Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
AWS Application Load Balancers (ALBs) close an existing client or target connection after 60 seconds with no data sent or received. If your request legitimately stays silent longer, the usual fix is to send heartbeat payload bytes during the silent period or raise the ALB connection idle timeout (up to 4,000 seconds). First identify which side timed out: HTTP 408, 460, 502 and 504 responses point to different failure stages. Then align the ALB value with your application, target and client timeouts, apply the change through the EC2 console, AWS CLI or CloudFormation, and verify the resulting attribute. Raising the number without checking those relationships can simply move the failure to another layer.
What is the AWS ALB idle timeout?
The ALB connection idle timeout is the amount of time an existing client-to-ALB or ALB-to-target connection may remain inactive, with no data sent or received, before the load balancer closes it. AWS sets the default to 60 seconds. The configurable range is 1 through 4,000 seconds.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →This is an inactivity timer, not a maximum request-duration setting. A request that continuously sends response data can remain open beyond 60 seconds; a request that sends nothing for 61 seconds can be closed. The timer applies independently to the client connection and the target connection, so a long-running operation can fail when either leg is silent.
The attribute you change is idle_timeout.timeout_seconds. It is different from client_keep_alive.seconds, which controls how long a persistent HTTP connection is maintained to a client. Changing the client keep-alive value does not extend an inactive request or target connection.
Popular on Amazon
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Why does an ALB return 408, 460, 502 or 504?
Read the status code and the logs before changing a value. Each code indicates a different side of the connection or a different stage of the request.
| Code | What it usually means | What to check first |
|---|---|---|
| 408 Request Timeout | The client sent no data before the idle timeout expired. | Client request behavior and whether payload data, rather than only TCP keep-alives, is sent before the deadline. |
| 460 | The client closed the connection before the ALB idle timeout elapsed. | Whether the client timeout is longer than the ALB timeout and whether the target can respond before the client deadline. |
| 502 Bad Gateway | The target closed or reset the connection while the ALB still had an outstanding request, or the target response was invalid. | Target keep-alive ordering, TCP RST/FIN events, target reachability and malformed response headers. |
| 504 Gateway Timeout | The ALB connected to the target but received no response before its idle timeout, or connection setup, network access, response length or TLS negotiation prevented completion. | Target logs, ALB access-log timings, network ACLs and the target’s response path. |
For a 504, AWS troubleshooting guidance also references a 10-second connection-establishment timeout. Network ACLs must allow the ephemeral port range 1024-65535 where applicable; blocked return traffic can look like an ALB timeout even when the application is healthy.
How should I diagnose the timeout before changing it?
- Capture the exact response code and timestamp. Correlate the client request, ALB access log entry and application or target log entry for the same request. Note whether the request failed at approximately 60 seconds or at a different client-side deadline.
- Determine which connection was quiet. If the client sent a request and the target produced no response bytes, inspect the ALB-to-target leg. If the client stopped sending an upload, inspect the client-to-ALB leg. A client disconnect before the ALB deadline points toward 460 rather than an ALB-initiated close.
- Compare all timeout settings. Record the ALB
idle_timeout.timeout_seconds, the application’s or target server’s keep-alive setting, any client or SDK request deadline, and relevant proxy or network-device timers. Do not assume the ALB is the shortest timer. - Check whether the operation can emit progress. Streaming responses, chunked output or application heartbeat bytes can prevent an idle interval. TCP keep-alive probes alone do not count as application data for this timer.
- Inspect target health and protocol correctness. A 502 can result from target resets, premature closes or malformed response headers, so increasing the idle value is not a complete fix for those causes.
Should I send heartbeat data or increase the timeout?
Use heartbeat payloads when the protocol and application can safely send progress during a long operation. Increase the ALB value when the silent period is legitimate but the application cannot emit data, and choose a value just beyond the longest expected silent interval rather than automatically selecting 4,000 seconds.
Send application data during long silent periods
Emit at least one byte of valid response or request payload before each interval in which the connection would otherwise be idle. The data must be part of the application exchange; a TCP keep-alive probe does not reset the ALB idle timer. Application Load Balancers also do not support HTTP/2 PING frames for resetting this timeout, so an HTTP/2 PING is not a substitute for response data.
Make sure heartbeat bytes are valid for the protocol and acceptable to the client. A client that cannot parse incremental output may still enforce its own total request deadline even though the ALB remains active.
Raise the ALB timeout for unavoidable silence
Choose a value greater than the expected maximum silent interval and leave enough margin for scheduling, network jitter and target processing. Keep the value bounded by the documented 1–4,000-second range. A longer timer makes the ALB wait longer before reporting a failure, so it should be used only when the workload requires that behavior and after checking resource and client-deadline implications.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Also popular on Amazon
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
How do I set the ALB idle timeout in the EC2 console?
The console changes the same idle_timeout.timeout_seconds attribute used by the API and infrastructure-as-code tools.
- Sign in to the AWS Management Console and open the Amazon EC2 console in the Region that contains the load balancer.
- In the navigation pane, choose Load Balancers.
- Select the Application Load Balancer you need to change.
- Open the Attributes tab and choose Edit.
- Under Traffic configuration, locate Connection idle timeout.
- Enter a whole-number value from 1 through 4,000 seconds, then save the change.
Allow the console operation to finish before retesting. If the ALB is managed by CloudFormation or another deployment system, update that source as well; otherwise a later stack update can restore the previous value.
How do I change it with the AWS CLI?
Use the load balancer ARN and replace 120 with the value appropriate for your workload.
aws elbv2 modify-load-balancer-attributes
--load-balancer-arn <load-balancer-arn>
--attributes "Key=idle_timeout.timeout_seconds,Value=120"The command returns the updated load balancer attributes when the operation succeeds. The value must remain within the documented 1–4,000-second range.
Recommended Free Tools
How can I verify the current value?
Query the same attribute after the modification:
aws elbv2 describe-load-balancer-attributes
--load-balancer-arn <load-balancer-arn>
--query "Attributes[?Key=='idle_timeout.timeout_seconds']"Confirm that the returned key is exactly idle_timeout.timeout_seconds and that its value matches the intended setting. If it does not, check the ARN, Region and IAM permissions before testing the application again.
How do I configure the timeout with CloudFormation?
Declare the attribute on the AWS::ElasticLoadBalancingV2::LoadBalancer resource so the setting is repeatable and remains under infrastructure management.
Also popular on Amazon
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Resources:
myLoadBalancer:
Type: AWS::ElasticLoadBalancingV2::LoadBalancer
Properties:
Type: application
LoadBalancerAttributes:
- Key: idle_timeout.timeout_seconds
Value: '120'Deploy the stack in the same Region as the ALB, then verify the live attribute with describe-load-balancer-attributes. If a stack update fails, inspect the CloudFormation event for the resource and correct the value or resource reference before retrying.
How should ALB, target and client timeouts be ordered?
The target or application keep-alive should be longer than the ALB idle timeout. AWS warns that if the target closes first and the ALB has not observed that close, the ALB can return HTTP 502.
| Layer | Role | Safe relationship to the ALB idle timeout |
|---|---|---|
| Client or SDK request timeout | How long the caller waits for the operation. | Longer than the time the operation may legitimately take, including any silent interval; otherwise the client can close first and produce 460. |
ALB idle_timeout.timeout_seconds |
Closes an inactive client or target connection. | Longer than the maximum expected silent interval, but not changed merely to hide target failures. |
| Application or target keep-alive | Controls how long the server keeps its connection available. | Longer than the ALB idle timeout so the target does not close first and trigger a 502. |
The exact client and server setting names depend on your runtime, web server and SDK. Find the effective values in those components’ configuration and compare them numerically; a setting described as a connection timeout may not be equivalent to an idle keep-alive timeout.
How do I troubleshoot an HTTP 504 that continues after raising the timeout?
A higher idle value cannot repair a failed connection, a blocked return path or an invalid target response. Work through the failure stage instead of repeatedly increasing the number.
Check target response generation
Use the application log to determine whether the request reached the handler and whether the handler produced response bytes. If the handler is blocked on a database, upstream service or lock, fix that dependency or stream valid progress data where appropriate.
Check target connectivity and network ACLs
Confirm that the ALB security path reaches the target and that return traffic is allowed. For the documented 504 troubleshooting case, network ACL rules may need to permit ephemeral ports 1024–65535. Verify both directions and the subnet route before treating the symptom as an idle timer.
Free tools Windows power users keep installed
One-click scans. No signup required.
Also popular on Amazon
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Check TLS and response formatting
A TLS handshake that cannot complete, an oversized or incomplete response, or malformed response headers can prevent the ALB from receiving a usable response. Correct the target protocol or headers and retest with a request that reaches the same listener and target group.
Check whether the client is actually the first side to close
If client logs show a deadline or disconnect before the ALB’s timer, raising the ALB setting will not help. Increase the client deadline only when the client is intended to wait that long, and keep it consistent with the target’s ability to finish.
What causes an HTTP 502 after an idle-timeout change?
A 502 generally indicates a target-side or protocol problem rather than a value that is too low. Inspect whether the target sent TCP FIN or RST while the ALB still had an outstanding request, whether its keep-alive is shorter than the ALB timeout, and whether response headers are malformed.
Correct the target keep-alive ordering first, then verify target health and connectivity. Do not use a larger ALB idle value to mask a target that closes connections prematurely.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhat is the difference between ALB idle timeout and client keep-alive?
idle_timeout.timeout_seconds governs inactivity on an existing client or target connection. client_keep_alive.seconds governs how long a persistent HTTP connection is maintained to a client, even when the connection is not being used for a particular request. They solve different problems, so change the idle-timeout attribute for silent request or target failures and leave client keep-alive unchanged unless connection lifetime itself is the issue.
How do I verify that the fix worked?
- Record the deployed ALB attribute with
describe-load-balancer-attributesor the console’s Attributes tab. - Repeat the original request using the same client, listener and target path that produced the error.
- Observe the request beyond the former failure point and confirm that response or heartbeat bytes arrive during every intended silent interval.
- Check ALB access logs, client logs and target logs together. The status code should disappear without a new client-side timeout, target reset or malformed-response error.
- Test a normal short request as a regression check; a timeout change should not alter ordinary response handling.
When should I reduce the timeout again?
Reduce it when the workload no longer needs the extended silent period, when the client cannot wait that long, or when monitoring shows that failed requests remain open unnecessarily. Keep the infrastructure definition and the live ALB value synchronized, then repeat the same correlated-log test after the rollback.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
As an optional shortcut after the manual checks, Outbyte PC Repair can look for common Windows system issues, clean temporary and cache files, and provide crash logging; it runs on Windows 11, 10, 8 and 7 with a category-based free trial of at least two days before a paid subscription. It complements antivirus software rather than replacing it, results vary, and no tool repairs every crash.
Frequently asked questions
Can an ALB idle timeout be set to zero to disable it?
No. The documented configurable range starts at 1 second and ends at 4,000 seconds. If a connection must remain open for a long operation, send valid application data periodically or choose a finite value that exceeds the expected silent interval.
Does an HTTP/2 PING frame keep an ALB connection alive?
No. Application Load Balancers do not support HTTP/2 PING frames for resetting the connection idle timeout. Use application-level payload data that the protocol and client can process.
Why can a 460 appear even when the ALB timeout is high?
HTTP 460 means the client closed the connection before the ALB idle timeout elapsed. The caller’s own deadline, browser behavior or SDK cancellation can therefore end the request first; compare client logs and deadlines rather than raising the ALB value again.
What should I change if only uploads fail?
Start with the client-to-ALB leg: confirm that upload data continues to arrive and that the client sends payload bytes before the idle period expires. A TCP keep-alive probe without upload data does not satisfy the ALB inactivity timer, so an upload client may need application-level progress or a larger idle value.
Frequently Asked Questions
Can an ALB idle timeout be set to zero to disable it?
No. The documented configurable range starts at 1 second and ends at 4,000 seconds. If a connection must remain open for a long operation, send valid application data periodically or choose a finite value that exceeds the expected silent interval.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDoes an HTTP/2 PING frame keep an ALB connection alive?
No. Application Load Balancers do not support HTTP/2 PING frames for resetting the connection idle timeout. Use application-level payload data that the protocol and client can process.
Why can a 460 appear even when the ALB timeout is high?
HTTP 460 means the client closed the connection before the ALB idle timeout elapsed. The caller’s own deadline, browser behavior or SDK cancellation can therefore end the request first; compare client logs and deadlines rather than raising the ALB value again.
What should I change if only uploads fail?
Start with the client-to-ALB leg: confirm that upload data continues to arrive and that the client sends payload bytes before the idle period expires. A TCP keep-alive probe without upload data does not satisfy the ALB inactivity timer, so an upload client may need application-level progress or a larger idle value.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
