Description

Ensure that access logging is enabled on every Classic Load Balancer. Access logs record detailed information about each request sent to the load balancer, such as the time, client IP address, request path, response status and TLS details, and deliver it to an Amazon S3 bucket.

Rationale

Without access logs there is no record of the traffic that reaches the application through the load balancer. This makes it hard to detect reconnaissance, brute-force and exploitation attempts, and slows down incident investigation and troubleshooting of outages or DDoS attacks. Enabling access logs to a protected S3 bucket, with restricted read access and a defined retention period, provides the visibility needed for monitoring and forensics.

Impact

  • Provides a record of all requests for security monitoring, investigations and troubleshooting

  • Supports audit and compliance requirements for logging network traffic

  • Storing log files in Amazon S3 incurs storage charges; there is no additional charge for access logging itself

  • No effect on traffic handled by the load balancer

Default Value

Access logging is disabled by default on Classic Load Balancers.

Pre-Requisites

  • IAM permissions: elasticloadbalancing:DescribeLoadBalancers, elasticloadbalancing:DescribeLoadBalancerAttributes and elasticloadbalancing:ModifyLoadBalancerAttributes

  • An S3 bucket in the same region as the load balancer, encrypted with Amazon S3 managed keys (SSE-S3)

  • A bucket policy that allows Elastic Load Balancing to write access logs to the bucket, as described in the AWS documentation for your region

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select Load Balancers under Load Balancing.

  3. Select a load balancer of type classic and open the Attributes tab.

  4. Check that Access logs is enabled and shows an S3 location.

  5. Repeat for each Classic Load Balancer in each region in use.

  6. If access logs are disabled, follow the implementation steps.

CLI:

List the Classic Load Balancers in the region:

aws elb describe-load-balancers --region <REGION> --query "LoadBalancerDescriptions[].LoadBalancerName"

Show the access log settings of a load balancer:

aws elb describe-load-balancer-attributes --region <REGION> --load-balancer-name <LOAD_BALANCER_NAME> --query "LoadBalancerAttributes.AccessLog"

A load balancer fails if Enabled is false.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select Load Balancers under Load Balancing.

  3. Select the Classic Load Balancer and open the Attributes tab.

  4. Choose Edit.

  5. Turn on Access logs and enter the S3 location, for example s3://<BUCKET_NAME>/<PREFIX>.

  6. Choose Save changes.

  7. Repeat for each affected load balancer in each region in use.

CLI:

Enable access logging to the S3 bucket:

aws elb modify-load-balancer-attributes --region <REGION> --load-balancer-name <LOAD_BALANCER_NAME> --load-balancer-attributes AccessLog={Enabled=true,S3BucketName=<BUCKET_NAME>}

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select the Classic Load Balancer.

  3. Open the Attributes tab and choose Edit.

  4. Turn off Access logs.

  5. Choose Save changes.

CLI:

aws elb modify-load-balancer-attributes --region <REGION> --load-balancer-name <LOAD_BALANCER_NAME> --load-balancer-attributes AccessLog={Enabled=false}

Note: disabling access logs removes visibility of requests to the load balancer. Log files already delivered to S3 are not deleted.

Reference