ELBv2 load balancer has cross-zone balancing enabled

Check ID: elbv2_cross_zone_load_balancing_enabled
Provider: AWS
Service: elbv2
Severity: MEDIUM
Categories: resilience
Resource type: AwsElbv2LoadBalancer

What this check verifies

Network and Gateway Load Balancers have cross-zone load balancing enabled (load_balancing.cross_zone.enabled), so each node distributes requests to targets in all enabled Availability Zones rather than only its own.

Risk

Without cross-zone distribution, traffic can concentrate in one zone, degrading availability through target saturation, uneven failover, and connection drops. Zonal impairment can cause partial outages and increase latency under load.

Recommendation

Enable cross-zone load balancing to spread load across zones and design for AZ redundancy.

Balance capacity per AZ and use health-based routing
Avoid single-AZ dependencies and sticky designs
Monitor zonal health to sustain fault tolerance

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elbv2 modify-load-balancer-attributes --load-balancer-arn <load-balancer-arn> --attributes Key=load_balancing.cross_zone.enabled,Value=true

resource "aws_lb" "<example_resource_name>" {
  load_balancer_type = "network"
  subnets            = ["<subnet-id-1>", "<subnet-id-2>"]
  enable_cross_zone_load_balancing = true  # Critical: enable cross-zone load balancing
}

Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Type: network
      Subnets:
        - <subnet-id-1>
        - <subnet-id-2>
      LoadBalancerAttributes:
        - Key: load_balancing.cross_zone.enabled  # Critical: enable cross-zone load balancing
          Value: true  # Ensures the check passes for NLB/GLB

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elbv2_cross_zone_load_balancing_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Classic Load Balancer SSL listeners use ACM certificates ELBv2 load balancer has deletion protection enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires