AWS Load Balancers: How Deregistration Delay Ensures Seamless Shutdowns

Jay TilluJay Tillu
4 min read

One Friday evening, Arjun got a page from his monitoring system.

“One of your EC2 instances is showing high error rates. Auto Scaling will replace it shortly.”

He sighed in relief—Auto Scaling would handle it.

But then... some users reported failed requests and broken sessions.

“Why did users get cut off mid-upload?” he asked himself.

That’s when Arjun learned about a quiet hero in AWS Load Balancers:
Connection Draining, also known as Deregistration Delay.


🧠 What Is Connection Draining / Deregistration Delay?

When an EC2 instance is:

  • Being removed from a load balancer

  • Marked unhealthy

  • Or getting terminated by Auto Scaling

The load balancer needs to stop sending it new requests — but also let existing users finish their sessions gracefully.

That’s exactly what Connection Draining (in Classic Load Balancer) and Deregistration Delay (in Application or Network Load Balancer) do.

📘 SAA Tip:
The concept is the same, but the name depends on the load balancer:

Load Balancer TypeFeature Name
Classic Load Balancer (CLB)Connection Draining
Application Load Balancer (ALB)Deregistration Delay
Network Load Balancer (NLB)Deregistration Delay

🚦 Why Is This Important?

Without connection draining:

  • An instance that’s in use could be cut off immediately

  • In-flight requests (like file uploads, payments) may fail abruptly

  • Users can experience errors or partial actions

With connection draining enabled:

✅ Current users finish their requests
✅ No new traffic is sent to that instance
✅ Instance gracefully exits the pool


🧪 Real-Life Example: Arjun’s EC2 Shutdown

Arjun had 3 EC2 instances behind his Application Load Balancer.

Suddenly, one instance started failing health checks. ALB began removing it.

But because Deregistration Delay was enabled, here’s what happened:

  1. Existing users still on that EC2 were allowed to finish their requests

  2. ALB stopped sending new traffic to that instance

  3. Once all sessions ended (or timeout expired), the instance was removed

This avoided interrupted uploads, lost forms, or broken logins.


⏲️ How Long Is the Draining Period?

You can configure the Connection Draining / Deregistration Delay time between:

  • 1 and 3,600 seconds (1 hour)

  • Default: 300 seconds (5 minutes)

To disable draining entirely, set it to 0.


⚖️ Choosing the Right Timeout: Arjun’s Tip Sheet

Use CaseRecommended Delay
Short requests (API calls, page loads)⏱️ 30–60 seconds
Medium requests (file downloads)⏱️ 120–300 seconds
Long sessions (video uploads, chat apps)⏱️ 600–900+ seconds
Testing fast instance replacement⏱️ 10–30 seconds

🛠️ Tip: Balance user experience vs. speed of replacement.


✅ What Happens During the Draining Period?

While an instance is draining:

  • ✅ Existing connections stay active until complete

  • ❌ No new requests go to the instance

  • ✅ Once all connections close (or timeout hits), the instance is removed

“It’s like a restaurant closing:
No new customers allowed in, but the current diners can finish their meal.”


🧠 Summary for SAA Exam

ConceptExplanation
Connection DrainingGraceful removal of an instance in CLB
Deregistration DelaySame feature in ALB/NLB
PurposeLet in-flight requests finish before shutting down
Default Duration300 seconds (5 minutes)
Adjustable?✅ Yes — 1 to 3600 seconds
Set to 0?Disables the feature (immediate cut-off)

🎯 Final Thoughts from Arjun

Arjun updated his infrastructure with:

  • A 300-second deregistration delay

  • Health checks + Auto Scaling policies

  • Awareness that graceful exits matter just as much as fast launches

“Now my app scales up and down without hurting users mid-request. That’s true resilience.”

More AWS SAA Articles

Follow me for more such content

0
Subscribe to my newsletter

Read articles from Jay Tillu directly inside your inbox. Subscribe to the newsletter, and don't miss out.

Written by

Jay Tillu
Jay Tillu

Hello! I'm Jay Tillu, an Information Security Engineer at Simple2Call. I have expertise in security frameworks and compliance, including NIST, ISO 27001, and ISO 27701. My specialities include Vulnerability Management, Threat Analysis, and Incident Response. I have also earned certifications in Google Cybersecurity and Microsoft Azure. I’m always eager to connect and discuss cybersecurity—let's get in touch!