Back to Checks
e2enetworks

E2E Networks ALB load balancers have backend health checks enabled

loadbalancer_backend_health_check_enabled
Service: loadbalancerSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:NotDefined

E2E Networks application load balancers should have HTTP health checks configured for their backends so traffic is only routed to healthy nodes.

Prowler logoProwlerprowler-provider-e2enetworks

Risk

Load balancers without backend health checks may route traffic to failed or unhealthy nodes, causing outages and masking active compromise on degraded backends.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler e2enetworks --checks loadbalancer_backend_health_check_enabled

Recommendation

Configure HTTP health checks for ALB backends so unhealthy nodes are automatically removed from rotation.

Check Code

from prowler.lib.check.models import Check, CheckReportE2eNetworks
from prowler.providers.e2enetworks.services.loadbalancer.loadbalancer_client import (
    loadbalancer_client,
)


class loadbalancer_backend_health_check_enabled(Check):
    """Check that ALB load balancers have backend health checks configured."""

    def execute(self) -> list[CheckReportE2eNetworks]:
        findings = []
        for lb in loadbalancer_client.load_balancers:
            if not lb.is_alb:
                continue

            report = CheckReportE2eNetworks(metadata=self.metadata(), resource=lb)
            report.status = "PASS"
            report.status_extended = (
                f"Load balancer {lb.name} has backend health checks configured."
            )
            if not lb.has_backend_health_check:
                report.status = "FAIL"
                report.status_extended = f"Load balancer {lb.name} does not have backend health checks configured."
            findings.append(report)
        return findings

References