ALB Should Have Logging Enabled

Using Console

Sign in to the AWS Management Console and open the Amazon EC2 dashboard at https://console.aws.amazon.com/ec2/.
In the navigation pane, under LOAD BALANCING, choose Load Balancers.
Select the load balancer that you want to enable logging for.
Open the Description tab, under Attributes section, choose Edit attributes.
In the Access logs section, do the following:
- Select Enable access logs.
- In the S3 location field, type the name of your S3 bucket where you want to store the logs. You can also specify a prefix. For example, if you type my-loadbalancer-logs/my-app, the access logs are stored in the my-app folder of the my-loadbalancer-logs bucket.
- If the bucket doesn’t exist, you can create it. Make sure that the bucket policy grants Amazon S3 write permissions to Elastic Load Balancing.
Choose Save.

Please note, the bucket must be in the same region as the load balancer. The bucket policy must grant write permissions to Elastic Load Balancing. If you don’t have a bucket for storing the logs, you can create one.

Using CLI

Sure, here are the steps to remediate this misconfiguration:

Identify the Load Balancer: First, you need to identify the load balancer for which you want to enable logging. You can do this by running the following command:

aws elbv2 describe-load-balancers --region your-region-name

This command will list all the load balancers in the specified region. Identify the ARN of the load balancer you want to enable logging for.

Create a S3 Bucket: ALB logs are stored in an S3 bucket. If you don’t have an existing bucket to store the logs, create a new one using the following command:

aws s3api create-bucket --bucket your-bucket-name --region your-region-name

Remember to replace ‘your-bucket-name’ with your preferred bucket name and ‘your-region-name’ with the region where you want to create the bucket.

Set Bucket Policy: Next, set a bucket policy that grants the Elastic Load Balancing service principal (elasticloadbalancing.amazonaws.com) permission to write logs to your bucket. You can do this by creating a JSON file with the following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PublicReadGetObject",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::your-bucket-name/*"
            ]
        }
    ]
}

Replace ‘your-bucket-name’ with the name of your S3 bucket. Save this file as ‘bucket-policy.json’ and run the following command to apply this policy to your bucket:

aws s3api put-bucket-policy --bucket your-bucket-name --policy file://bucket-policy.json

Enable Logging for Load Balancer: Finally, you can enable logging for your load balancer using the following command:

aws elbv2 modify-load-balancer-attributes --load-balancer-arn your-load-balancer-arn --attributes Key=access_logs.s3.enabled,Value=true Key=access_logs.s3.bucket,Value=your-bucket-name

Replace ‘your-load-balancer-arn’ with the ARN of your load balancer and ‘your-bucket-name’ with the name of your S3 bucket.

Verify Logging is Enabled: You can verify that logging is enabled by describing the attributes of the load balancer using the following command:

aws elbv2 describe-load-balancer-attributes --load-balancer-arn your-load-balancer-arn

In the output, you should see that ‘access_logs.s3.enabled’ is set to ‘true’ and ‘access_logs.s3.bucket’ is set to the name of your S3 bucket.

Using Python

To remediate this misconfiguration, you will need to use AWS SDK for Python (Boto3) to enable access logs for your Application Load Balancer (ALB). Here are the step by step instructions:

Install AWS SDK for Python (Boto3): If you haven’t installed Boto3, you can install it using pip:
pip install boto3
Configure AWS Credentials: Boto3 needs your AWS credentials (access key and secret key) to interact with AWS services. You can configure it in several ways. The simplest way is using the AWS CLI:
aws configure
It will ask for the Access Key ID, Secret Access Key, Default region name, and Default output format. You can find these details from your AWS account.

Create a Python Script: Now, you can write a Python script to enable access logs for your ALB. Here is a simple example:

import boto3

def enable_alb_logging(alb_name, s3_bucket_name, s3_prefix):
    client = boto3.client('elbv2')

    response = client.modify_load_balancer_attributes(
        LoadBalancerArn=alb_name,
        Attributes=[
            {
                'Key': 'access_logs.s3.enabled',
                'Value': 'true'
            },
            {
                'Key': 'access_logs.s3.bucket',
                'Value': s3_bucket_name
            },
            {
                'Key': 'access_logs.s3.prefix',
                'Value': s3_prefix
            }
        ]
    )

    print(response)

enable_alb_logging('my-load-balancer-arn', 'my-s3-bucket', 'my-log-prefix')

Replace 'my-load-balancer-arn', 'my-s3-bucket', and 'my-log-prefix' with your actual Load Balancer ARN, S3 bucket name, and prefix respectively.

Run the Python Script: You can run the Python script using Python command:
python enable_alb_logging.py

This script will enable access logs for your ALB and store the logs in the specified S3 bucket. Make sure that the S3 bucket has the right permissions to store access logs.

Using Terraform

resource "aws_lb" "alb" {
  name               = "ALB_NAME"                # replace with your ALB name
  internal           = false
  load_balancer_type = "application"
  subnets            = [SUBNET_ID_1, SUBNET_ID_2] # replace with your subnet IDs

  # Enable ALB access logging to an existing S3 bucket in the same region
  access_logs {
    enabled = true
    bucket  = "LOG_BUCKET_NAME"    # replace with the name of an existing S3 bucket for ALB logs
    prefix  = "LOG_PREFIX"         # optional: replace or remove if you don't want a prefix
  }
}

This updates the ALB in place (no replacement) to set access_logs.s3.enabled=true, access_logs.s3.bucket=<your-s3-bucket-for-logs>, and optionally access_logs.s3.prefix=<your-log-prefix>; ensure the S3 bucket already exists in the same region and has a bucket policy granting Elastic Load Balancing permission to write logs, as per the AWS documentation.Verification: terraform plan should show an in-place update to aws_lb.alb, adding/modifying only the access_logs block with enabled = true, the specified bucket, and (if set) prefix.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

ALB Should Have Logging Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​Additional Reading: