# Ensure Classic Load Balancer Connection Draining is Enabled - Source: https://support.icompaas.com/support/solutions/articles/62000233349-ensure-classic-load-balancer-connection-draining-is-enabled - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Profile Applicability:** - **Level 2** ### **Description:** Connection Draining for Classic Load Balancers (CLB) ensures that in-flight requests are allowed to complete before instances are deregistered or terminated. When enabled, the load balancer stops routing new requests to instances that are being deregistered but continues to route existing in-flight requests until they complete or the timeout period is reached. This feature is critical during instance replacement, scaling events, or maintenance to ensure a seamless user experience and avoid dropped connections. ### **Rationale:** - Graceful Deregistration: Prevents disruption to users by allowing active connections to complete before terminating or deregistering instances. - Seamless Scaling: Ensures smooth scaling events (both scaling out and scaling in) without impacting active user sessions. - High Availability: Reduces the risk of failed transactions and maintains application availability during changes. - Improved User Experience: Enhances user experience by preventing abrupt termination of requests. ### **Impact:** - **Pros:** - Ensures graceful termination of instances. - Enhances user experience by preventing abrupt disconnections. - Helps maintain application availability during maintenance or scaling events. - **Cons**: - Prolongs the time taken to completely deregister or terminate instances. - May result in a slight delay in scaling down instances if long-lived connections are present. ### **Default Value:** - Connection Draining is disabled by default for Classic Load Balancers. - It must be explicitly enabled and configured with a timeout value (maximum 3600 seconds or 1 hour). ### **Pre-Requisite:** - **IAM Permissions:** - elasticloadbalancing:DescribeLoadBalancers - elasticloadbalancing:ModifyLoadBalancerAttributes - AWS CLI installed and configured. #### **Remediation:** #### **Test Plan:** ##### **Using AWS Console:** 1. Sign in to the [AWS Management Console](https://console.aws.amazon.com/). 2. Navigate to EC2 Dashboard → Load Balancers. ![](https://support.icompaas.com/assets/kb/9a202517771d90a0.png) 3. Select Classic Load Balancers from the left-hand panel. ![](https://support.icompaas.com/assets/kb/42da8ad7e55cd8f7.png) 4. For each Classic Load Balancer: - Select the CLB. - Go to the Description tab. ![](https://support.icompaas.com/assets/kb/10d1a970eefd8497.png) - Under Attributes, check if Connection Draining is enabled. ![](https://support.icompaas.com/assets/kb/184d11456134266c.png) ![](https://support.icompaas.com/assets/kb/061ea66a68411e75.png) - Verify the timeout period (recommended: 300 seconds or higher) ##### **Using AWS CLI:** **Check Connection Draining Status:** aws elb describe-load-balancer-attributes --load-balancer-name --query 'LoadBalancerAttributes.ConnectionDraining' **Expected Output (Pass):** { "Enabled": true, "Timeout": 300 } Fail Output (Disabled): { "Enabled": false, "Timeout": 0 } ### **Implementation Steps:** #### **Using AWS Console:** 1. Sign in to the [AWS Console](https://console.aws.amazon.com/). 2. Navigate to EC2 Dashboard → Load Balancers. ![](https://support.icompaas.com/assets/kb/abe8c4a3629071e5.png) 3. Select the Classic Load Balancer to modify. 4. Under the Description tab, click Edit Attributes. ![](https://support.icompaas.com/assets/kb/3d99f77bf5372837.png) 5. Enable the checkbox for Connection Draining. ![](https://support.icompaas.com/assets/kb/b0af814ff49b7470.png) 6. Set the Timeout (recommended: 300 seconds). 7. Click Save. ![](https://support.icompaas.com/assets/kb/980d98755c5b660b.png) #### **Using AWS CLI:** **Enable Connection Draining with Timeout:** aws elb modify-load-balancer-attributes --load-balancer-name --load-balancer-attributes 'ConnectionDraining={"Enabled":true,"Timeout":300}' 1. Replace with your Classic Load Balancer name. Adjust the Timeout value as needed (maximum is 3600 seconds). **Verify the Changes:** aws elb describe-load-balancer-attributes --load-balancer-name --query 'LoadBalancerAttributes.ConnectionDraining' ### **Backout Plan:** If enabling Connection Draining causes issues: **Using AWS Console:** - Navigate to EC2 Dashboard → Load Balancers. - Select the Classic Load Balancer. - Click Edit Attributes. ![](https://support.icompaas.com/assets/kb/445355eb5b07fe69.png) - Uncheck the Connection Draining option. ![](https://support.icompaas.com/assets/kb/fd48971915323c00.png) - Click Save. ![](https://support.icompaas.com/assets/kb/e39e81691dcde3d7.png) **Using AWS CLI:** aws elb modify-load-balancer-attributes --load-balancer-name --load-balancer-attributes 'ConnectionDraining={"Enabled":false,"Timeout":0}' ### **References:** 1. [AWS CLB Documentation](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-additional-config.html#enable-connection-draining) 2. [AWS CLI - ELB Commands](https://docs.aws.amazon.com/cli/latest/reference/elb/index.html) 3. [Best Practices for Classic Load Balancers](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/best-practices.html) ### **CIS Controls:**

Version	Control ID	Control Description	IG1	IG2	IG3
v8	5.3	Securely Manage Network Infrastructure – Ensure network devices are resilient and fault-tolerant.	●	●	●
v8	13.2	Ensure Secure Network Communication – Implement measures that prevent disruption during network changes.	●	●	●
v7	9.1	Limit Exposure to External Networks – Use techniques like connection draining to ensure reliable connections.	●	●	●

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.