Skip to main content

Access Logging Should Be Enabled For Elastic Beanstalk Load

More Info:​

Ensure that your Amazon Elastic Beanstalk environment is configured to capture access logs for the load balancer associated with the application environment. An Elastic Beanstalk environment is a collection of AWS resources running an application version. When you create an environment, Amazon Elastic Beanstalk provisions the resources needed to run the application version you specified.

Risk Level​

Medium

Address​

Operational Maturity, Reliability, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • HIPAA
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of "Ensure Access Logging Is Enabled For Elastic Beanstalk Load Balancer" for AWS using AWS console, follow these steps:

  1. Sign in to the AWS Management Console.
  2. Navigate to the Elastic Beanstalk console.
  3. Select the appropriate application environment.
  4. In the left navigation pane, click on "Configuration".
  5. Scroll down to the "Load Balancer" section and click on the "Edit" button.
  6. In the "Logging" section, select "Enable Access Logs".
  7. Specify the S3 bucket where you want to store the access logs and provide a prefix for the log file names.
  8. Click on the "Save" button to save the changes.

After completing these steps, access logging will be enabled for the Elastic Beanstalk Load Balancer. The access logs will be stored in the specified S3 bucket and can be used for analysis and troubleshooting.

Using CLI

To remediate the misconfiguration "Ensure Access Logging Is Enabled For Elastic Beanstalk Load Balancer" for AWS using AWS CLI, follow the below steps:

  1. Open the AWS CLI on your terminal or command prompt.
  2. Run the following command to enable access logging for the Elastic Beanstalk Load Balancer:
aws elasticbeanstalk update-environment --environment-name <ENVIRONMENT_NAME> --option-settings Namespace=aws:elb:loadBalancer,OptionName=AccessLogs.S3Enabled,Value=true

Replace <ENVIRONMENT_NAME> with the name of your Elastic Beanstalk environment.

  1. Verify that access logging is enabled for the Elastic Beanstalk Load Balancer by running the following command:
aws elasticbeanstalk describe-environments --environment-names <ENVIRONMENT_NAME> --query "Environments[].OptionSettings[?Namespace=='aws:elb:loadBalancer' && OptionName=='AccessLogs.S3Enabled'].Value" --output text

This command will return "true" if access logging is enabled, and "false" if it is not enabled.

By following these steps, you can remediate the misconfiguration "Ensure Access Logging Is Enabled For Elastic Beanstalk Load Balancer" for AWS using AWS CLI.

Using Python

To remediate the misconfiguration "Ensure Access Logging Is Enabled For Elastic Beanstalk Load Balancer" for AWS using Python, you can follow the below steps:

  1. First, we need to check if the Elastic Beanstalk environment has a load balancer attached to it or not. We can use the boto3 library for this. Here is the code snippet for it:
import boto3

# Create an Elastic Beanstalk client
eb_client = boto3.client('elasticbeanstalk')

# Get the environment details
environment_name = 'your-environment-name'
environment = eb_client.describe_environments(EnvironmentNames=[environment_name])['Environments'][0]

# Get the load balancer name
load_balancer_name = environment['LoadBalancers'][0]['Name']

# Check if access logging is enabled for the load balancer
elb_client = boto3.client('elbv2')
response = elb_client.describe_load_balancers(Names=[load_balancer_name])
if response['LoadBalancers'][0]['AccessLogs']['Enabled']:
    print("Access logging is already enabled for the load balancer")
else:
    print("Access logging is not enabled for the load balancer")
  1. If access logging is not enabled for the load balancer, we can enable it by using the modify_load_balancer_attributes method of the elbv2 client. Here is the code snippet for it:
# Enable access logging for the load balancer
response = elb_client.modify_load_balancer_attributes(
    LoadBalancerArn=response['LoadBalancers'][0]['LoadBalancerArn'],
    Attributes=[
        {
            'Key': 'access_logs.s3.enabled',
            'Value': 'true'
        },
        {
            'Key': 'access_logs.s3.bucket',
            'Value': 'your-bucket-name'
        },
        {
            'Key': 'access_logs.s3.prefix',
            'Value': 'your-prefix'
        }
    ]
)
print("Access logging has been enabled for the load balancer")

In the above code snippet, replace your-bucket-name and your-prefix with the S3 bucket name and prefix where you want to store the access logs.

  1. Finally, we need to verify if access logging is enabled for the load balancer. We can use the same code snippet as in step 1 for this.
# Check if access logging is enabled for the load balancer
response = elb_client.describe_load_balancers(Names=[load_balancer_name])
if response['LoadBalancers'][0]['AccessLogs']['Enabled']:
    print("Access logging is now enabled for the load balancer")
else:
    print("Access logging could not be enabled for the load balancer")

By following these steps, we can remediate the misconfiguration "Ensure Access Logging Is Enabled For Elastic Beanstalk Load Balancer" for AWS using Python.

Using Terraform
# S3 bucket to store Elastic Beanstalk load balancer access logs
resource "aws_s3_bucket" "beanstalk_lb_access_logs" {
  bucket = "LOGS_BUCKET_NAME" # replace with a globally unique bucket name
}

# Optional: restrict ownership / public access as appropriate for your org
resource "aws_s3_bucket_public_access_block" "beanstalk_lb_access_logs" {
  bucket = aws_s3_bucket.beanstalk_lb_access_logs.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# Allow ELB/ALB log delivery to write into the bucket
resource "aws_s3_bucket_policy" "beanstalk_lb_access_logs" {
  bucket = aws_s3_bucket.beanstalk_lb_access_logs.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "AWSLogDeliveryWrite"
        Effect    = "Allow"
        Principal = {
          Service = "logdelivery.elasticloadbalancing.amazonaws.com"
        }
        Action = [
          "s3:PutObject",
          "s3:AbortMultipartUpload"
        ]
        Resource = "${aws_s3_bucket.beanstalk_lb_access_logs.arn}/*"
      },
      {
        Sid       = "AWSLogDeliveryAclCheck"
        Effect    = "Allow"
        Principal = {
          Service = "logdelivery.elasticloadbalancing.amazonaws.com"
        }
        Action   = "s3:GetBucketAcl"
        Resource = aws_s3_bucket.beanstalk_lb_access_logs.arn
      }
    ]
  })
}

# ---------------------------------------------------------------------------
# Elastic Beanstalk environment using a Classic Load Balancer (CLB)
# This change causes an environment update and may briefly interrupt service.
# ---------------------------------------------------------------------------
resource "aws_elastic_beanstalk_environment" "example_clb" {
  name                = "BEANSTALK_ENV_NAME_CLB"   # replace with your environment name
  application         = "BEANSTALK_APP_NAME"       # replace with your EB application name
  solution_stack_name = "SOLUTION_STACK_NAME"      # e.g., "64bit Amazon Linux 2 v3.6.1 running Python 3.9"

  # ...other required settings...

  setting {
    namespace = "aws:elb:accesslogs"
    name      = "Enabled"
    value     = "true"
  }

  setting {
    namespace = "aws:elb:accesslogs"
    name      = "AccessLogsS3Bucket"
    value     = aws_s3_bucket.beanstalk_lb_access_logs.bucket
  }
}

# ---------------------------------------------------------------------------
# Elastic Beanstalk environment using an Application or Network Load Balancer
# (ALB/NLB). This also triggers an environment update and brief interruption.
# ---------------------------------------------------------------------------
resource "aws_elastic_beanstalk_environment" "example_alb" {
  name                = "BEANSTALK_ENV_NAME_ALB"   # replace with your environment name
  application         = "BEANSTALK_APP_NAME"       # replace with your EB application name
  solution_stack_name = "SOLUTION_STACK_NAME"      # e.g., "64bit Amazon Linux 2 v3.6.1 running Python 3.9"

  # ...other required settings...

  setting {
    namespace = "aws:elbv2:loadbalancer"
    name      = "AccessLogsS3Enabled"
    value     = "true"
  }

  setting {
    namespace = "aws:elbv2:loadbalancer"
    name      = "AccessLogsS3Bucket"
    value     = aws_s3_bucket.beanstalk_lb_access_logs.bucket
  }
}

terraform plan should show creation of the S3 bucket (and its policy) and an in-place update to the aws_elastic_beanstalk_environment resource(s) adding/modifying the setting blocks for access logging, with no resource replacements.

Additional Reading:​