Back to Checks
aws

Auto Scaling group associated with a load balancer has ELB health checks enabled

autoscaling_group_elb_health_check_enabled
Service: autoscalingSeverity: low
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsAutoScalingAutoScalingGroup

EC2 Auto Scaling groups attached to a load balancer are evaluated for ELB-based health checks that use the load balancer's target health instead of instance-only checks.

Prowler logoProwlerprowler-provider-aws

Risk

Without ELB health checks, the group may keep instances that fail load balancer probes, causing:

  • Reduced availability from routing to bad targets
  • Higher error rates impacting transaction integrity
  • Inefficient scaling and increased costs

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks autoscaling_group_elb_health_check_enabled

Recommendation

Enable ELB health checks for Auto Scaling groups behind load balancers to reflect real client reachability. Apply high availability and defense in depth by:

  • Using application-appropriate LB probes
  • Tuning grace and threshold settings to avoid flapping
  • Monitoring health metrics and alerts

Remediation

CLI

aws autoscaling update-auto-scaling-group --auto-scaling-group-name <auto-scaling-group-name> --health-check-type ELB

Terraform

# Enable ELB health checks on the Auto Scaling group
resource "aws_autoscaling_group" "<example_resource_name>" {
  health_check_type = "ELB"  # Remediation: ensures ASG uses load balancer health status
}

NativeIaC

# CloudFormation: Enable ELB health checks for the Auto Scaling group
Resources:
  <example_resource_name>:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      HealthCheckType: ELB  # Remediation: use ELB health checks so the ASG evaluates instance health via the load balancer

Other

1In AWS Console, go to EC2 > Auto Scaling Groups
2Select the Auto Scaling group
3On the Details tab, click Edit under Health checks
4Under Additional health check types, select Elastic Load Balancing (ELB)
5Click Update/Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.autoscaling.autoscaling_client import (
    autoscaling_client,
)


class autoscaling_group_elb_health_check_enabled(Check):
    def execute(self):
        findings = []
        for group in autoscaling_client.groups:
            if group.load_balancers and group.target_groups:
                report = Check_Report_AWS(metadata=self.metadata(), resource=group)

                report.status = "FAIL"
                report.status_extended = f"Autoscaling group {group.name} is associated with a load balancer but does not have ELB health checks enabled, instead it has {group.health_check_type} health checks."
                if "ELB" in group.health_check_type:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Autoscaling group {group.name} has ELB health checks enabled."
                    )

                findings.append(report)

        return findings

References