ELBs Should Have Cross Zone Enabled

More Info:

For higher availability and reliability, ELBs should work with cross zone nodes.

Risk Level

Low

Address

Reliability, Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• GDPR
• HITRUST CSF
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST
• NIST CSF
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• Reserve Bank of India (RBI) Master Direction – Information Technology Framework
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate the ELBs should have cross-zone enabled misconfiguration for AWS using the AWS Console:

1. Open the AWS Management Console and navigate to the EC2 Dashboard.

2. From the left-hand menu, select "Load Balancers".

3. Select the ELB that you want to remediate.

4. Click on the "Attributes" tab.

5. Scroll down to the "Cross-Zone Load Balancing" section and click on the "Edit" button.

6. Select "Yes" for the "Enable Cross-Zone Load Balancing" option.

7. Click on the "Save" button to save the changes.

That's it! You have now successfully remediated the ELBs should have cross-zone enabled misconfiguration for AWS using the AWS Console.

Using CLI

To remediate the misconfiguration "ELBs should have cross-zone enabled" in AWS using AWS CLI, follow these steps:

1. Open the AWS CLI on your local machine.

2. Run the following command to enable cross-zone load balancing for all existing ELBs in the current region:

aws elb modify-load-balancer-attributes --load-balancer-name <ELB_NAME> --load-balancer-attributes "{\"CrossZoneLoadBalancing\":{\"Enabled\":true}}"

Replace <ELB_NAME> with the name of the ELB that needs to be remediated.

3. Run the following command to enable cross-zone load balancing for all new ELBs created in the current region:

aws elb create-lb-cookie-stickiness-policy --load-balancer-name <ELB_NAME> --policy-name "cross-zone-policy" --cookie-expiration-period 60

Replace <ELB_NAME> with the name of the ELB that needs to be remediated.

4. Verify that cross-zone load balancing is enabled for the ELB by running the following command:

aws elb describe-load-balancer-attributes --load-balancer-name <ELB_NAME> --query 'LoadBalancerAttributes.CrossZoneLoadBalancing.Enabled'

Replace <ELB_NAME> with the name of the ELB that was remediated.

5. Repeat these steps for all ELBs in the current region that require remediation.

Using Python

To remediate the misconfiguration of ELBs not having cross-zone enabled in AWS using Python, you can follow the below steps:

1. Import the necessary libraries:

import boto3

2. Create an AWS client for Elastic Load Balancing:

elb_client = boto3.client('elbv2')

3. Get the list of all the ELBs:

elbs = elb_client.describe_load_balancers()

4. Loop through each ELB and check if cross-zone load balancing is enabled. If not, enable it:

for elb in elbs['LoadBalancers']:
    elb_arn = elb['LoadBalancerArn']
    elb_attributes = elb_client.describe_load_balancer_attributes(LoadBalancerArn=elb_arn)
    if not elb_attributes['Attributes'][0]['Value']:
        elb_client.modify_load_balancer_attributes(
            LoadBalancerArn=elb_arn,
            Attributes=[
                {
                    'Key': 'load_balancing.cross_zone.enabled',
                    'Value': 'true'
                }
            ]
        )

5. Verify that cross-zone load balancing is enabled for all the ELBs:

for elb in elbs['LoadBalancers']:
    elb_arn = elb['LoadBalancerArn']
    elb_attributes = elb_client.describe_load_balancer_attributes(LoadBalancerArn=elb_arn)
    if not elb_attributes['Attributes'][0]['Value']:
        print(f"{elb['LoadBalancerName']} - Cross-Zone Load Balancing is not Enabled")
    else:
        print(f"{elb['LoadBalancerName']} - Cross-Zone Load Balancing is Enabled")

By following these steps, you can remediate the misconfiguration of ELBs not having cross-zone enabled in AWS using Python.

Using Terraform

# Classic Load Balancer: enable cross-zone load balancing
resource "aws_elb" "EXAMPLE_CLASSIC_ELB" {
  name               = "REPLACE_WITH_ELB_NAME"
  subnets            = [REPLACE_WITH_SUBNET_IDS]      # e.g. ["subnet-12345678", "subnet-abcdef01"]
  security_groups    = [REPLACE_WITH_SG_IDS]          # e.g. ["sg-12345678"]
  availability_zones = [REPLACE_WITH_AZS]             # e.g. ["us-east-1a", "us-east-1b"]

  # This matches:
  # aws elb modify-load-balancer-attributes ... --load-balancer-attributes '{"CrossZoneLoadBalancing": {"Enabled": true}}'
  cross_zone_load_balancing = true

  listener {
    lb_port           = 80
    lb_protocol       = "HTTP"
    instance_port     = 80
    instance_protocol = "HTTP"
  }

  # add other required arguments as in your existing resource
}

# Network Load Balancer: enable cross-zone load balancing
resource "aws_lb" "EXAMPLE_NLB" {
  name               = "REPLACE_WITH_NLB_NAME"
  internal           = false
  load_balancer_type = "network"
  subnets            = [REPLACE_WITH_SUBNET_IDS]      # e.g. ["subnet-12345678", "subnet-abcdef01"]

  # This matches:
  # aws elbv2 modify-load-balancer-attributes ... Key=load_balancing.cross_zone.enabled,Value=true
  enable_cross_zone_load_balancing = true

  # add other required arguments as in your existing resource
}

# Note: For Application Load Balancers (load_balancer_type = "application"),
# cross-zone load balancing is always enabled and cannot be modified; there is
# no Terraform argument to change it.

This change does not force resource replacement; Terraform will show in terraform plan an in-place update with cross_zone_load_balancing or enable_cross_zone_load_balancing changing from false (or null) to true.

Additional Reading:

• https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-subnets.html