Application, Network and Gateway Load Balancers should span multiple Availability Zones

How to fix it

Attach subnets so the load balancer is enabled in at least two Availability Zones. An Application Load Balancer needs two from creation, so one failing this is unusual; on a Network or Gateway Load Balancer a zone can be added but not removed. A zone with no registered targets adds nothing. This reads the load balancer's enabled zones, not where its targets are, so it can pass where AWS's own rule would not.

In the console

EC2 -> Load balancers -> the load balancer -> Network mapping -> Edit subnets

With the AWS CLI

aws elbv2 set-subnets --load-balancer-arn <load-balancer-arn> --subnets <subnet-id-a> <subnet-id-b> --region <region>

With Terraform

resource "aws_lb" "this" {
  subnets = var.subnet_ids
}