Project: KICS (Provisioning / Security & Compliance)
File: c62e8b7d-1fdf-4050-ac4c-76ba9e1d9621.md

title: ELBv2 ALB Access Log Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: c62e8b7d-1fdf-4050-ac4c-76ba9e1d9621 Query name: ELBv2 ALB Access Log Disabled Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: ELBv2 ALBs should have access log enabled to capture detailed information about requests sent to your load balancer.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="22" AWSTemplateFormatVersion: "2010-09-09" Description: A simple EC2 instance Parameters: EnvironmentName: Description: An environment name that will be prefixed to resource names Type: String VPC: Type: AWS::EC2::VPC::Id Description: Choose which VPC the Application Load Balancer should be deployed to Subnets: Description: Choose which subnets the Application Load Balancer should be deployed to Type: List<AWS::EC2::Subnet::Id> SecurityGroup: Description: Select the Security Group to apply to the Application Load Balancer Type: AWS::EC2::SecurityGroup::Id Resources: LoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: !Ref EnvironmentName Subnets: !Ref Subnets SecurityGroups: !Ref SecurityGroup Tags: Key: Name Value: !Ref EnvironmentName ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="30" AWSTemplateFormatVersion: "2010-09-09" Description: A simple EC2 instance Parameters: EnvironmentName: Description: An environment name that will be prefixed to resource names Type: String VPC: Type: AWS::EC2::VPC::Id Description: Choose which VPC the Application Load Balancer should be deployed to Subnets: Description: Choose which subnets the Application Load Balancer should be deployed to Type: List<AWS::EC2::Subnet::Id> SecurityGroup: Description: Select the Security Group to apply to the Application Load Balancer Type: AWS::EC2::SecurityGroup::Id Resources: LoadBalancertest: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: !Ref EnvironmentName Subnets: !Ref Subnets SecurityGroups: !Ref SecurityGroup Tags: Key: Name Value: !Ref EnvironmentName LoadBalancerAttributes: Key: access_logs.s3.enabled Value: false ``` ```json title="Positive test

3 - json file" hl_lines="23" { "Parameters": { "SecurityGroup": { "Description": "Select the Security Group to apply to the Application Load Balancer", "Type": "AWS::EC2::SecurityGroup::Id" }, "EnvironmentName": { "Description": "An environment name that will be prefixed to resource names", "Type": "String" }, "VPC": { "Type": "AWS::EC2::VPC::Id", "Description": "Choose which VPC the Application Load Balancer should be deployed to" }, "Subnets": { "Description": "Choose which subnets the Application Load Balancer should be deployed to", "Type": "List\u003cAWS::EC2::Subnet::Id\u003e" } }, "Resources": { "LoadBalancer": { "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", "Properties": { "Name": "EnvironmentName", "Subnets": "Subnets", "SecurityGroups": [ "SecurityGroup" ], "Tags": [ { "Key": "Name", "Value": "EnvironmentName" } ] } } }, "AWSTemplateFormatVersion": "2010-09-09", "Description": "A simple EC2 instance" } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="36" { "Description": "A simple EC2 instance", "Parameters": { "SecurityGroup": { "Description": "Select the Security Group to apply to the Application Load Balancer", "Type": "AWS::EC2::SecurityGroup::Id" }, "EnvironmentName": { "Description": "An environment name that will be prefixed to resource names", "Type": "String" }, "VPC": { "Type": "AWS::EC2::VPC::Id", "Description": "Choose which VPC the Application Load Balancer should be deployed to" }, "Subnets": { "Description": "Choose which subnets the Application Load Balancer should be deployed to", "Type": "List\u003cAWS::EC2::Subnet::Id\u003e" } }, "Resources": { "LoadBalancertest": { "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", "Properties": { "Name": "EnvironmentName", "Subnets": "Subnets", "SecurityGroups": [ "SecurityGroup" ], "Tags": [ { "Value": "EnvironmentName", "Key": "Name" } ], "LoadBalancerAttributes": [ { "Key": "access_logs.s3.enabled", "Value": false } ] } } }, "AWSTemplateFormatVersion": "2010-09-09" } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: A simple EC2 instance Parameters: EnvironmentName: Description: An environment name that will be prefixed to resource names Type: String VPC: Type: AWS::EC2::VPC::Id Description: Choose which VPC the Application Load Balancer should be deployed to Subnets: Description: Choose which subnets the Application Load Balancer should be deployed to Type: List<AWS::EC2::Subnet::Id> SecurityGroup: Description: Select the Security Group to apply to the Application Load Balancer Type: AWS::EC2::SecurityGroup::Id Resources: LoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Name: !Ref EnvironmentName Subnets: !Ref Subnets SecurityGroups: !Ref SecurityGroup Tags: Key: Name Value: !Ref EnvironmentName LoadBalancerAttributes: Key: access_logs.s3.enabled Value: true ``` ```json title="Negative test num. 2 - json file" { "Description": "A simple EC2 instance", "Parameters": { "EnvironmentName": { "Description": "An environment name that will be prefixed to resource names", "Type": "String" }, "VPC": { "Type": "AWS::EC2::VPC::Id", "Description": "Choose which VPC the Application Load Balancer should be deployed to" }, "Subnets": { "Description": "Choose which subnets the Application Load Balancer should be deployed to", "Type": "List\u003cAWS::EC2::Subnet::Id\u003e" }, "SecurityGroup": { "Description": "Select the Security Group to apply to the Application Load Balancer", "Type": "AWS::EC2::SecurityGroup::Id" } }, "Resources": { "LoadBalancer": { "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer", "Properties": { "SecurityGroups": [ "SecurityGroup" ], "Tags": [ { "Key": "Name", "Value": "EnvironmentName" } ], "LoadBalancerAttributes": [ { "Key": "access_logs.s3.enabled", "Value": true } ], "Name": "EnvironmentName", "Subnets": "Subnets" } } }, "AWSTemplateFormatVersion": "2010-09-09" } ```