Skip to main content

🛡️ AWS ELB Classic Load Balancer Connection Draining is disabled🟢

  • Contextual name: 🛡️ Classic Load Balancer Connection Draining is disabled🟢
  • ID: /ce/ca/aws/elb/load-balancer-connection-draining
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: RELIABILITY

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS Classic Load Balancers that have Connection Draining disabled. Connection Draining allows a load balancer to stop routing new requests to instances that are being deregistered or marked unhealthy, while allowing existing in-flight requests to complete within a configured timeout period.

Rationale​

Enabling Connection Draining is critical during instance termination events caused by scale-in activities, maintenance operations, or when the load balancer detects an unhealthy instance and reroutes traffic.

Without Connection Draining, active connections may be terminated abruptly, which can lead to 5xx errors and negatively impact the end-user experience.

Audit​

This policy flags an AWS Classic Load Balancer as INCOMPLIANT when the Connection Draining Enabled is set to false.

Other Load Balancer types are marked as INAPPLICABLE.

Remediation​

Open File

Remediation​

Enable Connection Draining​

Connection Draining ensures that in-flight requests are allowed to complete before instances are deregistered or terminated.

From Command Line​

Run the following AWS CLI command to enable Connection Draining and configure the timeout period (in seconds) for the selected Classic Load Balancer:

aws elb modify-load-balancer-attributes \
    --load-balancer-name {{lb-name}} \
    --load-balancer-attributes ConnectionDraining={Enabled=true,Timeout={{300}}}

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ELB.7] Classic Load Balancers should have connection draining enabled1no data
💼 Cloudaware Framework → 💼 System Configuration69no data
💼 FedRAMP High Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)3147no data
💼 FedRAMP Low Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)45no data
💼 FedRAMP Moderate Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)347no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks54no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-2 Baseline Configuration746no data