Classic Load Balancer is protected by AWS Shield Advanced

Check ID: shield_advanced_protection_in_classic_load_balancers
Provider: AWS
Service: shield
Severity: MEDIUM
Categories: resilience, internet-exposed
Resource type: AwsElbLoadBalancer

What this check verifies

Classic Load Balancers are evaluated for association with AWS Shield Advanced as a protected resource. Identifies load balancers without an active Shield Advanced protection when the subscription is enabled.

Risk

Unprotected ELB Classic endpoints are more exposed to large L3/L4 DDoS (e.g., SYN/UDP floods), risking availability loss from connection exhaustion and failed health checks, plus operational impact from autoscaling and data transfer surges.

Recommendation

Add internet-facing Classic Load Balancers as protected resources in Shield Advanced to strengthen DDoS resilience and cost protection. Apply defense-in-depth: minimize public exposure, enforce least-privilege network access, enable health-based detection, and use protection groups.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws shield create-protection —name <PROTECTION_NAME> —resource-arn <ELB_ARN>

# Add Shield Advanced protection to a Classic Load Balancer
resource "aws_shield_protection" "<example_resource_name>" {
  name         = "<example_resource_name>"
  resource_arn = "<example_resource_id>" # Critical: ARN of the Classic Load Balancer to protect
}

# CloudFormation: Add Shield Advanced protection to a Classic Load Balancer
Resources:
  <example_resource_name>:
    Type: AWS::Shield::Protection
    Properties:
      Name: <example_resource_name>
      ResourceArn: <example_resource_id>  # Critical: ARN of the Classic Load Balancer to protect

References

https://docs.aws.amazon.com/waf/latest/developerguide/configure-new-protection.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = shield_advanced_protection_in_classic_load_balancers. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Elastic IP address is protected by AWS Shield Advanced CloudFront distribution is protected by AWS Shield Advanced

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires