ELBv2 load balancer has at least one listener

Check ID: elbv2_listeners_underneath
Provider: AWS
Service: elbv2
Severity: MEDIUM
Categories: resilience
Resource type: AwsElbv2LoadBalancer

What this check verifies

ELBv2 load balancer requires at least one listener (protocol and port) to accept client connections and route requests to target groups. The finding indicates whether listeners are defined on the load balancer.

Risk

Without a listener, the load balancer cannot accept connections, making back-end services unreachable. This harms availability, leads to client timeouts and errors, and disrupts integrations that rely on the load balancer’s DNS endpoint.

Recommendation

Define at least one listener per load balancer. Prefer HTTPS on 443 to protect data in transit, and expose only required ports. Apply least privilege by limiting protocols and rules to intended traffic, and set an explicit default action to avoid unintended routing.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elbv2 create-listener --load-balancer-arn <LOAD_BALANCER_ARN> --protocol HTTP --port 80 --default-actions 'Type=fixed-response,FixedResponseConfig={StatusCode=200}'

# Terraform: add a minimal listener to the ELBv2
resource "aws_lb_listener" "<example_resource_name>" {
  load_balancer_arn = "<example_load_balancer_arn>"  # Critical: attaches the listener to the load balancer
  port              = 80                               # Critical: defines the listener port
  protocol          = "HTTP"                          # Critical: defines the listener protocol

  default_action {                                     # Critical: required default action so the listener is valid
    type = "fixed-response"
    fixed_response {
      status_code = "200"                             # Critical: required for fixed-response action
    }
  }
}

# CloudFormation: add a minimal listener to the ELBv2
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: <example_load_balancer_arn>  # Critical: attaches the listener to the load balancer
      Port: 80                                      # Critical: defines the listener port
      Protocol: HTTP                                # Critical: defines the listener protocol
      DefaultActions:
        - Type: fixed-response                       # Critical: minimal required default action so the listener is valid
          FixedResponseConfig:
            StatusCode: '200'                       # Critical: required for fixed-response action

References

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elbv2_listeners_underneath. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ELBv2 load balancer is configured across multiple AZs Application Load Balancer has S3 access logs enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires