Back to Checks
aws

Elastic Load Balancer is not internet-facing

elb_internet_facing
Service: elbSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsElbLoadBalancer

Elastic Load Balancers are evaluated for the scheme to determine whether they are internet-facing or internal, indicating if the endpoint is publicly reachable via a public DNS name.

Prowler logoProwlerprowler-provider-aws

Risk

An unintended internet-facing load balancer exposes backends to the Internet, enabling reconnaissance, credential stuffing, and exploitation of app flaws. This can lead to data exposure (confidentiality), unauthorized changes (integrity), and DDoS or resource exhaustion (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elb_internet_facing

Recommendation

Use internal load balancers for private services and restrict exposure with security groups, subnets, and allowlists. For public endpoints, apply defense in depth: associate an AWS WAF web ACL (when supported), enforce TLS, least-privilege network rules, and consider Shield or rate limiting. Regularly review necessity of public access.

Remediation

Terraform

resource "aws_lb" "<example_resource_name>" {
  internal        = true  # CRITICAL: sets scheme to internal so it's not internet-facing
  subnets         = ["<example_resource_id>", "<example_resource_id>"]
  security_groups = ["<example_resource_id>"]
}

NativeIaC

# CloudFormation: create an internal load balancer
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Scheme: internal  # CRITICAL: makes the load balancer internal (not internet-facing)
      Subnets:
        - <example_resource_id>
        - <example_resource_id>
      SecurityGroups:
        - <example_resource_id>

Other

1In AWS Console, go to EC2 > Load Balancers
2Click Create load balancer (Application or Network)
3Set Scheme to Internal
4Select at least two subnets and a security group; recreate listeners/target groups as needed
5Create the new load balancer and update DNS to its DNS name
6Delete the old internet-facing load balancer

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elb.elb_client import elb_client


class elb_internet_facing(Check):
    def execute(self):
        findings = []
        for lb in elb_client.loadbalancers.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
            report.status = "PASS"
            report.status_extended = f"ELB {lb.name} is not internet facing."
            if lb.scheme == "internet-facing":
                report.status = "FAIL"
                report.status_extended = (
                    f"ELB {lb.name} is internet facing in {lb.dns}."
                )

            findings.append(report)

        return findings

References