Back to Checks
aws

Classic Load Balancer has cross-zone load balancing enabled

elb_cross_zone_load_balancing_enabled
Service: elbSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsElbLoadBalancer

Classic Load Balancer with cross-zone load balancing distributes requests across registered targets in all enabled Availability Zones.

This evaluates whether that setting is enabled, instead of restricting distribution to targets within only the same zone.

Prowler logoProwlerprowler-provider-aws

Risk

Without cross-zone load balancing, traffic can concentrate in one AZ due to DNS skew or uneven capacity, creating hot spots, timeouts, and latency. This degrades service availability and increases the chance of cascading failures during AZ impairment or instance loss.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elb_cross_zone_load_balancing_enabled

Recommendation

Set cross-zone load balancing to enabled on Classic Load Balancers and use at least two AZs.

Balance capacity per AZ, enforce robust health checks with autoscaling, and design for high availability so load remains evenly distributed during demand spikes or partial AZ outages.

Remediation

CLI

aws elb modify-load-balancer-attributes --load-balancer-name <load-balancer-name> --load-balancer-attributes "{\"CrossZoneLoadBalancing\":{\"Enabled\":true}}"

Terraform

# Terraform: Enable cross-zone load balancing on a Classic Load Balancer
resource "aws_elb" "<example_resource_name>" {
  name = "<example_resource_name>"

  listener {
    lb_port           = 80
    lb_protocol       = "http"
    instance_port     = 80
    instance_protocol = "http"
  }

  availability_zones = ["<example_az>"]

  cross_zone_load_balancing = true  # Critical: enables cross-zone load balancing to pass the check
}

NativeIaC

# CloudFormation: Enable cross-zone load balancing on a Classic Load Balancer
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      CrossZone: true  # Critical: enables cross-zone load balancing to pass the check
      Listeners:
        - LoadBalancerPort: 80
          InstancePort: 80
          Protocol: HTTP
      AvailabilityZones:
        - <example_az>

Other

1Open the AWS EC2 console
2Go to Load Balancing > Load Balancers and select your Classic Load Balancer
3Open the Attributes tab and click Edit
4Enable Cross-zone load balancing
5Click Save changes

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elb.elb_client import elb_client


class elb_cross_zone_load_balancing_enabled(Check):
    def execute(self) -> List[Check_Report_AWS]:
        findings = []
        for lb in elb_client.loadbalancers.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
            report.status = "FAIL"
            report.status_extended = (
                f"ELB {lb.name} does not have cross-zone load balancing enabled."
            )

            if lb.cross_zone_load_balancing:
                report.status = "PASS"
                report.status_extended = (
                    f"ELB {lb.name} has cross-zone load balancing enabled."
                )

            findings.append(report)

        return findings

References