> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Internet facing elb remediation ### Triage and Remediation ### Remediation The following are the step by step instructions to remediate the misconfiguration "Internet Facing ELBs Should Be Regularly Reviewed" in AWS using the AWS console: 1. Log in to the AWS Management Console. 2. Navigate to the EC2 service. 3. Click on the "Load Balancers" option in the left-hand menu. 4. Select the Internet-facing ELB that needs to be reviewed. 5. Click on the "Listeners" tab. 6. Review the protocol and port configuration for each listener. Ensure that they are configured according to your organization's security policies. 7. Click on the "Security" tab. 8. Review the security groups associated with the ELB. Ensure that only necessary ports are open and that the source IP ranges are restricted to only authorized IPs. 9. Click on the "Instances" tab. 10. Review the instances associated with the ELB. Ensure that they are running the latest security patches and that they are not exposing any unnecessary services. 11. Click on the "Health Check" tab. 12. Review the health check configuration. Ensure that it is configured according to your organization's security policies. 13. Click on the "Attributes" tab. 14. Review the attributes associated with the ELB. Ensure that they are configured according to your organization's security policies. 15. Make any necessary changes to the ELB configuration. 16. Click on the "Save" button to save the changes. By following the above steps, the misconfiguration "Internet Facing ELBs Should Be Regularly Reviewed" can be remediated in AWS using the AWS console. # To remediate the misconfiguration for AWS using AWS CLI, follow these steps: 1. Open the AWS CLI and run the following command to list all the internet-facing Elastic Load Balancers (ELBs) in your account: ``` aws elbv2 describe-load-balancers --query "LoadBalancers[?Scheme=='internet-facing'].LoadBalancerArn" --output text ``` 2. Review the output and identify any ELBs that are no longer needed or should not be internet-facing. 3. For each internet-facing ELB that needs to be reviewed, run the following command to modify the scheme to internal: ``` aws elbv2 modify-load-balancer-attributes --load-balancer-arn --attributes Key=scheme,Value=internal ``` Replace `` with the ARN of the ELB that needs to be modified. 4. Verify that the ELB's scheme has been changed to internal by running the following command: ``` aws elbv2 describe-load-balancers --load-balancer-arns --query "LoadBalancers[0].Scheme" --output text ``` Replace `` with the ARN of the ELB that was modified. 5. Repeat steps 3-4 for each internet-facing ELB that needs to be reviewed. 6. Once all internet-facing ELBs have been reviewed and modified, run the first command again to verify that all internet-facing ELBs have been remediated. To remediate the misconfiguration of Internet Facing ELBs in AWS, you can use the following Python script: ``` import boto3 # Create a boto3 client for ELB elb_client = boto3.client('elbv2') # Define the ELB ARN elb_arn = 'arn:aws:elasticloadbalancing:us-west-2:123456789012:loadbalancer/app/my-load-balancer/50dc6c495c0c9188' # Set the desired security group ID security_group_id = 'sg-1234567890abcdef' # Update the ELB security group response = elb_client.set_security_groups( LoadBalancerArn=elb_arn, SecurityGroups=[ security_group_id, ] ) # Print the response print(response) ``` This script uses the boto3 library to create a client for Elastic Load Balancing (ELB) in AWS. It then sets the desired security group ID for the specified ELB ARN using the `set_security_groups` function. Finally, it prints the response from the API call. To use this script, replace the `elb_arn` and `security_group_id` values with the appropriate values for your environment. You can then run the script to remediate the misconfiguration of Internet Facing ELBs in AWS. ```hcl theme={null} # Application / Network Load Balancer (ELBv2) – change scheme to internal resource "aws_lb" "THIS_LOAD_BALANCER" { name = "REPLACE_WITH_LB_NAME" internal = true # sets scheme=internal instead of internet-facing load_balancer_type = "application" # or "network" subnets = [AWS_SUBNET_ID_1, AWS_SUBNET_ID_2] security_groups = [AWS_SECURITY_GROUP_ID] # other arguments as required... } ``` ```hcl theme={null} # Classic Load Balancer (ELBv1) – must be recreated as internal resource "aws_elb" "THIS_CLASSIC_LB" { name = "REPLACE_WITH_LB_NAME" subnets = [AWS_SUBNET_ID_1, AWS_SUBNET_ID_2] internal = true # creates an internal Classic Load Balancer listener { instance_port = 80 instance_protocol = "http" lb_port = 80 lb_protocol = "http" } # other arguments as required... } ``` * Substitute: * `THIS_LOAD_BALANCER` / `THIS_CLASSIC_LB` with your Terraform resource names. * `REPLACE_WITH_LB_NAME` with the actual load balancer name. * `AWS_SUBNET_ID_*` with subnet IDs. * `AWS_SECURITY_GROUP_ID` with the security group ID for ALB/NLB. Changing `internal` from `false` (internet-facing) to `true` forces replacement of the load balancer for both `aws_lb` and `aws_elb`, causing downtime while the old load balancer is destroyed and the new internal one is created. This matches the CLI remediation, which changes the scheme to `internal` and makes the load balancer inaccessible from the internet. Verification: `terraform plan` should show the existing load balancer resource being destroyed and a new one created with `internal = true` (scheme `internal`) and no other unexpected changes.