In modern cloud-native architectures, the AWS Application Load Balancer (ALB) is ubiquitous. Infrastructure engineers deploying microservices on Amazon Elastic Kubernetes Service (EKS) routinely create dozens of ALBs via the AWS Load Balancer Controller, assigning a distinct public or internal entry point to each API microservice, frontend ingress, or third-party webhook receiver. On paper, AWS markets ALB pricing at a modest baseline: $0.0225 per Application Load Balancer-hour (roughly $16.20 per balancer per month). For an organization with ten ALBs, finance expects an unremarkable $162 monthly line item.

Then the monthly AWS invoice arrives, and the Elastic Load Balancing line item has exploded to $14,800. When FinOps analysts investigate the bill, they encounter AWS’s most aggressively variable networking metric: Load Balancer Capacity Units (LCUs). Because AWS calculates LCU consumption across four separate operational dimensions and bills based on whichever dimension spikes highest, high-traffic APIs, short-lived TLS connections, and complex path-routing rules create punitive financial multipliers. This forensic engineering teardown deconstructs the mathematical mechanics of LCUs, audits real-world traffic profiles, and details how replacing sprawling ALBs with self-hosted Envoy gateways slashes ingress costs by over 85%.

What Are AWS Load Balancer Capacity Units (LCUs)?

To audit ALB billing forensics, you must examine the exact mathematical definitions of each LCU vector. One LCU provides:

1. New Connections: 25 new connections per second (or 5 new connections/sec for TLS listeners utilizing complex cipher suites).
2. Active Connections: 3,000 active connections per minute.
3. Processed Bytes: 1 Gigabyte (GB) per hour for EC2 targets (or 0.4 GB/hr for Lambda targets).
4. Rule Evaluations: 1,000 rule evaluations per second (calculated as: \( ext{Request Rate} imes ( ext{Number of Processed Rules} – 10) \)).

The financial pitfall lies in the non-additive max function: \( ext{Billed LCUs} = \max( ext{LCU}_{new}, ext{LCU}_{active}, ext{LCU}_{bytes}, ext{LCU}_{rules}) \). If an e-commerce API processes only 50 GB of data in an hour (requiring 50 byte-LCUs), but mobile app clients repeatedly open and close TLS connections at 2,500 new connections per second due to disabled HTTP keep-alive, your new-connection LCU consumption jumps to 100 LCUs (or 500 LCUs with heavy TLS handshakes). You are billed for 500 LCUs, completely ignoring your modest data footprint.

The Rule Evaluation Explosion: Why Path Routing Bleeds Capital

The most misunderstood LCU dimension is Rule Evaluations. AWS gives infrastructure engineers the ability to define advanced routing rules directly on the ALB—routing `/api/v1/billing` to Target Group A, `/api/v1/auth` to Target Group B, and `/api/v1/search` to Target Group C. While this feature seems to eliminate the need for an internal Nginx or Envoy proxy, AWS imposes a steep tax for the privilege.

AWS includes the first 10 rules evaluated free of charge. Every rule evaluated beyond the tenth rule incurs rule evaluation LCU charges. The formula is unforgiving:

Rule Evaluations per Second = Requests per Second × (Average Evaluated Rules − 10)

Consider a high-throughput API receiving 15,000 requests per second. The engineering team configured 50 granular routing rules on the ALB. On average, incoming requests evaluate 35 rules before finding a matching regex path. The resulting math:

15,000 req/sec × (35 − 10) = 375,000 Rule Evaluations per Second

Dividing 375,000 by the 1,000 evaluation LCU baseline yields 375 LCUs per hour solely from rule processing. At $0.008 per LCU-hour across 730 hours in a month, that single ALB generates $2,190 per month in rule evaluation fees alone. If the team duplicates this configuration across staging, preview, and production environments across three AWS regions, the enterprise burns over $26,000 annually simply allowing AWS to execute basic if-then string matching.

Forensic Comparison: Sprawling ALBs vs Self-Hosted Envoy Gateways

The table below compares the annual infrastructure economics of maintaining 20 microservice ALBs versus consolidating traffic behind an Envoy Proxy or Traefik ingress gateway:

Engineering Remediation: Three Actionable Steps to Slash ALB Costs

Infrastructure teams seeking immediate cost relief can execute three architectural optimizations without touching application code:

1. Enforce Client HTTP Keep-Alive: Short-lived TCP/TLS connections are the primary driver of connection LCU spikes. Configure upstream clients, CloudFront distributions, and API gateways to maintain persistent HTTP/2 or HTTP keep-alive connections (minimum 60 to 120 seconds). Reusing existing TLS sessions collapses new connection LCU consumption by up to 80%.
2. Replace Multi-ALB Ingress with a Single Network Load Balancer (NLB): Network Load Balancers operate at Layer 4 (TCP/UDP), bypassing path-based rule evaluations and TLS inspection. NLB pricing is driven by Network LCUs (NLCUs), which are far cheaper for high-throughput streaming. Place a single NLB in front of an internal Envoy cluster running inside your Kubernetes cluster.
3. Strip Rules into Reverse Proxies: Never use an ALB as an API gateway. Strip all path-based routing rules from the ALB listener, forward all traffic to a wildcard target group, and let Envoy, Traefik, or Nginx execute path routing, header matching, and authentication checks in software at 0ms marginal cost.

For more architectural frameworks on slashing hyperscaler data transfer tolls, review our forensic investigation on The AWS NAT Gateway Pricing Trap: VPC Endpoints Audit and cross-reference our cross-zone routing breakdown in The AWS Cross-AZ Data Transfer Toll: Inter-Zone Audit.