Skip to main content

ELB Security Layer Should Have At Least One Valid Security

More Info:​

Check Elastic Load Balancer (ELB) security layer for at least one valid security group that restrict access only to the ports defined in the load balancer listeners configuration.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Sure, here are the step-by-step instructions to remediate the ELB Security Layer misconfiguration in AWS:

  1. Open the AWS Management Console and navigate to the EC2 dashboard.

  2. Click on the "Load Balancers" link in the left-hand menu.

  3. Select the ELB that is experiencing the misconfiguration.

  4. In the "Description" tab, click on "Edit security groups" in the "Security" section.

  5. In the "Configure Security Group" dialog box, select the security group that you want to add to the ELB.

  6. Click on the "Add" button to add the selected security group to the ELB.

  7. Click on the "Save" button to save the changes.

  8. Verify the changes by navigating to the "Instances" tab and checking that the ELB now has at least one valid security group associated with it.

That's it! You have successfully remediated the ELB Security Layer misconfiguration in AWS using the AWS console.

Using CLI

To remediate the ELB Security Layer misconfiguration in AWS using AWS CLI, follow these steps:

  1. Identify the name of the ELB that is not associated with a valid security group. You can do this by running the following command:
aws elb describe-load-balancers --query 'LoadBalancerDescriptions[?not_null(SecurityGroups)][].{Name:LoadBalancerName, SecurityGroups:SecurityGroups}'
  1. Once you have identified the name of the ELB, you need to create a new security group or use an existing one that is associated with the ELB. To create a new security group, run the following command:
aws ec2 create-security-group --group-name <security-group-name> --description "ELB Security Group"
  1. Once the security group is created, you need to add a rule to allow incoming traffic on the required ports. For example, to allow incoming traffic on port 80, run the following command:
aws ec2 authorize-security-group-ingress --group-name <security-group-name> --protocol tcp --port 80 --cidr 0.0.0.0/0
  1. Finally, you need to associate the security group with the ELB. To do this, run the following command:
aws elb apply-security-groups-to-load-balancer --load-balancer-name <elb-name> --security-groups <security-group-id>
  1. Verify that the ELB is now associated with a valid security group by running the following command:
aws elb describe-load-balancers --load-balancer-name <elb-name> --query 'LoadBalancerDescriptions[].SecurityGroups'

Once these steps are completed, the ELB Security Layer misconfiguration should be remediated.

Using Python

To remediate the ELB Security Layer misconfiguration in AWS using Python, you can follow the below steps:

  1. Import the necessary AWS SDK libraries using pip install:
pip install boto3
  1. Create an AWS session using your access key and secret access key:
import boto3

session = boto3.session.Session(
    aws_access_key_id='your_access_key',
    aws_secret_access_key='your_secret_key',
    region_name='your_region'
)
  1. Get a list of all the ELBs in your AWS account:
elb_client = session.client('elbv2')

elbs = elb_client.describe_load_balancers()
  1. For each ELB, check if it has at least one valid security group:
for elb in elbs['LoadBalancers']:
    elb_arn = elb['LoadBalancerArn']
    elb_sg = elb_client.describe_load_balancer_attributes(
        LoadBalancerArn=elb_arn
    )['Attributes'][0]['Value']
    
    if elb_sg == '':
        # If there is no security group attached to the ELB, attach a valid security group
        elb_client.modify_load_balancer_attributes(
            LoadBalancerArn=elb_arn,
            Attributes=[
                {
                    'Key': 'security_groups',
                    'Value': 'valid_security_group_id'
                }
            ]
        )

  1. Replace valid_security_group_id with the ID of a valid security group in your AWS account.

  2. Save the Python script and run it to remediate the ELB Security Layer misconfiguration in your AWS account.

Using Terraform
resource "aws_elb" "classic_lb" {
  name               = "CLASSIC_LB_NAME" # replace with your ELB name
  subnets            = [AWS_SUBNET_ID_1, AWS_SUBNET_ID_2] # replace with your subnet IDs
  cross_zone_load_balancing = true

  listener {
    instance_port     = 80
    instance_protocol = "HTTP"
    lb_port           = 80
    lb_protocol       = "HTTP"
  }

  # This list must contain the full, final set of security groups you want
  # associated with the Classic Load Balancer; Terraform will replace the
  # existing list with this one, matching the CLI `apply-security-groups-to-load-balancer`.
  security_groups = [
    aws_security_group.lb_sg.id,
    "sg-EXISTING_SG_ID_1", # include any other existing/desired SG IDs
    "sg-EXISTING_SG_ID_2",
  ]
}

resource "aws_security_group" "lb_sg" {
  name        = "LB_SG_NAME"          # replace with your SG name
  description = "Security group for Classic ELB listeners"
  vpc_id      = AWS_VPC_ID            # replace with your VPC ID

  # Restrict inbound access to the ELB listener port(s) only
  ingress {
    from_port   = 80                  # must match lb_port in the ELB listener
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["ALLOWED_CIDR"]    # replace with the required source CIDR(s)
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "LB_SG_TAG_NAME"           # replace as needed
  }
}

The security_groups argument on aws_elb.classic_lb replaces the entire set of security groups on the load balancer (non-additive), just like aws elb apply-security-groups-to-load-balancer. This does not force replacement of the ELB; Terraform will show an in-place update where the security_groups attribute changes to the new list. Running terraform plan should show ~ security_groups on aws_elb.classic_lb (and + creation for aws_security_group.lb_sg if it is new).

Additional Reading:​