# Ensure Elastic Load Balancers have logging enabled

- Source: https://support.icompaas.com/support/solutions/articles/62000086775-ensure-elastic-load-balancers-have-logging-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [HIPAA Readiness](https://support.icompaas.com/support/solutions/62000039493) › [AWS - HIPAA](https://support.icompaas.com/support/solutions/folders/62000060465)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:** 

Elastic Load Balancing(**ELB**) automatically distributes incoming application traffic across multiple targets, such as EC2 instances, containers, IP addresses, Lambda functions, and virtual appliances. It can handle the varying load of your application traffic in a single Availability Zone or across multiple Availability Zones.

## **Rationale:** 

It can monitor the health of its registered targets and route traffic only to the healthy targets. It evenly distributes traffic across all availability zones in a region, improving fault tolerance. This strategy improves the performance and availability of applications, websites, databases, and other computing resources. It also helps process user requests quickly and accurately.

## **Impact:**

-   Analyze access and traffic patterns
    
-   Troubleshoot applications
    
-   Perform security monitoring
    
-   Improve the user experience
    
-   Discover and debug problems with the EC2 platform
    

## **Default Value:**

1.  By default, the AWS will not enable the logging, but when the logging is enabled manually, the Elastic Load Balance stores logs with a time interval of 60 minutes until the time interval is specified. 
    

## **Audit:**

Checking to see if a load balancer is enabled

1.  Open the Amazon EC2 console![](https://support.icompaas.com/assets/kb/71091c923ec986dd.png)
2.  On the navigation pane, under LOAD BALANCING, choose Load Balancers.![](https://support.icompaas.com/assets/kb/c80d505fb3b250ec.png)
3.  Select your load balancer.![](https://support.icompaas.com/assets/kb/076ff00685bb4fe9.png)
4.  Assigning **IAM Roles to EC2**.
    

CLI checking if a load balancer is enabled

aws elb describe-load-balancers

![](https://support.icompaas.com/assets/kb/9c557bb8423cb3ad.png)

## **Remediation:**

### **Pre-Requisites:** 

1.  Need to have an S3 Bucket where the logging would happen
    
2.  Need to have **Active ELB** enabled in the environment
    
3.  Assigning **IAM Roles to EC2**. After auditing, if you find any Elastic Load Balancer without logging enabled.
    

### **Implementation Steps:**

1.  Open the Amazon EC2 console
    
    1.  On the navigation pane, under load balancing choose Load Balancers.
        
    2.  Select your load balancer.
        
    3.  On the Description tab, choose Configure Access Logs.
        
    4.  On the Configure Access Logs page, Click to Enable access logs.![](https://support.icompaas.com/assets/kb/dbf3eb61e68ba2ee.png)
        

**Enabling ELB Using the CLI**

-   Use the following modify-load-balancer-attributes command to disable access logging:  
    aws elb modify-load-balancer-attributes --load-balancer-name **my-loadbalancer** \--load-balancer-attributes "{"AccessLog":{"Enabled":true}}"
    

1.  Create an S3 Bucket 
    
    -   Attach an ELB policy to the S3 Bucket.
        
    -   Enable Access Logs.
        
    -   Verify that the Load Balancer Created a Test File in the S3 Bucket.
        

**Enabling logging in load balancers:** 

aws configservice put-config-rule --config-rule '{
    "ConfigRuleName": "elb-logging-enabled",
    "Description": "A Config rule that checks whether the Application Load Balancers and the Classic Load Balancers have logging enabled. The rule is NON\_COMPLIANT if the the access\_logs.s3.enabled is true and access\_logs.S3.bucket is equal to the s3BucketName that you pr...",
    "Source": {
        "Owner": "AWS",
        "SourceIdentifier": "ELB\_LOGGING\_ENABLED",
        "SourceDetails": \[\]
    },
    "Scope": {
        "ComplianceResourceTypes": \[
            "AWS::ElasticLoadBalancing::LoadBalancer",
            "AWS::ElasticLoadBalancingV2::LoadBalancer"
        \]
    },
    "InputParameters": "{}"
}'

### **Backout Plan: Disabling Using the GUI**

-   Open the Amazon EC2 console
    
    1.  On the navigation pane, under load balancing choose Load Balancers.
        
    2.  Select your load balancer.
        
    3.  On the Description tab, choose Configure Access Logs.
        
    4.  On the Configure Access Logs page, clear Enable access logs.
        

### **Disabling Using the CLI**

-   Use the following modify-load-balancer-attributes command to disable access logging:
    
    aws elb modify-load-balancer-attributes --load-balancer-name my-loadbalancer --load-balancer-attributes "{"AccessLog":{"Enabled":false}}"
    
    ### **Reference:**
    
-   ### **[https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html)**

## Related compliance guidance

- [HIPAA compliance for SaaS: a practical implementation guide](https://support.icompaas.com/compliance/hipaa): The Security Rule safeguards this readiness item belongs to, with a phased implementation roadmap and the evidence OCR expects.
- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Most healthcare customers ask for a SOC 2 report alongside HIPAA assurances; the two share most technical controls.