Explanation
Why the waste happens and who it affects.
This often happens after network topology changes, security architecture updates, or environment deprecations. Without active packet forwarding, the GLB provides no functional benefit but still incurs hourly charges, along with charges for any associated Gateway Load Balancer endpoints.
Idle Gateway Load Balancer endpoints can also exist while the Gateway Load Balancer itself is busy: in centralized inspection designs each spoke VPC gets its own endpoints, and when a spoke VPC is retired or its route tables stop sending traffic to the endpoint, that endpoint keeps billing even though the shared load balancer still processes traffic for other VPCs.
Billing model
The pricing dimensions that drive this cost.
Gateway Load Balancers are billed for each hour or partial hour of operation plus the Gateway Load Balancer Capacity Units (GLCU) consumed. Gateway Load Balancer endpoints in consumer VPCs are priced and billed separately under AWS PrivateLink. Hourly charges continue to accrue even if the load balancer is not actively forwarding traffic, so idle GLBs and their endpoints result in ongoing costs without delivering operational value.
- GWLB endpoint-hours
- Each Gateway Load Balancer endpoint is priced and billed separately under AWS PrivateLink, with an hourly charge plus a per-GB data processing charge
How to detect
7 checks to find it in your estate.
- Identify Gateway Load Balancers with no active traffic or minimal packet forwarding over a representative time window
- Confirm there are no attached target appliances or ongoing inspection flows depending on the load balancer
- Review networking configurations, route tables, and security group dependencies to validate safe removal
- Check tagging and documentation to identify whether the GLB was associated with a retired or migrated environment
- Validate findings with security or network operations teams before deletion
- Review the Trusted Advisor cost optimization check Inactive Gateway Load Balancer endpoints, which flags endpoints that processed 0 bytes in the last 30 days and reports the VPC endpoint ID, VPC, subnet, service name and TotalBytesProcessed
- Check spoke VPC route tables for routes that target each Gateway Load Balancer endpoint; an endpoint that no route table references cannot receive traffic, even when the load balancer behind it is active
How to fix
2 ways to remove the waste.
If confirmed to be inactive, delete the associated Gateway Load Balancer endpoints and endpoint service along with the load balancer through the AWS Console, CLI, or API to stop further billing. Where possible, document the reason for decommissioning and update tagging or inventory systems to prevent reaccumulation of unused resources.
- Delete individual Gateway Load Balancer endpoints that processed no data and are no longer referenced by route tables, even when the Gateway Load Balancer and its endpoint service must stay for other VPCs
- Where Transit Gateway already connects the VPCs, consider a centralized inspection architecture with endpoints in one inspection VPC instead of endpoints in every spoke VPC, which Trusted Advisor suggests to reduce hourly charges on inactive endpoints
Documentation
Vendor references for pricing and configuration.