Back to Checks
aws

ELBv2 load balancer has at least one listener

elbv2_listeners_underneath
Service: elbv2Severity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsElbv2LoadBalancer

ELBv2 load balancer requires at least one listener (protocol and port) to accept client connections and route requests to target groups. The finding indicates whether listeners are defined on the load balancer.

Prowler logoProwlerprowler-provider-aws

Risk

Without a listener, the load balancer cannot accept connections, making back-end services unreachable. This harms availability, leads to client timeouts and errors, and disrupts integrations that rely on the load balancer's DNS endpoint.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elbv2_listeners_underneath

Recommendation

Define at least one listener per load balancer. Prefer HTTPS on 443 to protect data in transit, and expose only required ports. Apply least privilege by limiting protocols and rules to intended traffic, and set an explicit default action to avoid unintended routing.

Remediation

CLI

aws elbv2 create-listener --load-balancer-arn <LOAD_BALANCER_ARN> --protocol HTTP --port 80 --default-actions 'Type=fixed-response,FixedResponseConfig={StatusCode=200}'

Terraform

# Terraform: add a minimal listener to the ELBv2
resource "aws_lb_listener" "<example_resource_name>" {
  load_balancer_arn = "<example_load_balancer_arn>"  # Critical: attaches the listener to the load balancer
  port              = 80                               # Critical: defines the listener port
  protocol          = "HTTP"                          # Critical: defines the listener protocol

  default_action {                                     # Critical: required default action so the listener is valid
    type = "fixed-response"
    fixed_response {
      status_code = "200"                             # Critical: required for fixed-response action
    }
  }
}

NativeIaC

# CloudFormation: add a minimal listener to the ELBv2
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: <example_load_balancer_arn>  # Critical: attaches the listener to the load balancer
      Port: 80                                      # Critical: defines the listener port
      Protocol: HTTP                                # Critical: defines the listener protocol
      DefaultActions:
        - Type: fixed-response                       # Critical: minimal required default action so the listener is valid
          FixedResponseConfig:
            StatusCode: '200'                       # Critical: required for fixed-response action

Other

1In the AWS Console, go to EC2 > Load Balancing > Load Balancers
2Select the load balancer with the finding
3Open the Listeners tab and click Add listener
4Set Protocol to HTTP and Port to 80
5For Default action, choose Return fixed response and set Status code to 200
6Click Create/Save to add the listener

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client


class elbv2_listeners_underneath(Check):
    def execute(self):
        findings = []
        for lb in elbv2_client.loadbalancersv2.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
            report.status = "PASS"
            report.status_extended = f"ELBv2 {lb.name} has listeners underneath."
            if len(lb.listeners) == 0:
                report.status = "FAIL"
                report.status_extended = f"ELBv2 {lb.name} has no listeners underneath."

            findings.append(report)

        return findings

References