Back to Checks
aws

Classic Load Balancer is in multiple Availability Zones

elb_is_in_multiple_az
Service: elbSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsElbLoadBalancer

Classic Load Balancer spans at least the configured number of Availability Zones.

The evaluation identifies load balancers enabled in fewer AZs than the specified minimum.

Prowler logoProwlerprowler-provider-aws

Risk

Operating in too few AZs makes the load balancer a single point of failure. An AZ outage or zonal degradation can cause service unavailability, dropped connections, and uneven capacity, undermining application availability and resilience and increasing recovery time.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elb_is_in_multiple_az

Recommendation

Design for multi-AZ high availability:

  • Enable at least 2 AZs per load balancer
  • Distribute targets evenly and use Auto Scaling across AZs
  • Enable cross-zone load balancing to smooth imbalances
  • Regularly test failover and health thresholds

Apply fault isolation and defense in depth principles.

Remediation

Terraform

# Terraform: Ensure CLB spans at least two Availability Zones by adding two subnets
resource "aws_elb" "<example_resource_name>" {
  name    = "<example_resource_name>"
  subnets = [
    "<example_subnet_id_a>", # Critical: subnet in AZ A to ensure multiple AZs
    "<example_subnet_id_b>"  # Critical: subnet in different AZ (>=2 AZs total)
  ]

  listener {
    lb_port        = 80
    lb_protocol    = "http"
    instance_port  = 80
  }
}

NativeIaC

# CloudFormation: Ensure CLB spans at least two Availability Zones by adding two subnets
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      Subnets:
        - <example_subnet_id_a>  # Critical: add a subnet in AZ A to ensure multiple AZs
        - <example_subnet_id_b>  # Critical: add a subnet in a different AZ (>=2 AZs total)
      Listeners:
        - LoadBalancerPort: 80
          InstancePort: 80
          Protocol: HTTP

Other

1Open the Amazon EC2 console and go to Load Balancers
2Select your Classic Load Balancer (type: classic)
3Choose Edit subnets (or the Subnets tab > Edit)
4Add a subnet from a different Availability Zone than the existing one (ensure at least two AZs)
5Click Save
6If your CLB is in EC2-Classic, use Edit Availability Zones instead and select an additional AZ, then Save

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elb.elb_client import elb_client


class elb_is_in_multiple_az(Check):
    def execute(self) -> List[Check_Report_AWS]:
        findings = []
        ELB_MIN_AZS = elb_client.audit_config.get("elb_min_azs", 2)
        for lb in elb_client.loadbalancers.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
            report.status = "FAIL"
            report.status_extended = f"Classic Load Balancer {lb.name} is not in at least {ELB_MIN_AZS} availability zones, it is only in {', '.join(lb.availability_zones)}."

            if len(lb.availability_zones) >= ELB_MIN_AZS:
                report.status = "PASS"
                report.status_extended = f"Classic Load Balancer {lb.name} is in {len(lb.availability_zones)} availability zones: {', '.join(lb.availability_zones)}."

            findings.append(report)

        return findings

References