# Ensure ELB Cross AZ Load Balancing Enabled - Source: https://support.icompaas.com/support/solutions/articles/62000220444-ensure-elb-cross-az-load-balancing-enabled - Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ## **Description:** Elastic Load Balancing automatically distributes incoming applications traffic across multiple targets, such as Amazon EC2 instances, containers, IP addresses, Lambda functions, and virtual appliances. Classic Load Balancer provides basic load balancing across multiple Amazon EC2 instances and operates at both the request level and the connection level. It is intended for applications that are built within the EC2 classic network. ## **Rationale:** When cross-zone load balancing is enabled, each load balancer node distributes traffic across the registered targets in all enabled Availability Zones. When cross-zone load balancing is disabled, each load balancer node distributes traffic only across the registered targets in its Availability Zone. ## **Impact:** It distributes traffic and each load balancer node receives 50% of the traffic from the clients. Due to cross-zone load balancing being enabled, if there are 10 targets all targets receive 10% of the traffic. This is because each load balancer node can route 50% of the client traffic to all targets. If cross-zone load balancing is disabled then it is not equally distributed within the targets if you have two availability zone A (have 2 targets) and B(have 8 targets) then A receives 25% and B receives 6.25% of the traffic. ## **Default Value:** When you create the Elastic Load Balancer, Cross-zone by default disabled. ## ### **Pre-Requisite:** - The same security group must be applied to both the ELB and EC2 - The same subnet must be used in ELB and EC2 instance - VPC also be same for both instance and the load balancer - Web servers must be publicly accessible. ## **Remediation:** ## **Test Plan:** - Login to AWS Management Console and go to EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/ "https://console.aws.amazon.com/ec2/") -  In the left navigation pane, under  **Load Balancing**, click on **Load Balancers**. ![](https://support.icompaas.com/assets/kb/97e77ce641dd4f78.png) - Select your load balancer to examine  - Under the Description, you can see the Cross-zone load balancing is enabled or disabled. ![](https://support.icompaas.com/assets/kb/6f7148fcf8e0aa36.png) ### **Using AWS CLI:** To describe the load balancer attributes  aws elb describe-load-balancer-attributes --load-balancer-name ### **Implementation Steps:** - Login to AWS Management Console  - Go to EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/ "https://console.aws.amazon.com/ec2/") -  In the left navigation pane, under  **Load Balancing.** - Click on **Load Balancers**.![](https://support.icompaas.com/assets/kb/ca60f2e892e2e064.png) - Select the load balancer that you want to enable the cross AZ. - On the description, below the attributes tab, click on edit attributes. ![](https://support.icompaas.com/assets/kb/ca97166733363079.png) - On the **Configure Cross-Zone Load Balancing** page, select **Enable**. and click on Save button. ![](https://support.icompaas.com/assets/kb/4881ae535393c65a.png) ### **Using AWS CLI:** Modify load balancer attributes and set enabled value true. aws elb modify-load-balancer-attributes --load-balancer-name --load-balancer-attributes "{"CrossZoneLoadBalancing":{"Enabled":true}}" ## **Backout Plan** - Login to AWS Management Console and go to EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/ "https://console.aws.amazon.com/ec2/") -  In the left navigation pane, under  **Load Balancing** , click on **Load Balancers**. - Select your load balancer.  - On the **Description** tab, choose **Change cross-zone load balancing**. - On the **Configure Cross-Zone Load Balancing** , click on **edit attributes.![](https://support.icompaas.com/assets/kb/a889b284f4de109c.png)** - Uncheck the check box. and save it.![](https://support.icompaas.com/assets/kb/2400c62c207d3b0c.png) **Using AWS CLI****:** To Disable the Cross-zone load balancing. aws elb modify-load-balancer-attributes --load-balancer-name --load-balancer-attributes "{"CrossZoneLoadBalancing":{"Enabled":false}}" ## **Reference:** 1. [https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/how-elastic-load-balancing-works.html](https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/how-elastic-load-balancing-works.html) 2. [https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-disable-crosszone-lb.html](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-disable-crosszone-lb.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.