Skip to main content

More Info:

This rule checks if a Classic Load Balancer spans multiple Availability Zones (AZs). The rule is NON_COMPLIANT if a Classic Load Balancer spans less than 2 AZs or does not span number of AZs mentioned in the minAvailabilityZones parameter (if provided).

Risk Level

Low

Address

Availability

Compliance Standards

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • HITRUST CSF
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

To remediate the issue of Classic Load Balancer having multiple Availability Zones in AWS, you can follow these steps using the AWS Management Console:
  1. Login to AWS Console: Go to https://aws.amazon.com/ and login to your AWS account using your credentials.
  2. Navigate to EC2 Dashboard: Once logged in, navigate to the EC2 Dashboard by clicking on the “Services” dropdown menu at the top of the page and selecting “EC2” under the Compute section.
  3. Select Load Balancers: In the EC2 Dashboard, under the “Load Balancing” section in the navigation pane on the left, click on “Load Balancers”.
  4. Identify the Classic Load Balancer: Find the Classic Load Balancer that is configured with multiple Availability Zones.
  5. Edit Load Balancer: Select the Classic Load Balancer by clicking on its name, and then click on the “Listeners” tab.
  6. Edit Listener Configuration: In the Listeners tab, click on the “Edit” button to edit the listener configuration.
  7. Edit Availability Zones: In the Edit Listener Configuration window, you will see the option to select the Availability Zones for the load balancer. Deselect the additional Availability Zones that you want to remove from the configuration.
  8. Save Changes: After deselecting the additional Availability Zones, click on the “Save” button to apply the changes.
  9. Verify Configuration: Once the changes are saved, verify that the Classic Load Balancer is now configured to use only the desired Availability Zones.
By following these steps, you can remediate the issue of a Classic Load Balancer having multiple Availability Zones in AWS using the AWS Management Console.

To remediate the misconfiguration of having a Classic Load Balancer with multiple Availability Zones in AWS using AWS CLI, you can follow these steps:
  1. List the Availability Zones associated with the Classic Load Balancer:
  1. Identify the extra/unwanted Availability Zones that need to be removed from the Classic Load Balancer configuration.
  2. Deregister the instances from the extra/unwanted Availability Zones:
  1. Disable the extra/unwanted Availability Zones from the Classic Load Balancer:
  1. Verify the updated configuration of the Classic Load Balancer to ensure that it is now configured with the desired number of Availability Zones:
By following these steps, you can successfully remediate the misconfiguration of having a Classic Load Balancer with multiple Availability Zones in AWS using AWS CLI.
To remediate the misconfiguration of having a Classic Load Balancer with multiple availability zones in AWS using Python, you can follow these steps:
  1. Identify the Load Balancer: First, you need to identify the Classic Load Balancer that is configured with multiple availability zones.
  2. Update Load Balancer Configuration: You will need to update the Load Balancer configuration to ensure that it is only associated with a single availability zone.
  3. Use Boto3 Library: Boto3 is the AWS SDK for Python, which allows you to interact with AWS services using Python. You can use Boto3 to make API calls to AWS Elastic Load Balancer service.
  4. Install Boto3: If you haven’t already installed Boto3, you can do so using pip:
  5. Write Python Script: Here is an example Python script that uses Boto3 to update the availability zones for a Classic Load Balancer:
  6. Run the Script: Save the script in a file, for example, update_elb_availability_zones.py, and run it using Python:
  7. Verify Configuration: After running the script, verify that the Classic Load Balancer is now associated with only the specified availability zone.
By following these steps and running the Python script, you can remediate the misconfiguration of having a Classic Load Balancer with multiple availability zones in AWS.
Substitute:
  • CLASSIC_LB_VPC / CLASSIC_LB_EC2_CLASSIC with your Terraform resource names.
  • CLASSIC_LB_NAME with the existing Classic Load Balancer name.
  • EXISTING_SUBNET_ID_* with the current subnet IDs shown by aws elb describe-load-balancers.
  • NEW_SUBNET_ID_IN_NEW_AZ with a subnet in the same VPC, in an Availability Zone not already used, and with sufficient free IPs.
  • EXISTING_AZ_* with current availability zones.
  • NEW_AVAILABILITY_ZONE with an additional AZ in the same region that is not already enabled.
  • SECURITY_GROUP_ID with appropriate security group IDs.
This change updates the load balancer in place; it does not force resource replacement, but traffic patterns may shift as new AZs/subnets become active.terraform plan should show:
  • For the VPC ELB: an in-place update on aws_elb.CLASSIC_LB_VPC with subnets gaining NEW_SUBNET_ID_IN_NEW_AZ.
  • For the EC2-Classic ELB: an in-place update on aws_elb.CLASSIC_LB_EC2_CLASSIC with availability_zones gaining NEW_AVAILABILITY_ZONE.

Additional Reading: