ELBv2 load balancer is configured across multiple AZs

Check ID: elbv2_is_in_multiple_az
Provider: AWS
Service: elbv2
Severity: MEDIUM
Categories: resilience
Resource type: AwsElbv2LoadBalancer

What this check verifies

ELBv2 load balancers (Application, Network, or Gateway) are assessed for distribution across multiple Availability Zones. The finding indicates whether each load balancer spans at least the configured minimum number of AZs (default 2).

Risk

Limiting a load balancer to one AZ introduces a single point of failure. An AZ outage, zonal degradation, or imbalanced target capacity can cause downtime, dropped connections, and deployment risk, undermining service availability and resiliency.

Recommendation

Operate each load balancer across at least two AZs and ensure every enabled AZ has healthy, scaled targets.

Distribute capacity per AZ; use autoscaling
Keep health checks effective
Consider cross-zone load balancing to absorb bursts
Regularly test failover

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elbv2 set-subnets —load-balancer-arn <LOAD_BALANCER_ARN> —subnets <SUBNET_ID_A> <SUBNET_ID_B>

# Ensure ELBv2 spans at least two Availability Zones
resource "aws_lb" "<example_resource_name>" {
  subnets = [
    "<subnet_id_a>",  # critical: add a second AZ/subnet
    "<subnet_id_b>"   # critical: ensures the load balancer spans >=2 AZs
  ]
}

# CloudFormation: ensure the ELBv2 spans at least two AZs by specifying two subnets
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Subnets:
        - <subnet_id_a>  # critical: add a second AZ/subnet
        - <subnet_id_b>  # critical: ensures the load balancer spans >=2 AZs

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elbv2_is_in_multiple_az. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Application Load Balancer is not publicly accessible ELBv2 load balancer has at least one listener

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires