Check ID: elbv2_internet_facing
Provider: AWS
Service: elbv2
Severity: MEDIUM
Categories: internet-exposed
Resource type: AwsElbv2LoadBalancer

​
What this check verifies

ELBv2 Application Load Balancers configured as internet-facing are assessed for exposure by reviewing attached security groups. Inbound TCP rules that allow 0.0.0.0/0 or ::/0 indicate unrestricted internet reachability.

​
Risk

Unrestricted ALB access lets any client reach exposed endpoints, enabling credential stuffing, automated scanning, and web exploits. Impacts:
  • Confidentiality: data exfiltration
  • Integrity: unauthorized changes
  • Availability: increased attack surface and DoS potential

​
Recommendation

Enforce least privilege on security groups: avoid 0.0.0.0/0; allow only trusted CIDRs or upstream services. Use an internal load balancer for non-public apps. For public endpoints, layer WAF rules, strict TLS, and rate limiting; consider CloudFront/Shield for defense in depth and reduced direct exposure.

​
Remediation

# Security Group for ALB with no public (0.0.0.0/0 or ::/0) TCP ingress
resource "aws_security_group" "<example_resource_name>" {
  name   = "alb-restricted-sg"
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # Critical: restricts inbound to private CIDR, preventing public access
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elbv2_internet_facing. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks