AWS Load Balancers: How Deregistration Delay Ensures Seamless Shutdowns

Table of contents

One Friday evening, Arjun got a page from his monitoring system.
“One of your EC2 instances is showing high error rates. Auto Scaling will replace it shortly.”
He sighed in relief—Auto Scaling would handle it.
But then... some users reported failed requests and broken sessions.
“Why did users get cut off mid-upload?” he asked himself.
That’s when Arjun learned about a quiet hero in AWS Load Balancers:
Connection Draining, also known as Deregistration Delay.
🧠 What Is Connection Draining / Deregistration Delay?
When an EC2 instance is:
Being removed from a load balancer
Marked unhealthy
Or getting terminated by Auto Scaling
The load balancer needs to stop sending it new requests — but also let existing users finish their sessions gracefully.
That’s exactly what Connection Draining (in Classic Load Balancer) and Deregistration Delay (in Application or Network Load Balancer) do.
📘 SAA Tip:
The concept is the same, but the name depends on the load balancer:
Load Balancer Type | Feature Name |
Classic Load Balancer (CLB) | Connection Draining |
Application Load Balancer (ALB) | Deregistration Delay |
Network Load Balancer (NLB) | Deregistration Delay |
🚦 Why Is This Important?
Without connection draining:
An instance that’s in use could be cut off immediately
In-flight requests (like file uploads, payments) may fail abruptly
Users can experience errors or partial actions
With connection draining enabled:
✅ Current users finish their requests
✅ No new traffic is sent to that instance
✅ Instance gracefully exits the pool
🧪 Real-Life Example: Arjun’s EC2 Shutdown
Arjun had 3 EC2 instances behind his Application Load Balancer.
Suddenly, one instance started failing health checks. ALB began removing it.
But because Deregistration Delay was enabled, here’s what happened:
Existing users still on that EC2 were allowed to finish their requests
ALB stopped sending new traffic to that instance
Once all sessions ended (or timeout expired), the instance was removed
This avoided interrupted uploads, lost forms, or broken logins.
⏲️ How Long Is the Draining Period?
You can configure the Connection Draining / Deregistration Delay time between:
1 and 3,600 seconds (1 hour)
Default: 300 seconds (5 minutes)
To disable draining entirely, set it to 0
.
⚖️ Choosing the Right Timeout: Arjun’s Tip Sheet
Use Case | Recommended Delay |
Short requests (API calls, page loads) | ⏱️ 30–60 seconds |
Medium requests (file downloads) | ⏱️ 120–300 seconds |
Long sessions (video uploads, chat apps) | ⏱️ 600–900+ seconds |
Testing fast instance replacement | ⏱️ 10–30 seconds |
🛠️ Tip: Balance user experience vs. speed of replacement.
✅ What Happens During the Draining Period?
While an instance is draining:
✅ Existing connections stay active until complete
❌ No new requests go to the instance
✅ Once all connections close (or timeout hits), the instance is removed
“It’s like a restaurant closing:
No new customers allowed in, but the current diners can finish their meal.”
🧠 Summary for SAA Exam
Concept | Explanation |
Connection Draining | Graceful removal of an instance in CLB |
Deregistration Delay | Same feature in ALB/NLB |
Purpose | Let in-flight requests finish before shutting down |
Default Duration | 300 seconds (5 minutes) |
Adjustable? | ✅ Yes — 1 to 3600 seconds |
Set to 0? | Disables the feature (immediate cut-off) |
🎯 Final Thoughts from Arjun
Arjun updated his infrastructure with:
A 300-second deregistration delay
Health checks + Auto Scaling policies
Awareness that graceful exits matter just as much as fast launches
“Now my app scales up and down without hurting users mid-request. That’s true resilience.”
More AWS SAA Articles
Follow me for more such content
Subscribe to my newsletter
Read articles from Jay Tillu directly inside your inbox. Subscribe to the newsletter, and don't miss out.
Written by

Jay Tillu
Jay Tillu
Hello! I'm Jay Tillu, an Information Security Engineer at Simple2Call. I have expertise in security frameworks and compliance, including NIST, ISO 27001, and ISO 27701. My specialities include Vulnerability Management, Threat Analysis, and Incident Response. I have also earned certifications in Google Cybersecurity and Microsoft Azure. I’m always eager to connect and discuss cybersecurity—let's get in touch!