Back to Checks
aws

Classic Load Balancer is protected by AWS Shield Advanced

shield_advanced_protection_in_classic_load_balancers
Service: shieldSeverity: medium
OfficialBuilt-inVerified
Categories:resilienceinternet-exposed
Resource Type:AwsElbLoadBalancer

Classic Load Balancers are evaluated for association with AWS Shield Advanced as a protected resource.

Identifies load balancers without an active Shield Advanced protection when the subscription is enabled.

Prowler logoProwlerprowler-provider-aws

Risk

Unprotected ELB Classic endpoints are more exposed to large L3/L4 DDoS (e.g., SYN/UDP floods), risking availability loss from connection exhaustion and failed health checks, plus operational impact from autoscaling and data transfer surges.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks shield_advanced_protection_in_classic_load_balancers

Recommendation

Add internet-facing Classic Load Balancers as protected resources in Shield Advanced to strengthen DDoS resilience and cost protection.

Apply defense-in-depth: minimize public exposure, enforce least-privilege network access, enable health-based detection, and use protection groups.

Remediation

CLI

aws shield create-protection --name <PROTECTION_NAME> --resource-arn <ELB_ARN>

Terraform

# Add Shield Advanced protection to a Classic Load Balancer
resource "aws_shield_protection" "<example_resource_name>" {
  name         = "<example_resource_name>"
  resource_arn = "<example_resource_id>" # Critical: ARN of the Classic Load Balancer to protect
}

NativeIaC

# CloudFormation: Add Shield Advanced protection to a Classic Load Balancer
Resources:
  <example_resource_name>:
    Type: AWS::Shield::Protection
    Properties:
      Name: <example_resource_name>
      ResourceArn: <example_resource_id>  # Critical: ARN of the Classic Load Balancer to protect

Other

1In the AWS Console, open AWS WAF & Shield
2Go to Shield > Protected resources and click Add resources to protect
3Select the Region and resource type Classic Load Balancer, then Load resources
4Select your Classic Load Balancer and click Protect with Shield Advanced
5Confirm to create the protection

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elb.elb_client import elb_client
from prowler.providers.aws.services.shield.shield_client import shield_client


class shield_advanced_protection_in_classic_load_balancers(Check):
    def execute(self):
        findings = []
        if shield_client.enabled:
            for lb in elb_client.loadbalancers.values():
                report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
                report.region = shield_client.region
                report.status = "FAIL"
                report.status_extended = (
                    f"ELB {lb.name} is not protected by AWS Shield Advanced."
                )

                for protection in shield_client.protections.values():
                    if lb.arn == protection.resource_arn:
                        report.status = "PASS"
                        report.status_extended = (
                            f"ELB {lb.name} is protected by AWS Shield Advanced."
                        )
                        break

                findings.append(report)

        return findings

References