Internet-facing ALB is protected by Shield Advanced

Check ID: shield_advanced_protection_in_internet_facing_load_balancers
Provider: AWS
Service: shield
Severity: MEDIUM
Categories: internet-exposed, resilience
Resource type: AwsElbv2LoadBalancer

What this check verifies

Application Load Balancers that are internet-facing are evaluated for an associated AWS Shield Advanced protection. Scope includes ALBs of type application with external exposure.

Risk

Without enhanced DDoS protection, internet-facing ALBs are exposed to volumetric L3/L4 floods and HTTP L7 floods, compromising availability via outages and latency spikes. Sudden scaling can raise costs, while reduced visibility and response support extend disruption across dependent services.

Recommendation

Register internet-facing ALBs as Shield Advanced protected resources to strengthen availability. Use defense-in-depth: pair with AWS WAF for L7 filtering and rate limits, group related assets, enable health-based detection and proactive engagement, and enforce least-privilege IAM with continuous monitoring.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws shield create-protection —name <ALB_NAME> —resource-arn <ALB_ARN>

resource "aws_shield_protection" "protect" {
  name         = "<example_resource_name>"
  resource_arn = "<example_resource_id>" # CRITICAL: ALB ARN; creating this enables Shield Advanced on the ALB
}

Resources:
  ShieldProtection:
    Type: AWS::Shield::Protection
    Properties:
      Name: "<example_resource_name>"
      ResourceArn: "<example_resource_id>" # CRITICAL: Set to the ALB ARN to enable Shield Advanced protection for it

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = shield_advanced_protection_in_internet_facing_load_balancers. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Global Accelerator is protected by AWS Shield Advanced Route53 hosted zone is protected by AWS Shield Advanced

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires