Classic Load Balancer has cross-zone load balancing enabled

Check ID: elb_cross_zone_load_balancing_enabled
Provider: AWS
Service: elb
Severity: MEDIUM
Categories: resilience
Resource type: AwsElbLoadBalancer

What this check verifies

Classic Load Balancer with cross-zone load balancing distributes requests across registered targets in all enabled Availability Zones. This evaluates whether that setting is enabled, instead of restricting distribution to targets within only the same zone.

Risk

Without cross-zone load balancing, traffic can concentrate in one AZ due to DNS skew or uneven capacity, creating hot spots, timeouts, and latency. This degrades service availability and increases the chance of cascading failures during AZ impairment or instance loss.

Recommendation

Set cross-zone load balancing to enabled on Classic Load Balancers and use at least two AZs. Balance capacity per AZ, enforce robust health checks with autoscaling, and design for high availability so load remains evenly distributed during demand spikes or partial AZ outages.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elb modify-load-balancer-attributes --load-balancer-name <load-balancer-name> --load-balancer-attributes "{\"CrossZoneLoadBalancing\":{\"Enabled\":true}}"

# Terraform: Enable cross-zone load balancing on a Classic Load Balancer
resource "aws_elb" "<example_resource_name>" {
  name = "<example_resource_name>"

  listener {
    lb_port           = 80
    lb_protocol       = "http"
    instance_port     = 80
    instance_protocol = "http"
  }

  availability_zones = ["<example_az>"]

  cross_zone_load_balancing = true  # Critical: enables cross-zone load balancing to pass the check
}

# CloudFormation: Enable cross-zone load balancing on a Classic Load Balancer
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      CrossZone: true  # Critical: enables cross-zone load balancing to pass the check
      Listeners:
        - LoadBalancerPort: 80
          InstancePort: 80
          Protocol: HTTP
      AvailabilityZones:
        - <example_az>

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elb_cross_zone_load_balancing_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Classic Load Balancer has connection draining enabled Classic Load Balancer mitigates desync attacks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires