Check ID: elb_internet_facing
Provider: AWS
Service: elb
Severity: MEDIUM
Categories: internet-exposed
Resource type: AwsElbLoadBalancer

​
What this check verifies

Elastic Load Balancers are evaluated for the scheme to determine whether they are internet-facing or internal, indicating if the endpoint is publicly reachable via a public DNS name.

​
Risk

An unintended internet-facing load balancer exposes backends to the Internet, enabling reconnaissance, credential stuffing, and exploitation of app flaws. This can lead to data exposure (confidentiality), unauthorized changes (integrity), and DDoS or resource exhaustion (availability).

​
Recommendation

Use internal load balancers for private services and restrict exposure with security groups, subnets, and allowlists. For public endpoints, apply defense in depth: associate an AWS WAF web ACL (when supported), enforce TLS, least-privilege network rules, and consider Shield or rate limiting. Regularly review necessity of public access.

​
Remediation

resource "aws_lb" "<example_resource_name>" {
  internal        = true  # CRITICAL: sets scheme to internal so it's not internet-facing
  subnets         = ["<example_resource_id>", "<example_resource_id>"]
  security_groups = ["<example_resource_id>"]
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elb_internet_facing. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks