# Ensure Cross-Zone Load Balancing is Enabled for Classic Load Balancers (CLBs) - Source: https://support.icompaas.com/support/solutions/articles/62000233350-ensure-cross-zone-load-balancing-is-enabled-for-classic-load-balancers-clbs- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Profile Applicability:** - **Level 2** ### **Description:** Cross-Zone Load Balancing ensures that each Classic Load Balancer (CLB) distributes incoming traffic evenly across all registered instances in all enabled Availability Zones (AZs), rather than restricting traffic to instances in the same AZ as the incoming request. This feature helps optimize resource utilization and enhances application availability and fault tolerance. When Cross-Zone Load Balancing is enabled, it allows CLBs to route traffic to healthy instances across all AZs, even if the incoming request originates from a different AZ. ### **Rationale:** - High Availability: Ensures even traffic distribution across multiple AZs, improving fault tolerance in case of instance or AZ failures. - Optimized Resource Utilization: Prevents uneven traffic distribution that could overwhelm instances in a single AZ. - Reduced Downtime: Increases application resilience and minimizes the risk of bottlenecks. - Enhanced Load Distribution: Especially beneficial in cases where the number of instances in each AZ is not the same. ### **Impact:** - **Pros:** - Ensures even traffic distribution across all AZs. - Improves fault tolerance and high availability. - Optimizes resource utilization, reducing the risk of overloading instances in one AZ. - Cons: - May incur additional data transfer costs due to inter-AZ traffic. - Could lead to higher latency if traffic crosses AZ boundaries. ### **Default Value:** - Cross-Zone Load Balancing is disabled by default for Classic Load Balancers. - It must be manually enabled. ### **Pre-Requisite:** - **IAM Permissions:** - elasticloadbalancing:DescribeLoadBalancers - elasticloadbalancing:ModifyLoadBalancerAttributes - AWS CLI installed and configured. ### **Remediation:** #### **Test Plan:** ##### **Using AWS Console:** 1. Sign in to the [AWS Management Console](https://console.aws.amazon.com/). 2. Navigate to EC2 Dashboard → Load Balancers. 3. Select Classic Load Balancers from the left-hand panel. 4. For each Classic Load Balancer: - Select the CLB. - Go to the Description tab. - Under Attributes, check if Cross-Zone Load Balancing is enabled. ##### **Using AWS CLI:** **Check Cross-Zone Load Balancing Status:** aws elb describe-load-balancer-attributes --load-balancer-name --query 'LoadBalancerAttributes.CrossZoneLoadBalancing' **Expected Output (Pass):** { "Enabled": true } Fail Output (Disabled): { "Enabled": false } ### **Implementation Steps:** #### **Using AWS Console:** 1. Sign in to the [AWS Console](https://console.aws.amazon.com/). 2. Navigate to EC2 Dashboard → Load Balancers. ![](https://support.icompaas.com/assets/kb/b97838e630547f95.png) 3. Select the Classic Load Balancer to modify. ![](https://support.icompaas.com/assets/kb/b84931bd1984b0ff.png) 4. Under the Description tab, click Edit Attributes. ![](https://support.icompaas.com/assets/kb/a4d9b454193fa462.png) 5. Enable the checkbox for Cross-Zone Load Balancing. ![](https://support.icompaas.com/assets/kb/ddd72b611be50798.png) 6. Click Save. ![](https://support.icompaas.com/assets/kb/d56c9eb3480a10fa.png) #### **Using AWS CLI:** **Enable Cross-Zone Load Balancing:** aws elb modify-load-balancer-attributes --load-balancer-name --load-balancer-attributes 'CrossZoneLoadBalancing={"Enabled":true}' **Verify the Changes:** aws elb describe-load-balancer-attributes --load-balancer-name --query 'LoadBalancerAttributes.CrossZoneLoadBalancing' ### **Backout Plan:** If enabling Cross-Zone Load Balancing causes issues: **Using AWS Console:** - Navigate to EC2 Dashboard → Load Balancers. - Select the Classic Load Balancer. - Click Edit Attributes. - Uncheck the Cross-Zone Load Balancing option. ![](https://support.icompaas.com/assets/kb/91ede2526ec18165.png) - Click Save. ![](https://support.icompaas.com/assets/kb/2b48b602d1f31b11.png) **Using AWS CLI:** aws elb modify-load-balancer-attributes --load-balancer-name --load-balancer-attributes 'CrossZoneLoadBalancing={"Enabled":false}' ### **References:** 1. [AWS CLB Documentation](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-disable-crosszone-lb.html) 2. [AWS CLI - ELB Commands](https://docs.aws.amazon.com/cli/latest/reference/elb/index.html) 3. [Best Practices for Classic Load Balancers](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/best-practices.html) ### **CIS Controls:**

Version	Control ID	Control Description	IG1	IG2	IG3
v8	5.3	Securely Manage Network Infrastructure – Ensure load balancers distribute traffic optimally.	●	●	●
v8	13.2	Ensure Secure Network Communication – Implement balanced traffic routing to ensure availability.	●	●	●
v7	9.1	Limit Exposure to External Networks – Optimize traffic flow and distribution across resources.	●	●	●

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.