Skip to main content

More Info:

You should not have unused Elastic Load Balancers in your AWS account. Unused ELBs should be deleted to help lower the cost of your monthly AWS bill.

Risk Level

Low

Address

Cost Optimisation

Compliance Standards

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • HITRUST CSF
  • ISO/IEC 27017
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration of having no unused ELBs present in AWS, you can follow the below steps:
  1. Sign in to the AWS Management Console.
  2. Go to the EC2 dashboard.
  3. Click on “Load Balancers” from the left-hand menu.
  4. Identify any unused ELBs that are present in the list.
  5. Select the unused ELB and click on “Actions” and then “Delete”.
  6. Confirm the deletion by clicking on “Yes, Delete”.
  7. Repeat the above steps for all unused ELBs that are present.
By following these steps, you will be able to remediate the misconfiguration of having no unused ELBs present in AWS.

To remediate the misconfiguration of having unused ELBs in AWS, you can follow the below steps using AWS CLI:
  1. List all the ELBs in the AWS account using the following command:
  1. Identify the ELBs that are not being used and note down their names.
  2. Delete the unused ELBs using the following command:
  1. Repeat step 3 for all the unused ELBs that you identified in step 2.
  2. Verify that all the unused ELBs have been deleted using the following command:
This should remediate the misconfiguration of having unused ELBs in AWS.
To remediate the misconfiguration “No Unused ELBs Should Be Present” in AWS using Python, you can follow the below steps:
  1. Import the required AWS SDK modules using the boto3 library in Python.
  2. Use the describe_load_balancers() method to list all the load balancers available in your AWS account.
  3. Use the describe_instance_health() method to check the instances associated with each load balancer and their health status.
  4. Identify the unused load balancers by checking if there are any instances associated with them.
  5. Use the delete_load_balancer() method to delete the unused load balancers.
Here’s the sample Python code to remediate the misconfiguration “No Unused ELBs Should Be Present” in AWS:
Note: Before running the script, make sure that you have configured the AWS credentials in your environment.
To actually perform the CLI-equivalent remediation in Terraform, you must delete the entire aws_lb.UNUSED_LB or aws_elb.UNUSED_CLASSIC_ELB resource block(s) from your configuration once you have verified via CloudWatch that the load balancer is truly unused.This is destructive and cannot be undone: on the next terraform apply, terraform plan should show these load balancers with -/+ or - indicating they are marked for destruction (i.e., Plan: 0 to add, 0 to change, 2 to destroy or similar, depending on how many you removed).

Additional Reading: