Ensure Persistent Logs Are Enabled For Elastic Beanstalk Environments
More Info:
Ensure that AWS Elastic Beanstalk (EB) environment logs are retained and uploaded to Amazon S3 in order to keep the logging data for future audits, historical purposes or to track and analyze the EB application environment behavior for a long period of time.Risk Level
MediumAddress
Operational Maturity, ReliabilityCompliance Standards
HIPAA, PCIDSS, GDPR, SOC2Triage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Ensure Persistent Logs Are Enabled For Elastic Beanstalk Environments” for AWS using AWS console, you can follow the below steps:
- Login to the AWS Management Console.
- Navigate to the Elastic Beanstalk service.
- Select the Elastic Beanstalk environment for which you want to enable persistent logs.
- Click on the “Configuration” option from the left-hand menu.
- Scroll down to the “Software” section and click on the “Edit” button.
- Scroll down to the “Instance log streaming” section and click on the “Edit” button.
- Select the “Enable log file rotation” checkbox to enable persistent logs for the Elastic Beanstalk environment.
- Set the “Retention” value to the desired number of days for which you want to retain the logs.
- Click on the “Apply” button to save the changes.
- Wait for a few minutes for the changes to take effect.
Using CLI
Using CLI
To enable persistent logs for Elastic Beanstalk environments in AWS using AWS CLI, follow these steps:Note: Replace Note: Replace
- Open the AWS CLI and run the following command to enable Elastic Beanstalk logging:
<environment-name> with the actual name of the Elastic Beanstalk environment.- Next, run the following command to enable log rotation for the environment:
- Finally, run the following command to configure the log retention period (in days):
<number-of-days> with the desired number of days for log retention.After following these steps, persistent logs will be enabled for the Elastic Beanstalk environment in AWS.Using Python
Using Python
To remediate the misconfiguration of ensuring persistent logs are enabled for Elastic Beanstalk environments in AWS using Python, you can follow the below steps:This script will loop through all the Elastic Beanstalk environments in your AWS account and enable persistent logs for any environment where it is not already enabled.
- Import the required libraries:
- Create an AWS Elastic Beanstalk client object:
- Get a list of Elastic Beanstalk environments:
- Loop through the list of environments and check if persistent logs are enabled. If not, update the environment to enable persistent logs: