Rule: ELB Application and Classic Load Balancer Logging Should Be Enabled

Rule Description: Enable ELB Application and Classic Load Balancer Logging for FFIEC Compliance

Troubleshooting Steps (if any):

2. 1.
   Check if the ELB logging feature is already enabled.
4. 2.
   Verify if there are any existing logs and their storage location.
6. 3.
   Ensure that the necessary permissions are granted to access and write logs to the designated logging storage.

Necessary Codes (if any):

AWS CLI Code Snippet:

aws elbv2 modify-load-balancer-attributes --load-balancer-arn <ELB_ARN> --attributes Key=access_logs.s3.enabled,Value=true Key=access_logs.s3.bucket,Value=<BUCKET_NAME> Key=access_logs.s3.prefix,Value=<BUCKET_PREFIX>

AWS SDK for Python (Boto3) Code Snippet:

import boto3

elbv2_client = boto3.client('elbv2')

response = elbv2_client.modify_load_balancer_attributes(
    LoadBalancerArn='<ELB_ARN>',
    Attributes=[
        {
            'Key': 'access_logs.s3.enabled',
            'Value': 'true'
        },
        {
            'Key': 'access_logs.s3.bucket',
            'Value': '<BUCKET_NAME>'
        },
        {
            'Key': 'access_logs.s3.prefix',
            'Value': '<BUCKET_PREFIX>'
        }
    ]
)

Step-by-Step Guide for Remediation:

2. 1.

   Identify the Elastic Load Balancer (ELB) instances that need logging enabled. Note down the ARN (Amazon Resource Name) of each ELB required for compliance.

4. 2.

   Determine the AWS region in which the ELBs exist.

6. 3.

   Ensure that you have the necessary permissions to modify the load balancer attributes.

8. 4.

   Choose the appropriate method to configure ELB logging (CLI or SDK). The examples provided above use the AWS CLI and Python SDK (Boto3) for illustration purposes.

10. 5.

    Open your preferred command-line interface (CLI) or Integrated Development Environment (IDE).

12. 6.

    If using the AWS CLI, run the provided code snippet, replacing

    <ELB_ARN>

    ,

    <BUCKET_NAME>

    , and

    <BUCKET_PREFIX>

    with the correct values for your environment.

    If using the AWS SDK for Python (Boto3), utilize the provided code snippet, making the necessary modifications based on your environment.

14. 7.

    Verify if the logging attributes were successfully modified by checking the response from the API call or inspecting the load balancer attributes.

16. 8.

    Repeat the process for each ELB instance that requires logging enabled.

18. 9.

    Monitor the S3 bucket where the logs are stored to ensure they are being generated and updated correctly.