All checks
Medium
Application and Classic Load Balancers logging should be enabled
Confirms that Application and Classic Load Balancers write access logs to S3, recording each request's time, client IP address, path and response for audit and troubleshooting. The Terraform and CLI routes are for an Application Load Balancer; a Classic one takes the same settings in aws_elb's access_logs block or aws elb modify-load-balancer-attributes.
- service
- ELB
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
EC2 → Load balancers → the load balancer → Attributes → Monitoring
- Access logs
- On
- S3 URI
- s3:// URI of an SSE-S3 bucket in this Region whose policy lets Elastic Load Balancing write to it
With the AWS CLI
aws elbv2 modify-load-balancer-attributes --load-balancer-arn <load-balancer-arn> --attributes Key=access_logs.s3.enabled,Value=true Key=access_logs.s3.bucket,Value=<bucket-name> --region <region>With Terraform
resource "aws_lb" "this" {
subnets = var.subnet_ids
access_logs {
bucket = var.access_log_bucket
enabled = true
}
}See which of your accounts this check is failing on.
Book a live scan