All checks
Medium
Application, Network and Gateway Load Balancers should span multiple Availability Zones
Ensures Application, Network, and Gateway Load Balancers span multiple Availability Zones for fault tolerance. The threshold is two zones, the default AWS sets for this control. This reads the zones the load balancer is enabled in, not where its targets are, so it can pass where AWS's own rule would not.
- service
- ELB
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
EC2 → Load balancers → the load balancer → Network mapping → Edit subnets
- Network mapping
- One subnet in each of at least two Availability Zones, in zones where targets are registered
With the AWS CLI
- Overwrites existing settings: set-subnets replaces the whole subnet list, so name every subnet already enabled; a Network Load Balancer drops the connections of any zone left out.
aws elbv2 set-subnets --load-balancer-arn <load-balancer-arn> --subnets <subnet-id-a> <subnet-id-b> --region <region>With Terraform
resource "aws_lb" "this" {
subnets = var.subnet_ids
}See which of your accounts this check is failing on.
Book a live scan