AWS Abandoned Classic Load Balancer Detector
Identify legacy Classic Load Balancers with zero registered healthy instances or zero traffic incurring legacy hourly charges.
1. Detection Scope & Operational Boundaries
Every ArthaOps detector enforces strict epistemic honesty. We clearly separate what can be mathematically proven via agentless telemetry from what requires contextual human judgement.
What This Detector Identifies
- Classic Load Balancers (CLBs) where registered instance count is 0 for $\ge 7$ days.
- CLBs where CloudWatch HealthyHostCount is 0 and RequestCount is 0 across 14 consecutive days.
- Legacy balancers left behind following migration to Application Load Balancers (ALBs).
What It Cannot Establish Alone
- Whether external DNS records (Route 53 or external registrars) still point an active domain to the CLB DNS name.
- Whether backend Auto Scaling Groups (ASGs) or ECS services are intentionally scaled to zero (e.g. night-time dev environment teardown or temporary off-hours pause).
- Whether the balancer serves as an inactive standby target in a blue/green or disaster recovery deployment topology.
2. Telemetry & Evidence Requirements
ArthaOps operates strictly via Plane 1 (Read-Only Discovery). The following CloudFormation / IAM permissions and CloudWatch metrics are evaluated:
AWS::ElasticLoadBalancing::LoadBalancerVerification Protocol: Tested against simulated Classic Load Balancer fixtures with zero registered instances.
Validation Context: Validated in customer AWS accounts identifying legacy CLBs created years ago and never deleted.
3. Reproducible AWS CLI Verification Recipe
List all Classic Load Balancers in ap-south-1 and check registered instances.
# List Classic Load Balancers with instance count
aws elb describe-load-balancers \
--region ap-south-1 \
--query "LoadBalancerDescriptions[*].{Name:LoadBalancerName,Instances:length(Instances),DNSName:DNSName}" \
--output table---------------------------------------------------------------------------------------------------
| DescribeLoadBalancers |
+--------------------------------------------------------------+------------+---------------------+
| DNSName | Instances | Name |
+--------------------------------------------------------------+------------+---------------------+
| legacy-api-clb-12345.ap-south-1.elb.amazonaws.com | 0 | legacy-api-clb |
+--------------------------------------------------------------+------------+---------------------+💡 Instances == 0 indicates zero backend EC2 instances are registered to receive traffic.
4. Transparent Economic Model
- 730 billable hours per standard calendar month.
- Zero data processing fees included as balancer receives zero requests.
- LCU charges apply to ALBs/NLBs, whereas CLBs bill on pure hourly + bandwidth rates.
5. False-Positive Scenarios & Operational Risks
Never delete or terminate cloud resources blindly. These validated architectural scenarios must be reviewed before initiating remediation:
Documented False-Positive Scenarios
- Auto-Scaling Group Scale-to-Zero: An ASG configured to register instances dynamically may currently be scaled to 0 desired capacity during scheduled off-hours (e.g. night-time dev/staging shutdowns).
- Blue/Green Deployment Standby: Balancers provisioned as inactive standby targets for green deployments that receive health checks or staged traffic only during cutovers.
Blast Radius & Remediation Risks
- DNS Failure: If Route 53 or third-party DNS still points to the CLB DNS name, deleting the load balancer causes instant NXDOMAIN / HTTP 503.
6. Remediation Procedure & Rollback Runbook
Follow this ordered sequence of verified AWS CLI actions to remediate the resource with complete rollback availability:
Audit Route 53 DNS Aliases
Confirm no active domains point to this load balancer.
aws route53 list-resource-record-sets --hosted-zone-id Z1234567890 --query "ResourceRecordSets[?AliasTarget.DNSName!=null]"Delete the Classic Load Balancer
Decommission the idle load balancer.
aws elb delete-load-balancer --region ap-south-1 --load-balancer-name legacy-api-clbForensic Rollback Procedure
Deleted Classic Load Balancers cannot be undeleted. A new load balancer must be provisioned (ideally an ALB) and DNS updated.
🔒 ArthaOps Assurance: ArthaOps requires confirmation of zero DNS associations and zero ASG attachments before deletion.
CLBs cannot be restored in-place once deleted; recreation provisions a new DNS name.
How This Appears in the ArthaOps Control Plane
Classic Load Balancer has had 0 registered instances and 0 HTTP requests for over 90 days.
Test Your Infrastructure in 180 Seconds
Explore our zero-setup interactive sample report covering real Mumbai findings, or launch a 100% read-only agentless scan across your AWS environment.