Minimum Number of EC2 Instances Should Be Configured For

More Info:

Minimum number of instances should be configured for your Load Balancer to improve the reliability.

Risk Level

Low

Address

Reliability

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of having a minimum number of EC2 instances not configured for ELBs in AWS, follow these steps:

1. Log in to the AWS Management Console.
2. Navigate to the EC2 dashboard.
3. Select the Load Balancers option from the navigation pane on the left-hand side.
4. Select the Load Balancer that you want to remediate.
5. Click on the Edit button in the Basic Configuration section.
6. In the Minimum Healthy Targets section, specify the minimum number of instances that should be registered with the Load Balancer.
7. Click on the Save button to save the changes.

Once the changes are saved, the Load Balancer will ensure that the specified minimum number of instances are always registered with it. This will help ensure that the application running on the instances is always available to users.

Using CLI

The misconfiguration "Minimum Number of EC2 Instances Should Be Configured For ELBs" means that the Elastic Load Balancer (ELB) is not configured with a minimum number of instances that it should maintain. This can lead to a situation where there are no instances available to handle the traffic, resulting in downtime.

Here are the steps to remediate this misconfiguration in AWS using AWS CLI:

1. Log in to the AWS Management Console.

2. Open the AWS CLI on your local machine.

3. Run the following command to describe the current ELB settings:

   aws elb describe-load-balancers --load-balancer-name <load-balancer-name>

   Replace <load-balancer-name> with the name of the ELB that you want to configure.

4. Look for the MinSize parameter in the output. If it is not set, or if it is set to 0, then this is the cause of the misconfiguration.

5. To remediate this, run the following command to set the minimum size to 1:

   aws autoscaling update-auto-scaling-group --auto-scaling-group-name <auto-scaling-group-name> --min-size 1

   Replace <auto-scaling-group-name> with the name of the Auto Scaling Group associated with the ELB.

6. Verify that the MinSize parameter has been set to 1 by running the describe-load-balancers command again.

   aws elb describe-load-balancers --load-balancer-name <load-balancer-name>

   If the MinSize parameter is now set to 1, then the misconfiguration has been remediated.

Note: If there is no Auto Scaling Group associated with the ELB, you will need to create one and associate it with the ELB.

Using Python

The misconfiguration can be remediated by setting the minimum number of instances for the Elastic Load Balancer (ELB) in AWS. Here are the step-by-step instructions to remediate this misconfiguration using Python:

1. Install the AWS SDK for Python (boto3) using pip.

pip install boto3

2. Create a boto3 client for ELB.

import boto3

elb_client = boto3.client('elbv2')

3. Get the list of all load balancers.

response = elb_client.describe_load_balancers()

4. Iterate through the list of load balancers and get the ARN of each load balancer.

for lb in response['LoadBalancers']:
    lb_arn = lb['LoadBalancerArn']

5. Get the current minimum number of instances for each load balancer.

response = elb_client.describe_target_group_attributes(
    TargetGroupArn=target_group_arn,
    Attributes=[
        {
            'Key': 'deregistration_delay.timeout_seconds',
        },
        {
            'Key': 'proxy_protocol_v2.enabled',
        },
        {
            'Key': 'stickiness.enabled',
        },
        {
            'Key': 'stickiness.type',
        },
        {
            'Key': 'stickiness.lb_cookie.duration_seconds',
        },
        {
            'Key': 'load_balancing.algorithm.type',
        },
        {
            'Key': 'slow_start.duration_seconds',
        },
        {
            'Key': 'stickiness.lb_cookie.enabled',
        },
        {
            'Key': 'target_deregistration_delay.timeout_seconds',
        },
        {
            'Key': 'load_balancing.scheme',
        },
        {
            'Key': 'load_balancing.cross_zone.enabled',
        },
        {
            'Key': 'load_balancing.cross_zone.arns.count',
        },
        {
            'Key': 'load_balancing.cross_zone.arns.values',
        },
        {
            'Key': 'load_balancing.cross_zone.arns',
        },
        {
            'Key': 'load_balancing.cross_zone.target_group_arns',
        },
        {
            'Key': 'load_balancing.cross_zone.target_group_arns.count',
        },
        {
            'Key': 'load_balancing.cross_zone.target_group_arns.values',
        },
        {
            'Key': 'load_balancing.cross_zone.target_group_arns',
        },
        {
            'Key': 'load_balancing.cross_zone',
        },
        {
            'Key': 'proxy_protocol_v2',
        },
        {
            'Key': 'stickiness',
        },
        {
            'Key': 'load_balancing.algorithm',
        },
        {
            'Key': 'slow_start',
        },
        {
            'Key': 'target_deregistration_delay',
        },
        {
            'Key': 'load_balancing',
        },
    ]
)

min_instances = int(response['Attributes'][0]['Value'])

6. Update the minimum number of instances for each load balancer.

response = elb_client.modify_target_group_attributes(
    TargetGroupArn=target_group_arn,
    Attributes=[
        {
            'Key': 'deregistration_delay.timeout_seconds',
            'Value': '300',
        },
    ]
)

7. Verify that the minimum number of instances has been updated.

response = elb_client.describe_target_group_attributes(
    TargetGroupArn=target_group_arn,
    Attributes=[
        {
            'Key': 'deregistration_delay.timeout_seconds',
        },
    ]
)

min_instances = int(response['Attributes'][0]['Value'])
print('Minimum number of instances:', min_instances)

By following these steps, you can remediate the misconfiguration of minimum number of EC2 instances for ELBs in AWS using Python.

Using Terraform

# Classic Load Balancer: ensure at least 2 EC2 instances are registered
resource "aws_elb" "THIS_CLASSIC_ELB" {
  name               = "CLASSIC_ELB_NAME" # replace with your ELB name
  subnets            = [AWS_SUBNET_ID_1, AWS_SUBNET_ID_2] # replace with your subnet IDs
  security_groups    = [AWS_SECURITY_GROUP_ID]            # replace with your SG ID

  # This is the Terraform equivalent of:
  # aws elb register-instances-with-load-balancer --load-balancer-name ... --instances i-...
  instances = [
    AWS_INSTANCE_ID_1, # replace with first EC2 instance ID
    AWS_INSTANCE_ID_2, # replace with second EC2 instance ID
  ]

  listener {
    instance_port     = 80
    instance_protocol = "http"
    lb_port           = 80
    lb_protocol       = "http"
  }
}

# Application/Network Load Balancer: ensure at least 2 EC2 instances are registered in the target group
resource "aws_lb_target_group" "THIS_TG" {
  name     = "TG_FOR_ALB_OR_NLB"   # replace with your TG name
  port     = 80
  protocol = "HTTP"
  vpc_id   = AWS_VPC_ID            # replace with your VPC ID
}

# Terraform equivalent of:
# aws elbv2 register-targets --target-group-arn ... --targets Id=i-...
resource "aws_lb_target_group_attachment" "TG_ATTACHMENT_1" {
  target_group_arn = aws_lb_target_group.THIS_TG.arn
  target_id        = AWS_INSTANCE_ID_1  # replace with first EC2 instance ID
  port             = 80
}

resource "aws_lb_target_group_attachment" "TG_ATTACHMENT_2" {
  target_group_arn = aws_lb_target_group.THIS_TG.arn
  target_id        = AWS_INSTANCE_ID_2  # replace with second EC2 instance ID
  port             = 80
}

Substitute:

• CLASSIC_ELB_NAME with your Classic ELB name.
• AWS_SUBNET_ID_1, AWS_SUBNET_ID_2 with subnet IDs.
• AWS_SECURITY_GROUP_ID with the load balancer security group ID.
• AWS_INSTANCE_ID_1, AWS_INSTANCE_ID_2 with existing EC2 instance IDs.
• AWS_VPC_ID and TG_FOR_ALB_OR_NLB with your VPC ID and target group name.

No resource replacement is forced by adding instances/attachments; Terraform will show + for new aws_lb_target_group_attachment resources and an in‑place ~ update to aws_elb.THIS_CLASSIC_ELB.instances to include the additional instance(s).

Additional Reading:

• https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-backend-instances.html