Ensure access logging is enabled for AWS LB (Load Balancer)

MEDIUM

Description

AWS classic load balancers do not have access logging enabled.Access logging should be enabled in order to analyze statistics, diagnose issues, and retain data for regulatory or legal purposes.

Remediation

In AWS Console -

  1. Sign in to the AWS Console and open the Load Balancer Console.
  2. Choose the load balancer to edit and in the Actions drop down select Edit load balancer attributes.
  3. Under Attributes, select Configure access logs.
  4. Check the Enable access logs box and provide an interval and S3 location.
  5. Select Save.

In Terraform -

  1. In the aws_lb resource, set the access_logs.enabled field to true.
  2. Provide a bucket (S3 location).

References:
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb#access_logs

Policy Details

Rule Reference ID: AC_AWS_0435
CSP: AWS
Remediation Available: Yes
Resource: aws_lb
Resource Category: Virtual Network
Resource Type: Load Balancer

Frameworks