

1Open the EC2 console and go to Load Balancers (Classic)
2Select the Classic Load Balancer
3Choose the Attributes tab, then click Edit
4Check Enable connection draining (leave default timeout or set as needed)
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elb.elb_client import elb_client


class elb_connection_draining_enabled(Check):
    def execute(self) -> list[Check_Report_AWS]:
        findings = []
        for lb in elb_client.loadbalancers.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
            report.status = "PASS"
            report.status_extended = f"ELB {lb.name} has connection draining enabled."

            if not lb.connection_draining:
                report.status = "FAIL"
                report.status_extended = (
                    f"ELB {lb.name} does not have connection draining enabled."
                )

            findings.append(report)

        return findings

References