Check ID: elb_is_in_multiple_az
Provider: AWS
Service: elb
Severity: MEDIUM
Categories: resilience
Resource type: AwsElbLoadBalancer

​
What this check verifies

Classic Load Balancer spans at least the configured number of Availability Zones. The evaluation identifies load balancers enabled in fewer AZs than the specified minimum.

​
Risk

Operating in too few AZs makes the load balancer a single point of failure. An AZ outage or zonal degradation can cause service unavailability, dropped connections, and uneven capacity, undermining application availability and resilience and increasing recovery time.

​
Recommendation

Design for multi-AZ high availability:
  • Enable at least 2 AZs per load balancer
  • Distribute targets evenly and use Auto Scaling across AZs
  • Enable cross-zone load balancing to smooth imbalances
  • Regularly test failover and health thresholds
Apply fault isolation and defense in depth principles.

​
Remediation

# Terraform: Ensure CLB spans at least two Availability Zones by adding two subnets
resource "aws_elb" "<example_resource_name>" {
  name    = "<example_resource_name>"
  subnets = [
    "<example_subnet_id_a>", # Critical: subnet in AZ A to ensure multiple AZs
    "<example_subnet_id_b>"  # Critical: subnet in different AZ (>=2 AZs total)
  ]

  listener {
    lb_port        = 80
    lb_protocol    = "http"
    instance_port  = 80
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elb_is_in_multiple_az. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks