# Ensure Classic Load Balancers have access logging enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292209909447-ensure-classic-load-balancers-have-access-logging-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that access logging is enabled on every Classic Load Balancer. Access logs record detailed information about each request sent to the load balancer, such as the time, client IP address, request path, response status and TLS details, and deliver it to an Amazon S3 bucket.

**Rationale**

Without access logs there is no record of the traffic that reaches the application through the load balancer. This makes it hard to detect reconnaissance, brute-force and exploitation attempts, and slows down incident investigation and troubleshooting of outages or DDoS attacks. Enabling access logs to a protected S3 bucket, with restricted read access and a defined retention period, provides the visibility needed for monitoring and forensics.

**Impact**

-   Provides a record of all requests for security monitoring, investigations and troubleshooting
    
-   Supports audit and compliance requirements for logging network traffic
    
-   Storing log files in Amazon S3 incurs storage charges; there is no additional charge for access logging itself
    
-   No effect on traffic handled by the load balancer
    

**Default Value**

Access logging is disabled by default on Classic Load Balancers.

**Pre-Requisites**

-   IAM permissions: elasticloadbalancing:DescribeLoadBalancers, elasticloadbalancing:DescribeLoadBalancerAttributes and elasticloadbalancing:ModifyLoadBalancerAttributes
    
-   An S3 bucket in the same region as the load balancer, encrypted with Amazon S3 managed keys (SSE-S3)
    
-   A bucket policy that allows Elastic Load Balancing to write access logs to the bucket, as described in the AWS documentation for your region
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon EC2 console and select **Load Balancers** under **Load Balancing**.
    
3.  Select a load balancer of type **classic** and open the **Attributes** tab.
    
4.  Check that **Access logs** is enabled and shows an S3 location.
    
5.  Repeat for each Classic Load Balancer in each region in use.
    
6.  If access logs are disabled, follow the implementation steps.
    

**CLI:**

List the Classic Load Balancers in the region:

aws elb describe-load-balancers --region <REGION> --query "LoadBalancerDescriptions\[\].LoadBalancerName"

Show the access log settings of a load balancer:

aws elb describe-load-balancer-attributes --region <REGION> --load-balancer-name <LOAD\_BALANCER\_NAME> --query "LoadBalancerAttributes.AccessLog"

A load balancer fails if Enabled is false.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon EC2 console and select **Load Balancers** under **Load Balancing**.
    
3.  Select the Classic Load Balancer and open the **Attributes** tab.
    
4.  Choose **Edit**.
    
5.  Turn on **Access logs** and enter the S3 location, for example s3://<BUCKET\_NAME>/<PREFIX>.
    
6.  Choose **Save changes**.
    
7.  Repeat for each affected load balancer in each region in use.
    

**CLI:**

Enable access logging to the S3 bucket:

aws elb modify-load-balancer-attributes --region <REGION> --load-balancer-name <LOAD\_BALANCER\_NAME> --load-balancer-attributes AccessLog={Enabled=true,S3BucketName=<BUCKET\_NAME>}

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon EC2 console and select the Classic Load Balancer.
    
3.  Open the **Attributes** tab and choose **Edit**.
    
4.  Turn off **Access logs**.
    
5.  Choose **Save changes**.
    

**CLI:**

aws elb modify-load-balancer-attributes --region <REGION> --load-balancer-name <LOAD\_BALANCER\_NAME> --load-balancer-attributes AccessLog={Enabled=false}

Note: disabling access logs removes visibility of requests to the load balancer. Log files already delivered to S3 are not deleted.

**Reference**

-   [https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/access-log-collection.html](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/access-log-collection.html)
    
-   [https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-access-logs.html](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-access-logs.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/elb/modify-load-balancer-attributes.html](https://docs.aws.amazon.com/cli/latest/reference/elb/modify-load-balancer-attributes.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.