Project: KICS (Provisioning / Security & Compliance)
File: 20018359-6fd7-4d05-ab26-d4dffccbdf79.md

title: ELB Access Log Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 20018359-6fd7-4d05-ab26-d4dffccbdf79 Query name: ELB Access Log Disabled Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: ELB should have logging enabled to help on error investigation<br> ```tf title="Positive test num. 1 - tf file" hl_lines="9" resource "aws_elb" "postive1" { name = "foobar-terraform-elb" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] access_logs { bucket = "foo" bucket_prefix = "bar" interval = 60 enabled = false } listener { instance_port = 8000 instance_protocol = "http" lb_port = 80 lb_protocol = "http" } listener { instance_port = 8000 instance_protocol = "http" lb_port = 443 lb_protocol = "https" sslcertificateid = "arn:aws:iam::123456789012:server-certificate/certName" } health_check { healthy_threshold = 2 unhealthy_threshold = 2 timeout = 3 target = "HTTP:8000/" interval = 30 } instances = [aws_instance.foo.id] crosszoneload_balancing = true idle_timeout = 400 connection_draining = true connectiondrainingtimeout = 400 tags = { Name = "foobar-terraform-elb" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" resource "aws_elb" "postive2" { name = "foobar-terraform-elb" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] listener { instance_port = 8000 instance_protocol = "http" lb_port = 80 lb_protocol = "http" } listener { instance_port = 8000 instance_protocol = "http" lb_port = 443 lb_protocol = "https" sslcertificateid = "arn:aws:iam::123456789012:server-certificate/certName" } health_check { healthy_threshold = 2 unhealthy_threshold = 2 timeout = 3 target = "HTTP:8000/" interval = 30 } instances = [aws_instance.foo.id] crosszoneload_balancing = true idle_timeout = 400 connection_draining = true connectiondrainingtimeout = 400 tags = { Name = "foobar-terraform-elb" } } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="1" module "elb_http" { source = "terraform-aws-modules/elb/aws" version = "~> 2.0" name = "elb-example" subnets = ["subnet-12345678", "subnet-87654321"] security_groups = ["sg-12345678"] internal = false listener = [ { instance_port = 80 instance_protocol = "HTTP" lb_port = 80 lb_protocol = "HTTP" }, { instance_port = 8080 instance_protocol = "http" lb_port = 8080 lb_protocol = "http" sslcertificateid = "arn:aws:acm:eu-west-1:235367859451:certificate/6c270328-2cd5-4b2d-8dfd-ae8d0004ad31" }, ] health_check = { target = "HTTP:80/" interval = 30 healthy_threshold = 2 unhealthy_threshold = 2 timeout = 5 } // ELB attachments numberofinstances = 2 instances = ["i-06ff41a77dfb5349d", "i-4906ff41a77dfb53d"] tags = { Owner = "user" Environment = "dev" } } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="39" module "elb_http" { source = "terraform-aws-modules/elb/aws" version = "~>

name = "elb-example" subnets = ["subnet-12345678", "subnet-87654321"] security_groups = ["sg-12345678"] internal = false listener = [ { instance_port = 80 instance_protocol = "HTTP" lb_port = 80 lb_protocol = "HTTP" }, { instance_port = 8080 instance_protocol = "http" lb_port = 8080 lb_protocol = "http" sslcertificateid = "arn:aws:acm:eu-west-1:235367859451:certificate/6c270328-2cd5-4b2d-8dfd-ae8d0004ad31" }, ] health_check = { target = "HTTP:80/" interval = 30 healthy_threshold = 2 unhealthy_threshold = 2 timeout = 5 } access_logs = { bucket = "foo" bucket_prefix = "bar" interval = 60 enabled = false } // ELB attachments numberofinstances = 2 instances = ["i-06ff41a77dfb5349d", "i-4906ff41a77dfb53d"] tags = { Owner = "user" Environment = "dev" } } ``` </details> ```tf title="Negative test num. 1 - tf file" resource "aws_elb" "negative1" { name = "foobar-terraform-elb" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] access_logs { bucket = "foo" bucket_prefix = "bar" interval = 60 } listener { instance_port = 8000 instance_protocol = "http" lb_port = 80 lb_protocol = "http" } listener { instance_port = 8000 instance_protocol = "http" lb_port = 443 lb_protocol = "https" sslcertificateid = "arn:aws:iam::123456789012:server-certificate/certName" } health_check { healthy_threshold = 2 unhealthy_threshold = 2 timeout = 3 target = "HTTP:8000/" interval = 30 } instances = [aws_instance.foo.id] crosszoneload_balancing = true idle_timeout = 400 connection_draining = true connectiondrainingtimeout = 400 tags = { Name = "foobar-terraform-elb" } } ``` ```tf title="Negative test num. 2 - tf file" resource "aws_elb" "negative2" { name = "foobar-terraform-elb" availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"] access_logs { bucket = "foo" bucket_prefix = "bar" interval = 60 enabled = true } listener { instance_port = 8000 instance_protocol = "http" lb_port = 80 lb_protocol = "http" } listener { instance_port = 8000 instance_protocol = "http" lb_port = 443 lb_protocol = "https" sslcertificateid = "arn:aws:iam::123456789012:server-certificate/certName" } health_check { healthy_threshold = 2 unhealthy_threshold = 2 timeout = 3 target = "HTTP:8000/" interval = 30 } instances = [aws_instance.foo.id] crosszoneload_balancing = true idle_timeout = 400 connection_draining = true connectiondrainingtimeout = 400 tags = { Name = "foobar-terraform-elb" } } ``` ```tf title="Negative test num. 3 - tf file" module "elb_http" { source = "terraform-aws-modules/elb/aws" version = "~> 2.0" name = "elb-example" subnets = ["subnet-12345678", "subnet-87654321"] security_groups = ["sg-12345678"] internal = false listener = [ { instance_port = 80 instance_protocol = "HTTP" lb_port = 80 lb_protocol = "HTTP" }, { instance_port = 8080 instance_protocol = "http" lb_port = 8080 lb_protocol = "http" sslcertificateid = "arn:aws:acm:eu-west-1:235367859451:certificate/6c270328-2cd5-4b2d-8dfd-ae8d0004ad31" }, ] health_check = { target = "HTTP:80/" interval = 30 healthy_threshold = 2 unhealthy_threshold = 2 timeout = 5 } access_logs = { bucket = "foo" bucket_prefix = "bar" interval = 60 } // ELB attachments numberofinstances = 2 instances = ["i-06ff41a77dfb5349d", "i-4906ff41a77dfb53d"] tags = { Owner = "user" Environment = "dev" } } ``` <details><summary>Negative test num. 4 - tf file</summary> ```tf module "elb_http" { source = "terraform-aws-modules/elb/aws" version = "~> 2.0" name = "elb-example" subnets = ["subnet-12345678", "subnet-87654321"] security_groups = ["sg-12345678"] internal = false listener = [ { instance_port = 80 instance_protocol = "HTTP" lb_port = 80 lb_protocol = "HTTP" }, { instance_port = 8080 instance_protocol = "http" lb_port = 8080 lb_protocol = "http" sslcertificateid = "arn:aws:acm:eu-west-1:235367859451:certificate/6c270328-2cd5-4b2d-8dfd-ae8d0004ad31" }, ] health_check = { target = "HTTP:80/" interval = 30 healthy_threshold = 2 unhealthy_threshold = 2 timeout = 5 } access_logs = { bucket = "foo" bucket_prefix = "bar" interval = 60 enabled = true } // ELB attachments numberofinstances = 2 instances = ["i-06ff41a77dfb5349d", "i-4906ff41a77dfb53d"] tags = { Owner = "user" Environment = "dev" } } ``` </details>