Back to Checks
aws

ELBv2 load balancer is configured across multiple Availability Zones

elbv2_is_in_multiple_az
Service: elbv2Severity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsElbv2LoadBalancer

ELBv2 load balancers (Application, Network, or Gateway) are assessed for distribution across multiple Availability Zones. The finding indicates whether each load balancer spans at least the configured minimum number of AZs (default 2).

Prowler logoProwlerprowler-provider-aws

Risk

Limiting a load balancer to one AZ introduces a single point of failure. An AZ outage, zonal degradation, or imbalanced target capacity can cause downtime, dropped connections, and deployment risk, undermining service availability and resiliency.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elbv2_is_in_multiple_az

Recommendation

Operate each load balancer across at least two AZs and ensure every enabled AZ has healthy, scaled targets.

  • Distribute capacity per AZ; use autoscaling
  • Keep health checks effective
  • Consider cross-zone load balancing to absorb bursts
  • Regularly test failover

Remediation

CLI

aws elbv2 set-subnets --load-balancer-arn <LOAD_BALANCER_ARN> --subnets <SUBNET_ID_A> <SUBNET_ID_B>

Terraform

# Ensure ELBv2 spans at least two Availability Zones
resource "aws_lb" "<example_resource_name>" {
  subnets = [
    "<subnet_id_a>",  # critical: add a second AZ/subnet
    "<subnet_id_b>"   # critical: ensures the load balancer spans >=2 AZs
  ]
}

NativeIaC

# CloudFormation: ensure the ELBv2 spans at least two AZs by specifying two subnets
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Subnets:
        - <subnet_id_a>  # critical: add a second AZ/subnet
        - <subnet_id_b>  # critical: ensures the load balancer spans >=2 AZs

Other

1Open AWS Console > EC2 > Load Balancers
2Select the load balancer
3Go to the Network mapping tab and click Edit subnets
4Enable at least two Availability Zones by selecting one subnet in each of two AZs
5Click Save changes

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client


class elbv2_is_in_multiple_az(Check):
    def execute(self) -> List[Check_Report_AWS]:
        findings = []
        elbv2_min_azs = elbv2_client.audit_config.get("elbv2_min_azs", 2)
        for lb in elbv2_client.loadbalancersv2.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
            report.status = "FAIL"
            report.status_extended = f"ELBv2 {lb.name} is not in at least {elbv2_min_azs} AZs. Is only in {', '.join(lb.availability_zones.keys())}."

            if len(lb.availability_zones) >= elbv2_min_azs:
                report.status = "PASS"
                report.status_extended = f"ELBv2 {lb.name} is at least in {elbv2_min_azs} AZs: {', '.join(lb.availability_zones.keys())}."

            findings.append(report)

        return findings

References