Back to Checks
aws

Application Load Balancer is not publicly accessible (no inbound TCP from 0.0.0.0/0 or ::/0)

elbv2_internet_facing
Service: elbv2Severity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsElbv2LoadBalancer

ELBv2 Application Load Balancers configured as internet-facing are assessed for exposure by reviewing attached security groups.

Inbound TCP rules that allow 0.0.0.0/0 or ::/0 indicate unrestricted internet reachability.

Prowler logoProwlerprowler-provider-aws

Risk

Unrestricted ALB access lets any client reach exposed endpoints, enabling credential stuffing, automated scanning, and web exploits.

Impacts:

  • Confidentiality: data exfiltration
  • Integrity: unauthorized changes
  • Availability: increased attack surface and DoS potential

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elbv2_internet_facing

Recommendation

Enforce least privilege on security groups: avoid 0.0.0.0/0; allow only trusted CIDRs or upstream services.

Use an internal load balancer for non-public apps.

For public endpoints, layer WAF rules, strict TLS, and rate limiting; consider CloudFront/Shield for defense in depth and reduced direct exposure.

Remediation

Terraform

# Security Group for ALB with no public (0.0.0.0/0 or ::/0) TCP ingress
resource "aws_security_group" "<example_resource_name>" {
  name   = "alb-restricted-sg"
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # Critical: restricts inbound to private CIDR, preventing public access
  }
}

NativeIaC

# CloudFormation Security Group for ALB with no public (0.0.0.0/0 or ::/0) TCP ingress
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: ALB SG restricted ingress
      VpcId: "<example_resource_id>"
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 10.0.0.0/8  # Critical: restricts inbound to private CIDR, preventing public access

Other

1In AWS Console, go to EC2 > Load Balancers and select the ALB
2In the Description tab, note the attached Security Group and open it
3Click Edit inbound rules
4Delete any TCP rule with Source 0.0.0.0/0 or ::/0
5If access is needed, add only specific private CIDRs or trusted security groups
6Click Save rules

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client
from prowler.providers.aws.services.ec2.lib.security_groups import check_security_group
from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client


class elbv2_internet_facing(Check):
    def execute(self):
        findings = []
        for lb in elbv2_client.loadbalancersv2.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
            report.status = "PASS"
            report.status_extended = f"ELBv2 ALB {lb.name} is not internet facing."
            if lb.scheme == "internet-facing":
                report.status_extended = f"ELBv2 ALB {lb.name} has an internet facing scheme with domain {lb.dns} but is not public."
                for sg_id in getattr(lb, "security_groups", []):
                    sg_arn = f"arn:{elbv2_client.audited_partition}:ec2:{lb.region}:{elbv2_client.audited_account}:security-group/{sg_id}"
                    if sg_arn in ec2_client.security_groups:
                        for ingress_rule in ec2_client.security_groups[
                            sg_arn
                        ].ingress_rules:
                            if check_security_group(
                                ingress_rule, "tcp", any_address=True
                            ):
                                report.status = "FAIL"
                                report.status_extended = f"ELBv2 ALB {lb.name} is internet facing with domain {lb.dns} due to their security group {sg_id} is public."

            findings.append(report)

        return findings

References