Description: 

Elastic Load Balancing(ELB) automatically distributes incoming application traffic across multiple targets, such as EC2 instances, containers, IP addresses, Lambda functions, and virtual appliances. It can handle the varying load of your application traffic in a single Availability Zone or across multiple Availability Zones.

Rationale: 

It can monitor the health of its registered targets and route traffic only to the healthy targets. It evenly distributes traffic across all availability zones in a region, improving fault tolerance. This strategy improves the performance and availability of applications, websites, databases, and other computing resources. It also helps process user requests quickly and accurately.

Impact:

  • Analyze access and traffic patterns

  • Troubleshoot applications

  • Perform security monitoring

  • Improve the user experience

  • Discover and debug problems with the EC2 platform

Default Value:

  1. By default, the AWS will not enable the logging, but when the logging is enabled manually, the Elastic Load Balance stores logs with a time interval of 60 minutes until the time interval is specified. 

Audit:

Checking to see if a load balancer is enabled

  1. Open the Amazon EC2 console
  2. On the navigation pane, under LOAD BALANCING, choose Load Balancers.
  3. Select your load balancer.

  4. Assigning IAM Roles to EC2.

CLI checking if a load balancer is enabled

aws elb describe-load-balancers

Remediation:

Pre-Requisites: 

  1. Need to have an S3 Bucket where the logging would happen

  2. Need to have Active ELB enabled in the environment

  3. Assigning IAM Roles to EC2. After auditing, if you find any Elastic Load Balancer without logging enabled.

Implementation Steps:

  1. Open the Amazon EC2 console

    1. On the navigation pane, under load balancing choose Load Balancers.

    2. Select your load balancer.

    3. On the Description tab, choose Configure Access Logs.

    4. On the Configure Access Logs page, Click to Enable access logs.

Enabling ELB Using the CLI

  • Use the following modify-load-balancer-attributes command to disable access logging:
    aws elb modify-load-balancer-attributes --load-balancer-name my-loadbalancer --load-balancer-attributes "{"AccessLog":{"Enabled":true}}"

 

  1. Create an S3 Bucket 

    • Attach an ELB policy to the S3 Bucket.

    • Enable Access Logs.

    • Verify that the Load Balancer Created a Test File in the S3 Bucket.

Enabling logging in load balancers: 

aws configservice put-config-rule --config-rule '{
    "ConfigRuleName": "elb-logging-enabled",
    "Description": "A Config rule that checks whether the Application Load Balancers and the Classic Load Balancers have logging enabled. The rule is NON_COMPLIANT if the the access_logs.s3.enabled is true and access_logs.S3.bucket is equal to the s3BucketName that you pr...",
    "Source": {
        "Owner": "AWS",
        "SourceIdentifier": "ELB_LOGGING_ENABLED",
        "SourceDetails": []
    },
    "Scope": {
        "ComplianceResourceTypes": [
            "AWS::ElasticLoadBalancing::LoadBalancer",
            "AWS::ElasticLoadBalancingV2::LoadBalancer"
        ]
    },
    "InputParameters": "{}"
}'

Backout Plan: Disabling Using the GUI

  • Open the Amazon EC2 console

    1. On the navigation pane, under load balancing choose Load Balancers.

    2. Select your load balancer.

    3. On the Description tab, choose Configure Access Logs.

    4. On the Configure Access Logs page, clear Enable access logs.

Disabling Using the CLI