These rules identify load balancers across all types (ALB, CLB, GWLB, NLB) with no registered targets or negligible traffic. Idle load balancers incur minimum hourly charges with no traffic flowing through them.
| Rule ID | Scan Type | Severity | Name |
|---|---|---|---|
| CLDBRN-AWS-ELB-1 | Discovery | Medium | Application Load Balancer Without Targets |
| CLDBRN-AWS-ELB-2 | Discovery | Medium | Classic Load Balancer Without Instances |
| CLDBRN-AWS-ELB-3 | Discovery | Medium | Gateway Load Balancer Without Targets |
| CLDBRN-AWS-ELB-4 | Discovery | Medium | Network Load Balancer Without Targets |
| CLDBRN-AWS-ELB-5 | Discovery | Medium | Load Balancer Idle |
CLDBRN-AWS-ELB-1
Application Load Balancer Without Targets
Scan type: Discovery
Severity: Medium
What it checks
Flags Application Load Balancers (ALBs) that have no target groups or have target groups with zero registered targets. An ALB with no targets cannot route any traffic and serves no purpose.
Why it matters
ALBs have a minimum hourly charge of approximately $0.022/hour (~$16/month) plus LCU charges, regardless of traffic. An idle ALB with no targets generates this cost indefinitely with zero utility.
What triggers a finding
The ALB has no target groups attached, or every attached target group is known to have zero registered targets. A target group whose registered-target count could not be read does not count as empty, so the ALB is left alone rather than flagged on partial evidence.
How to remediate
Delete the idle ALB. If the ALB was created in anticipation of a future deployment, delete it and recreate it when the deployment is ready — the setup cost is minimal compared to weeks or months of idle charges.
aws elbv2 delete-load-balancer --load-balancer-arn arn:aws:elasticloadbalancing:...
CLDBRN-AWS-ELB-2
Classic Load Balancer Without Instances
Scan type: Discovery
Severity: Medium
What it checks
Flags Classic Load Balancers (CLBs) that have zero EC2 instances attached. Classic Load Balancers are a deprecated generation of AWS load balancers and should be migrated to ALB or NLB in addition to being cleaned up when idle.
Why it matters
CLBs charge per hour regardless of attached instances or traffic volume. An idle CLB with no instances accumulates charges with no benefit. CLBs are also a deprecated service — AWS no longer adds features and the migration path to ALB/NLB provides better functionality at lower cost for most workloads.
What triggers a finding
The CLB has zero instances attached.
How to remediate
Delete the Classic Load Balancer. If it was actively used, migrate to an Application Load Balancer (HTTP/HTTPS) or Network Load Balancer (TCP/UDP) before deleting.
aws elb delete-load-balancer --load-balancer-name my-classic-elb
CLDBRN-AWS-ELB-3
Gateway Load Balancer Without Targets
Scan type: Discovery
Severity: Medium
What it checks
Flags Gateway Load Balancers (GWLBs) that have no target groups or have target groups with zero registered targets. GWLBs with no targets cannot process any traffic.
Why it matters
GWLBs have a minimum hourly charge similar to other load balancer types, plus per-GB data processing fees. An idle GWLB generates base hourly costs with no traffic throughput.
What triggers a finding
The GWLB has no target groups attached, or every attached target group is known to have zero registered targets. A target group whose registered-target count could not be read does not count as empty.
How to remediate
Delete the idle Gateway Load Balancer. GWLBs are typically used for inline network appliances (firewalls, IDS/IPS). If the appliance fleet was decommissioned, the GWLB should be deleted as well.
aws elbv2 delete-load-balancer --load-balancer-arn arn:aws:elasticloadbalancing:...
CLDBRN-AWS-ELB-4
Network Load Balancer Without Targets
Scan type: Discovery
Severity: Medium
What it checks
Flags Network Load Balancers (NLBs) that have no target groups or have target groups with zero registered targets. An NLB with no targets cannot route any traffic.
Why it matters
NLBs charge a minimum hourly fee plus per-NLCU data processing costs. An idle NLB with no registered targets generates base hourly charges with no traffic flowing through it. NLBs are commonly provisioned for services that later get decommissioned, leaving the load balancer behind.
What triggers a finding
The NLB has no target groups attached, or every attached target group is known to have zero registered targets. A target group whose registered-target count could not be read does not count as empty.
How to remediate
Delete the idle Network Load Balancer. If the targets were temporarily removed for a maintenance window, re-register them. Otherwise, clean up the NLB:
aws elbv2 delete-load-balancer --load-balancer-arn arn:aws:elasticloadbalancing:...
CLDBRN-AWS-ELB-5
Load Balancer Idle
Scan type: Discovery
Severity: Medium
What it checks
Flags load balancers whose 14-day average request count stays below 10 requests per day. The request threshold only applies to load balancers with verified HTTP request semantics: Application Load Balancers, and Classic Load Balancers whose listeners are all HTTP or HTTPS. Network and Gateway Load Balancers, and Classic Load Balancers carrying TCP, SSL, or unreadable listeners, are never flagged by request volume, because a request count is not a meaningful measure of their traffic.
This rule only fires when the load balancer is not already flagged by the corresponding empty-targets rule (ELB-1 through ELB-4). The cleanup rules take precedence: an idle load balancer that is also empty is reported once, as an empty load balancer, since deleting it is the same action with stronger evidence behind it.
Why it matters
Load balancers incur an hourly charge regardless of traffic. An ALB costs roughly $16/month in fixed charges plus LCU charges. An NLB charges similarly. A load balancer receiving fewer than 10 requests per day is effectively idle and wasting money.
What triggers a finding
All of the following must be true:
- The load balancer is an ALB, or a Classic Load Balancer with at least one listener protocol where every listener protocol is
HTTPorHTTPS - Request activity for the 14-day window is complete (
requestActivityStatusiscompleteor absent) averageRequestsPerDayLast14Daysis not null AND is less than 10- The load balancer is not already covered by its empty-targets cleanup rule: zero attached instances for a Classic Load Balancer, or no registered targets for the other types
Coverage
A load balancer is reported as unknown when its request semantics are unsupported or its activity evidence is incomplete, unless an empty-targets cleanup rule already settles it. That covers Network and Gateway Load Balancers, Classic Load Balancers with non-HTTP or unreadable listener protocols, and any load balancer whose 14-day request activity came back with a requestActivityStatus of unknown or unsupported or with no usable average. None of these are reported as low-traffic passes. See Live Evaluation Coverage.
How to remediate
Determine whether the service behind the load balancer is still needed. If the service is decommissioned, delete the load balancer, its listeners, and target groups. If the service has minimal traffic, consider using API Gateway or a shared load balancer instead of a dedicated one.
aws elbv2 delete-load-balancer --load-balancer-arn arn:aws:elasticloadbalancing:...
See Also
- CLI discover command — scan live load balancers
- SDK Reference — run discovery programmatically