Idle load balancer cost is the hourly fee for a load balancer without targets, an Application Gateway without a backend, an Azure Firewall in front of an empty network, a VPN gateway without a connection or a forwarding rule without a backend service: each of these objects is billed per hour whether a request arrives or not, and most of them come up with an environment and outlive it. The saving comes from deleting a gateway without a target and from merging several load balancers with one application each into one with rules. The fix belongs to the team that owned the application behind it.

Symptom

The bill shows gateway hours without capacity units or bytes. On AWS these are lineItem/UsageType EUC1-LoadBalancerUsage with full hours and EUC1-LCUUsage near zero per load balancer under AWSELB, and EUC1-VPN-Usage-Hours for site-to-site VPN connections. On Azure they are MeterCategory Application Gateway with Fixed Cost hours and no Capacity Units, Azure Firewall with Deployment hours and no Data Processed, VPN Gateway with gateway hours, and Load Balancer with rule hours. On Google Cloud Cloud Load Balancing carries the SKU Forwarding Rule Minimum Service Charge per forwarding rule and Cloud VPN the tunnel hours. What load balancers cost in principle is in load balancers, NAT and public IPs; this page covers the ones without a target.

A load balancer or gatewaywithout a targetThe hour line counts fullhours: LoadBalancerUsage,Fixed Cost, Deployment,gateway hours, ForwardingRule Minimum Service ChargeThe consumption line beside itstays near zero: LCUUsage,Capacity Units, DataProcessed, bytesFull hours and no consumptionfor the same object:the symptom
The hour line of a gateway without a target counts full hours while the capacity or byte line beside it stays near zero

How to detect it

AWS

The load balancers, their target groups and the health of the targets:

aws elbv2 describe-load-balancers --query 'LoadBalancers[].[LoadBalancerName,Type,Scheme,CreatedTime,LoadBalancerArn]' --output table
aws elbv2 describe-target-groups --load-balancer-arn <arn> --query 'TargetGroups[].[TargetGroupName,TargetType,TargetGroupArn]' --output table
aws elbv2 describe-target-health --target-group-arn <target-group-arn> --query 'TargetHealthDescriptions[].[Target.Id,TargetHealth.State]' --output table

A load balancer without a target group or with an empty one is a candidate; for one with targets, the CloudWatch metrics RequestCount, ActiveConnectionCount and ConsumedLCUs in the AWS/ApplicationELB namespace over two weeks show whether traffic flows; RequestCount is reported only when targets are registered (ALB metrics). VPN connections and their tunnel status: aws ec2 describe-vpn-connections --query 'VpnConnections[].[VpnConnectionId,State,VgwTelemetry[].Status|join(,,@)]'. Trusted Advisor flags under "Idle Load Balancers" a load balancer without active or healthy backend instances or with fewer than 100 requests per day over the last seven days, but only for Classic Load Balancers (read on 2026-10-21); Compute Optimizer does not rate load balancers. In billing data the candidate is a LoadBalancerUsage line with 720 hours and LCUUsage near zero for the same lineItem/ResourceId (AWS Cost and Usage Report).

Azure

Application Gateways with their backend pools, firewalls, network gateways with their connections:

az network application-gateway list --query "[].{name:name, rg:resourceGroup, sku:sku.name, state:operationalState, backends:backendAddressPools[].length(backendAddresses)|join(',', @)}" -o table
az network firewall list --query "[].{name:name, rg:resourceGroup, sku:sku.tier, subnet:ipConfigurations[0].subnet.id}" -o table
az network vnet-gateway list --resource-group <rg> --query "[].{name:name, sku:sku.name, type:gatewayType}" -o table
az network vpn-connection list --resource-group <rg> --query "[].{name:name, gateway:virtualNetworkGateway1.id, status:connectionStatus}" -o table

An Application Gateway with empty backend pools and the metric Total Requests at zero, a firewall with Data processed at zero, and a network gateway without a connection are the candidates; Azure Advisor recommends, in preview, under "Delete Azure virtual network gateways with no connections" the deletion and names the hourly fee of the gateway and its public address. In the cost export the candidate is an applicationGateways/, azureFirewalls/ or virtualNetworkGateways/ resource with full hours and no consumption meter (Azure cost exports).

Google Cloud

Forwarding rules, backend services and their backends, VPN tunnels:

gcloud compute forwarding-rules list --format="table(name,region.basename(),IPAddress,loadBalancingScheme,target.basename(),backendService.basename())"
gcloud compute backend-services list --format="table(name,region.basename(),protocol,backends[].group.basename().list())"
gcloud compute vpn-tunnels list --format="table(name,region.basename(),status,peerIp)"

A backend service with an empty backends field and a forwarding rule pointing at it pay the minimum charge per rule without traffic; the metric loadbalancing.googleapis.com/https/request_count per rule over two weeks is the evidence, a tunnel in ESTABLISHED status without bytes the second. There is no recommender for load balancers. In the billing export the candidate is a Forwarding Rule Minimum Service Charge line with no Network Load Balancing: Data Processed beside it (Google Cloud billing export).

How to fix it

  1. Settle per object whether it belongs to an environment that is still coming or one that has gone; the name, the tag and the creation date say so, the owner decides.
  2. Delete, from the list. AWS: aws elbv2 delete-load-balancer --load-balancer-arn <arn> and then aws elbv2 delete-target-group --target-group-arn <arn>, without a dry run, so only against the checked list; the Elastic IP address of a Network Load Balancer stays and needs release-address; VPN with aws ec2 delete-vpn-connection --vpn-connection-id <id> --dry-run. Azure: az network application-gateway delete --name <gateway> --resource-group <rg>, az network firewall delete, az network vnet-gateway delete, then the public addresses. Google Cloud: gcloud compute forwarding-rules delete <rule> --region=<region>, then gcloud compute backend-services delete, gcloud compute vpn-tunnels delete.
  3. Merge where one load balancer runs per application: one Application Load Balancer with host-based rules per environment, one Application Gateway with several listeners, one Google Cloud load balancer with a URL map; on Kubernetes an ingress or gateway instead of a service of type LoadBalancer per service (Kubernetes efficiency).
  4. Correct the template: load balancers and gateways come up with the environment and go with it, in the same module; a firewall or a VPN gateway created for a test gets an expiry date (cost in the development lifecycle).

The hourly fee ends with the deletion; the daily export shows it the next day.

still cominggonePer object: name, tag andcreation date; the ownerdecidesEnvironment stillcoming, or gone?Stays with its environmentDelete from the checked list,then the public addresses andthe Elastic IP it leaves behindMerge: one load balancer withrules, listeners or a URL mapinstead of one per application;an ingress on KubernetesCorrect the template:gateways come and go withthe environment in the samemodule; a test gateway getsan expiry dateThe hourly fee ends with thedeletion; the daily exportshows it the next day
What belongs to a gone environment is deleted from the checked list, the rest is merged, and the template ties the next gateway to its environment

Risks and side effects

  • A load balancer without targets is sometimes the DNS anchor of an application in the middle of a move; its hostname sits in records that disappear with it. A look at the DNS zone comes before the deletion.
  • An Application Gateway can be stopped before it is deleted; whether a stopped gateway carries charges depends on the SKU and is on the pricing page, so stopping is a test, not the saving.
  • A VPN gateway without a connection is sometimes the counterpart of a partner who brings up the tunnel only when needed; the connection history and the partner decide.
  • Merging raises the dependency: one load balancer for ten applications is a point of failure for ten, and its capacity units add up; the hourly fee falls, the LCU or capacity unit line does not.
  • A firewall meets a security requirement; a firewall without traffic that satisfies a "no direct internet access" policy stays until the policy is met another way.

How to verify the saving

Before: per object, the hourly line in the last full month, LoadBalancerUsage, VPN-Usage-Hours, Fixed Cost, Deployment, gateway hours, Forwarding Rule Minimum Service Charge, and beside it the consumption line, LCUUsage, Capacity Units, Data Processed. After: the same objects in the first full month after the deletion, expected zero, and after a merge the hourly line of the remaining load balancer with a consumption line that rises by the requests it took over. The sum of the deletion list's hourly fees is the estimate, the release makes it accepted, the deletion implemented, and the following month's invoice realises it in the pattern of estimated, accepted, implemented, verified. The number of gateways without a target is the figure that then stays at zero.

Sources

Read on 2026-10-21. Trusted Advisor cost optimization checks, CloudWatch metrics for Application Load Balancers, aws elbv2, Azure Advisor cost recommendations, az network application-gateway, az network vnet-gateway, gcloud compute forwarding-rules, gcloud compute backend-services.