Rule: ELB Application and Classic Load Balancer Logging Should Be Enabled

NIST 800-53 Revision 5: Enable logging for ELB Application and Classic Load Balancer

Description:

Troubleshooting Steps:

2. 1.
   Verify IAM access: Ensure that the user or role you are using has the necessary permissions to enable logging for ELB and access the required service APIs.
4. 2.
   Check resource limits: Confirm that your AWS account does not exceed any limits imposed on ELB or CloudWatch.
6. 3.
   Review CloudWatch agent configuration: If you are using the CloudWatch agent to collect logs, make sure the agent is installed and configured correctly.
8. 4.
   Examine security groups and network ACLs: Confirm that the necessary ports and protocols required for logging are open in security groups and network ACLs.
10. 5.
    Check CloudWatch Logs subscription filter: If you are using CloudWatch Logs subscription filters, verify that the filter pattern is correctly configured.

Necessary Codes:

AWS CLI Command:

# Enable access logging for an ELB Application Load Balancer:
aws elbv2 modify-load-balancer-attributes --load-balancer-arn YOUR_LB_ARN --attributes Key=access_logs.s3.enabled,Value=true

# Enable access logging for a Classic Load Balancer:
aws elb modify-load-balancer-attributes --load-balancer-name YOUR_LB_NAME --load-balancer-attributes "{\"AccessLog\":{\"Enabled\":true,\"S3BucketName\":\"YOUR_BUCKET_NAME\"}}"

AWS CloudFormation:

Resources:
  YourLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      LoadBalancerAttributes:
        - Key: access_logs.s3.enabled
          Value: "true"

Step-by-step Guide for Remediation:

2. 1.

   ELB Application Load Balancer:

   • Open the AWS Management Console and navigate to the EC2 service.
   • In the navigation pane, select "Load Balancers."
   • Choose the Application Load Balancer you want to enable logging for.
   • Go to the "Attributes" tab.
   • Under "Access Logs," click on "Edit."
   • Enable access logging by selecting the checkbox next to "Enable access logs to an S3 bucket."
   • Choose the S3 bucket where the logs should be stored, or create a new bucket.
   • Click "Save."
4. 2.

   Classic Load Balancer:

   • Open the AWS Management Console and navigate to the EC2 service.
   • In the navigation pane, select "Load Balancers."
   • Choose the Classic Load Balancer you want to enable logging for.
   • Go to the "Description" tab.
   • Under the "Attributes" section, click on "Enable Access Logs."
   • Enable access logging by selecting the checkbox next to "Enable access logs."
   • Specify the S3 bucket name where the logs should be stored.
   • Click "Save."