Skip to main content
idle · aws

Running ECS services behind a load balancer that served no requests and sat compute-idle for 30 days

resource types
1
rule IDs covered
1
severity
high

What does ZopNight detect here?

ZopNight flags an ECS service with at least one running task when its load balancer target group's `RequestCountPerTarget` never read above 1 over 30 days and its tasks averaged no more than 5% CPU and 20% memory. The service pays full task compute for nothing, so the saving is its entire measured run-rate.

Signal and threshold

How ZopNight evaluates Running ECS services behind a load balancer that served no requests and sat compute-idle for 30 days.
Field Value
Rule IDsRC-044b
Categoryidle
Severityhigh
MetricRequestCountPerTarget, CPUUtilization, MemoryUtilization
ThresholdRequestCountPerTarget at most 1 (average and peak); CPU avg 5% / peak 20%; memory avg 20% / peak 40%
Evaluation window30d
SourceZopNight
Permissions usedecs:ListServices · ecs:DescribeServices · elasticloadbalancing:DescribeTargetGroups · cloudwatch:GetMetricStatistics

Running tasks bill for their CPU and memory, traffic or not

With AWS Fargate you pay for the vCPU, memory and storage your tasks consume while they run. On the EC2 launch type the tasks occupy container instances you pay for by the hour. Either way, a service with a desired count of two keeps two tasks alive around the clock, even if no request has reached it in weeks.

This is the running counterpart to ECS Idle Service, which covers services already scaled to zero.

Confirming a service gets no requests

Find the service’s target group, then look at RequestCountPerTarget. The ALB metrics reference says this metric takes the TargetGroup dimension on its own and is the target group’s requests divided by its healthy targets:

Terminal window
aws ecs describe-services --cluster my-cluster --services my-service \
--query 'services[].[desiredCount,runningCount,loadBalancers[].targetGroupArn]'
aws cloudwatch get-metric-statistics \
--namespace AWS/ApplicationELB --metric-name RequestCountPerTarget \
--dimensions Name=TargetGroup,Value=targetgroup/my-tg/0123456789abcdef \
--start-time 2026-08-26T00:00:00Z --end-time 2026-09-25T00:00:00Z \
--period 86400 --statistics Sum

Check the service’s CPUUtilization and MemoryUtilization in AWS/ECS as well.

No traffic and no background work

The service must have a desired count and a running count of at least 1. Its request series must cover 30 days and stay at or below 1 on both average and peak. Then comes the compute gate, which exists because plenty of services take no HTTP traffic yet do real work: queue consumers, workers, scheduled batch jobs. Over the same 30 days, CPU must average no more than 5% and peak no higher than 20%, and memory must average no more than 20% and peak no higher than 40%. Finally the service needs a priced cost.

Services this check cannot see

A worker with no load balancer has no request series, and a service behind a Network Load Balancer has no request count to read, so neither produces a finding. Missing CPU or memory data, less than 30 days of any series, or no price also means silence. The check never uses tags or names to decide a service is idle.

Saving the full run-rate

Terminal window
saving = measured monthly cost of the service's running tasks
cost after fix = 0 (scaled to zero or deleted)

Scaling down a service nobody calls

  1. Confirm in the target group metrics that no client reaches it, and ask the owning team about internal or scheduled callers.
  2. Scale it to zero: aws ecs update-service --cluster my-cluster --service my-service --desired-count 0.
  3. If it is abandoned, delete it with aws ecs delete-service --cluster my-cluster --service my-service --force.
  4. Remove the listener rule and target group that pointed at it.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

472 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

472 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·