Project: KICS (Provisioning / Security & Compliance)
File: ee12ad32-2863-4c0f-b13f-28272d115028.md

title: ELB Access Log Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: ee12ad32-2863-4c0f-b13f-28272d115028 Query name: ELB Access Log Disabled Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: ELB should have access log enabled<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="6" AWSTemplateFormatVersion: "2010-09-09" Description: A simple EC2 instance Resources: MyLoadBalancer: Type: AWS::ElasticLoadBalancing::LoadBalancer Properties: AvailabilityZones: "us-east-2a" CrossZone: true Listeners: InstancePort: "80" InstanceProtocol: HTTP LoadBalancerPort: "443" Protocol: HTTPS PolicyNames: My-SSLNegotiation-Policy SSLCertificateId: arn:aws:iam::123456789012:server-certificate/my-server-certificate HealthCheck: Target: HTTP:80/ HealthyThreshold: "2" UnhealthyThreshold: "3" Interval: "10" Timeout: "5" Policies: PolicyName: My-SSLNegotiation-Policy PolicyType: SSLNegotiationPolicyType Attributes: Name: Reference-Security-Policy Value: ELBSecurityPolicy-TLS-1-2-2017-01 ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="31" AWSTemplateFormatVersion: "2010-09-09" Description: A simple EC2 instance Resources: MyLoadBalancer2: Type: AWS::ElasticLoadBalancing::LoadBalancer Properties: AvailabilityZones: "us-east-2a" CrossZone: true Listeners: InstancePort: "80" InstanceProtocol: HTTP LoadBalancerPort: "443" Protocol: HTTPS PolicyNames: My-SSLNegotiation-Policy SSLCertificateId: arn:aws:iam::123456789012:server-certificate/my-server-certificate HealthCheck: Target: HTTP:80/ HealthyThreshold: "2" UnhealthyThreshold: "3" Interval: "10" Timeout: "5" Policies: PolicyName: My-SSLNegotiation-Policy PolicyType: SSLNegotiationPolicyType Attributes: Name: Reference-Security-Policy Value: ELBSecurityPolicy-TLS-1-2-2017-01 AccessLoggingPolicy: Enabled: false S3BucketName: teste ``` ```json title="Positive test num. 3 - json file" hl_lines="7" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "A simple EC2 instance", "Resources": { "MyLoadBalancer": { "Type": "AWS::ElasticLoadBalancing::LoadBalancer", "Properties": { "AvailabilityZones": [ "us-east-2a" ], "CrossZone": true, "Listeners": [ { "InstancePort": "80", "InstanceProtocol": "HTTP", "LoadBalancerPort": "443", "Protocol": "HTTPS", "PolicyNames": [ "My-SSLNegotiation-Policy" ], "SSLCertificateId": "arn:aws:iam::123456789012:server-certificate/my-server-certificate" } ], "HealthCheck": { "Target": "HTTP:80/", "HealthyThreshold": "2", "UnhealthyThreshold": "3", "Interval": "10", "Timeout": "5" }, "Policies": [ { "PolicyName": "My-SSLNegotiation-Policy", "PolicyType": "SSLNegotiationPolicyType", "Attributes": [ { "Name": "Reference-Security-Policy", "Value": "ELBSecurityPolicy-TLS-1-2-2017-01" } ] } ] } } } } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="18" { "Resources": { "MyLoadBalancer2": { "Properties": { "Policies": [ { "PolicyType": "SSLNegotiationPolicyType", "Attributes": [ { "Name": "Reference-Security-Policy", "Value": "ELBSecurityPolicy-TLS-1-2-2017-01" } ], "PolicyName": "My-SSLNegotiation-Policy" } ], "AccessLoggingPolicy": { "Enabled": false, "S3BucketName": "teste" }, "AvailabilityZones": [ "us-east-2a" ], "CrossZone": true, "Listeners": [ { "InstancePort": "80", "InstanceProtocol": "HTTP", "LoadBalancerPort": "443", "Protocol": "HTTPS", "PolicyNames": [ "My-SSLNegotiation-Policy" ], "SSLCertificateId": "arn:aws:iam::123456789012:server-certificate/my-server-certificate" } ], "HealthCheck": { "Interval": "10", "Timeout": "5", "Target": "HTTP:80/", "HealthyThreshold": "2", "UnhealthyThreshold": "3" } }, "Type": "AWS::ElasticLoadBalancing::LoadBalancer" } }, "AWSTemplateFormatVersion": "2010-09-09", "Description": "A simple EC2 instance" } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: A simple EC2 instance Resources: MyLoadBalancer: Type: AWS::ElasticLoadBalancing::LoadBalancer Properties: AvailabilityZones: "us-east-2a" CrossZone: true Listeners: InstancePort: "80" InstanceProtocol: HTTP LoadBalancerPort: "443" Protocol: HTTPS PolicyNames: My-SSLNegotiation-Policy SSLCertificateId: arn:aws:iam::123456789012:server-certificate/my-server-certificate HealthCheck: Target: HTTP:80/ HealthyThreshold: "2" UnhealthyThreshold: "3" Interval: "10" Timeout: "5" Policies: PolicyName: My-SSLNegotiation-Policy PolicyType: SSLNegotiationPolicyType Attributes: Name: Reference-Security-Policy Value: ELBSecurityPolicy-TLS-1-2-2017-01 AccessLoggingPolicy: Enabled: true S3BucketName: teste ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "A simple EC2 instance", "Resources": { "MyLoadBalancer": { "Type": "AWS::ElasticLoadBalancing::LoadBalancer", "Properties": { "Policies": [ { "PolicyName": "My-SSLNegotiation-Policy", "PolicyType": "SSLNegotiationPolicyType", "Attributes": [ { "Name": "Reference-Security-Policy", "Value": "ELBSecurityPolicy-TLS-1-2-2017-01" } ] } ], "AccessLoggingPolicy": [ { "Enabled": true, "S3BucketName": "teste" } ], "AvailabilityZones": [ "us-east-2a" ], "CrossZone": true, "Listeners": [ { "LoadBalancerPort": "443", "Protocol": "HTTPS", "PolicyNames": [ "My-SSLNegotiation-Policy" ], "SSLCertificateId": "arn:aws:iam::123456789012:server-certificate/my-server-certificate", "InstancePort": "80", "InstanceProtocol": "HTTP" } ], "HealthCheck": { "Timeout": "5", "Target": "HTTP:80/", "HealthyThreshold": "2", "UnhealthyThreshold": "3", "Interval": "10" } } } } } ```