Back to Checks
aws

ELBv2 Network or Gateway Load Balancer has cross-zone load balancing enabled

elbv2_cross_zone_load_balancing_enabled
Service: elbv2Severity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsElbv2LoadBalancer

Network and Gateway Load Balancers have cross-zone load balancing enabled (load_balancing.cross_zone.enabled), so each node distributes requests to targets in all enabled Availability Zones rather than only its own.

Prowler logoProwlerprowler-provider-aws

Risk

Without cross-zone distribution, traffic can concentrate in one zone, degrading availability through target saturation, uneven failover, and connection drops. Zonal impairment can cause partial outages and increase latency under load.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elbv2_cross_zone_load_balancing_enabled

Recommendation

Enable cross-zone load balancing to spread load across zones and design for AZ redundancy.

  • Balance capacity per AZ and use health-based routing
  • Avoid single-AZ dependencies and sticky designs
  • Monitor zonal health to sustain fault tolerance

Remediation

CLI

aws elbv2 modify-load-balancer-attributes --load-balancer-arn <load-balancer-arn> --attributes Key=load_balancing.cross_zone.enabled,Value=true

Terraform

resource "aws_lb" "<example_resource_name>" {
  load_balancer_type = "network"
  subnets            = ["<subnet-id-1>", "<subnet-id-2>"]
  enable_cross_zone_load_balancing = true  # Critical: enable cross-zone load balancing
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Type: network
      Subnets:
        - <subnet-id-1>
        - <subnet-id-2>
      LoadBalancerAttributes:
        - Key: load_balancing.cross_zone.enabled  # Critical: enable cross-zone load balancing
          Value: true  # Ensures the check passes for NLB/GLB

Other

1Open the AWS EC2 console and go to Load Balancers
2Select your Network or Gateway Load Balancer
3Choose the Attributes tab > Edit attributes
4Turn on Cross-zone load balancing
5Save changes

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client


class elbv2_cross_zone_load_balancing_enabled(Check):
    def execute(self) -> List[Check_Report_AWS]:
        findings = []
        for lb in elbv2_client.loadbalancersv2.values():
            if lb.type != "application":
                report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
                report.status = "FAIL"
                report.status_extended = (
                    f"ELBv2 {lb.name} does not have cross-zone load balancing enabled."
                )
                if lb.cross_zone_load_balancing == "true":
                    report.status = "PASS"
                    report.status_extended = (
                        f"ELBv2 {lb.name} has cross-zone load balancing enabled."
                    )

                findings.append(report)

        return findings

References