# Gateway Load Balancer

> Gateway Load Balancers bill per hour for each deployment plus GLCU capacity units consumed by inspected traffic, and the appliance fleet behind them bills separately. ZopNight discovers every GWLB on the 6-hour cycle, pulls its cost from Cost Explorer or CUR 2.0, and flags gateways whose inspection path no longer carries traffic.

Source: https://zop.dev/integrations/aws/gwlb
Updated: 2026-08-19

---

A Gateway Load Balancer (GWLB) distributes traffic to fleets of virtual network appliances such as firewalls, billed per hour plus capacity units. GWLBs and their appliance fleets keep billing after inspection architectures are retired or rerouted.

## What a GWLB actually charges for

The meter has two parts: an hourly fee for the load balancer itself and GLCU capacity units that scale with the traffic being steered through the appliance fleet. The GWLB is rarely the expensive half of the architecture, though. The firewall or IDS instances it fronts are EC2 capacity billed on their own meters, and the GWLB endpoints that route spoke-VPC traffic into it bill hourly as well. Retiring an inspection design means unwinding all three layers, and the GWLB lingering is usually the sign the other two are lingering too.

## Inspection paths under ZopNight

Discovery on the 6-hour cycle picks up each gateway, and Cost Explorer or CUR 2.0 supplies its per-resource spend. ZopNight's idle detection matters here because a GWLB with no processed traffic almost always indicates a decommissioned or bypassed inspection layer, where the recoverable amount is the whole stack: gateway, endpoints, and the appliance instances behind the target group. Load balancers expose no stop action, so this is a delete decision, not a scheduling one.

## How inspection stacks go stale

Three patterns recur. Security architectures get simplified (traffic moves to AWS Network Firewall or to security groups alone) and the GWLB stays because deleting it requires touching route tables in several accounts. Proof-of-concept appliance evaluations end without cleanup, leaving a vendor firewall AMI running behind a gateway nobody routes to. And spoke VPCs get re-homed to a new hub, leaving orphaned GWLB endpoints billing hourly in the old one.

## Auditing gateway balancers in place

The EC2 console's Load Balancers view, filtered to the gateway type, lists each GWLB with its target group; the VPC console's Endpoints view shows the GWLB endpoints that feed it. Healthy-host count and processed bytes together tell you whether the appliance fleet is doing any inspecting at all.