Back to Checks
aws

Internet-facing Application Load Balancer is protected by AWS Shield Advanced

shield_advanced_protection_in_internet_facing_load_balancers
Service: shieldSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposedresilience
Resource Type:AwsElbv2LoadBalancer

Application Load Balancers that are internet-facing are evaluated for an associated AWS Shield Advanced protection. Scope includes ALBs of type application with external exposure.

Prowler logoProwlerprowler-provider-aws

Risk

Without enhanced DDoS protection, internet-facing ALBs are exposed to volumetric L3/L4 floods and HTTP L7 floods, compromising availability via outages and latency spikes. Sudden scaling can raise costs, while reduced visibility and response support extend disruption across dependent services.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks shield_advanced_protection_in_internet_facing_load_balancers

Recommendation

Register internet-facing ALBs as Shield Advanced protected resources to strengthen availability. Use defense-in-depth: pair with AWS WAF for L7 filtering and rate limits, group related assets, enable health-based detection and proactive engagement, and enforce least-privilege IAM with continuous monitoring.

Remediation

CLI

aws shield create-protection --name <ALB_NAME> --resource-arn <ALB_ARN>

Terraform

resource "aws_shield_protection" "protect" {
  name         = "<example_resource_name>"
  resource_arn = "<example_resource_id>" # CRITICAL: ALB ARN; creating this enables Shield Advanced on the ALB
}

NativeIaC

Resources:
  ShieldProtection:
    Type: AWS::Shield::Protection
    Properties:
      Name: "<example_resource_name>"
      ResourceArn: "<example_resource_id>" # CRITICAL: Set to the ALB ARN to enable Shield Advanced protection for it

Other

1In the AWS Console, open AWS WAF & Shield
2Go to Shield > Protected resources
3Click Add resources to protect
4Select the Region and resource type Application Load Balancer
5Select your internet-facing ALB
6Click Protect with Shield Advanced

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client
from prowler.providers.aws.services.shield.shield_client import shield_client


class shield_advanced_protection_in_internet_facing_load_balancers(Check):
    def execute(self):
        findings = []
        if shield_client.enabled:
            for elbv2_arn, elbv2 in elbv2_client.loadbalancersv2.items():
                if elbv2.type == "application" and elbv2.scheme == "internet-facing":
                    report = Check_Report_AWS(metadata=self.metadata(), resource=elbv2)
                    report.region = shield_client.region
                    report.status = "FAIL"
                    report.status_extended = f"ELBv2 ALB {elbv2.name} is not protected by AWS Shield Advanced."

                    for protection in shield_client.protections.values():
                        if elbv2_arn == protection.resource_arn:
                            report.status = "PASS"
                            report.status_extended = f"ELBv2 ALB {elbv2.name} is protected by AWS Shield Advanced."
                            break

                    findings.append(report)

        return findings

References