Enable ELB Application and Classic Load Balancer Logging Rule
This rule ensures that logging is enabled for ELB application and classic load balancers.
| Rule | ELB application and classic load balancer logging should be enabled |
| Framework | NIST 800-53 Revision 5 |
| Severity | ✔ High |
Rule Description:
ELB (Elastic Load Balancer) application and classic load balancer logging must be enabled to comply with the NIST 800-53 Revision 5 security standard. Logging enables the collection of important information about the load balancer's activities, helping with security monitoring, incident response, and compliance auditing.
Troubleshooting Steps:
If ELB logging is not enabled or encountering issues, follow these troubleshooting steps:
- 1.
Check IAM Permissions: Ensure that the IAM (Identity and Access Management) policy associated with the load balancer includes the required permissions for logging. These permissions should grant access to write logs to Amazon S3 or CloudWatch.
- 2.
Verify Target Group Configuration: Confirm that the target groups associated with the load balancer are correctly configured. Ensure that the target group's health check settings are accurate, allowing the load balancer to route traffic properly.
- 3.
Check Load Balancer Subnets: Verify that the load balancer is placed in the correct subnets. The subnets should have appropriate access to resources and necessary security group rules.
- 4.
Examine Load Balancer Health: Check if the load balancer itself is healthy. If there are issues with the load balancer's health, it may impact logging functionality. Review CloudWatch metrics and logs related to the load balancer health.
- 5.
Review Load Balancer Access Logs: If ELB access logs aren't being produced, check the ELB access log configuration. Ensure that the access logs are enabled and that the log files are being delivered to the desired destination (e.g., S3 bucket or CloudWatch).
- 6.
Confirm AWS Region and Account: Verify that the load balancer and logging resources are in the correct AWS region and account. Cross-check any cross-account or cross-region configurations to ensure they are correctly set up.
- 7.
Check Log File Integrity: If access logs are being produced but contain incomplete or inconsistent data, examine the integrity of log files. Corruption or partial logs may indicate issues with the logging configuration or delivery.
Necessary Codes (if applicable):
If you need to enable ELB access logging, use the AWS Command Line Interface (CLI) or AWS Management Console. Here are the steps using the AWS CLI:
- 1.List your existing load balancers:
aws elbv2 describe-load-balancers
- 1.Enable access logs for the desired load balancer:
aws elbv2 modify-load-balancer-attributes --load-balancer-arn <your-load-balancer-arn> --attributes Key=access_logs.s3.enabled,Value=true Key=access_logs.s3.bucket,Value=<your-s3-bucket-name> Key=access_logs.s3.prefix,Value=<optional-prefix>
Replace
<your-load-balancer-arn><your-s3-bucket-name><optional-prefix>- 1.Ensure that the access logs are being delivered correctly to the S3 bucket or CloudWatch. Monitor the logs for data consistency and completeness.
Remediation Steps:
To enable ELB application and classic load balancer logging according to NIST 800-53 Revision 5, follow these steps:
- 1.
Open the AWS Management Console and navigate to the Amazon EC2 service.
- 2.
In the navigation pane, select "Load Balancers" to view your existing load balancers.
- 3.
Identify the load balancer(s) for which you want to enable logging.
- 4.
Click on the load balancer's name to access its configuration.
- 5.
In the "Attributes" section, locate the "Access logs" attribute and click on the "Edit" button.
- 6.
Enable access logging by selecting the checkbox.
- 7.
Specify the S3 bucket where you want to store the access logs. You can either choose an existing bucket or create a new one.
- 8.
Optionally, provide a prefix for log file names to distinguish them from logs of other resources.
- 9.
Save the changes and verify that the access logs are being generated and stored correctly.
- 10.
Regularly monitor the logs for any anomalies or issues.
By following these steps, you can ensure that ELB application and classic load balancer logging is enabled and compliant with the NIST 800-53 Revision 5 security standard.