ELBs Should Have Connection Draining Enabled

Using Console

Sure, here are the step by step instructions to remediate the misconfiguration of ELBs not having Connection Draining enabled in AWS console:

Open the AWS Management Console and navigate to the EC2 Dashboard.
From the left-hand menu, click on the “Load Balancers” option.
Select the ELB that you want to remediate from the list of available load balancers.
Click on the “Attributes” tab from the bottom panel.
Under the “Connection Settings” section, click on the “Edit” button.
In the “Edit Connection Settings” window, check the box next to “Enable Connection Draining”.
Set the “Connection Draining Timeout” value to the desired number of seconds (e.g., 300 seconds).
Click on the “Save” button to save the changes.
Verify that the “Connection Draining” attribute is now enabled for the selected ELB.

That’s it! You have successfully remediated the misconfiguration of ELBs not having Connection Draining enabled in AWS.

Using CLI

To remediate the misconfiguration “ELBs Should Have Connection Draining Enabled” in AWS using AWS CLI, please follow the below steps:Step 1: Open the AWS CLI on your local machine.Step 2: Run the following command to enable connection draining for an existing ELB:

aws elb modify-load-balancer-attributes --load-balancer-name <ELB_Name> --load-balancer-attributes "{\"ConnectionDraining\":{\"Enabled\":true,\"Timeout\":300}}"

Note: Replace <ELB_Name> with the name of your ELB.Step 3: Verify the connection draining is enabled by running the following command:

aws elb describe-load-balancer-attributes --load-balancer-name <ELB_Name> --query 'LoadBalancerAttributes.ConnectionDraining'

Note: Replace <ELB_Name> with the name of your ELB.If the output of the above command shows “Enabled”: true, then the connection draining is enabled for your ELB.That’s it! You have successfully remediated the misconfiguration “ELBs Should Have Connection Draining Enabled” in AWS using AWS CLI.

Using Python

To remediate the “ELBs Should Have Connection Draining Enabled” misconfiguration in AWS using Python, follow these steps:

First, import the necessary AWS SDK libraries in your Python script. You will need boto3 and botocore libraries.

import boto3
from botocore.exceptions import ClientError

Next, create a boto3 client for the Elastic Load Balancing (ELB) service.

elb_client = boto3.client('elb')

Retrieve a list of all the ELBs in your AWS account using the describe_load_balancers() method.

response = elb_client.describe_load_balancers()
load_balancers = response['LoadBalancerDescriptions']

For each ELB in the list, check if Connection Draining is enabled by calling the describe_load_balancer_attributes() method.

for lb in load_balancers:
    lb_name = lb['LoadBalancerName']
    response = elb_client.describe_load_balancer_attributes(LoadBalancerName=lb_name)
    attrs = response['LoadBalancerAttributes']
    if 'ConnectionDraining' not in attrs or not attrs['ConnectionDraining']['Enabled']:
        # Connection Draining is not enabled. Remediate the misconfiguration.

If Connection Draining is not enabled, use the modify_load_balancer_attributes() method to enable it.

elb_client.modify_load_balancer_attributes(
    LoadBalancerName=lb_name,
    LoadBalancerAttributes={
        'ConnectionDraining': {
            'Enabled': True,
            'Timeout': 300 # Set the timeout value in seconds
        }
    }
)

Finally, add appropriate logging and error handling to your script.

try:
    # Put the above code here
except ClientError as e:
    print(f"Error: {e}")

With these steps, you can remediate the “ELBs Should Have Connection Draining Enabled” misconfiguration in AWS using Python.

Using Terraform

resource "aws_elb" "CLASSIC_ELB_NAME" {
  name               = "CLASSIC_ELB_NAME" # replace with your ELB name
  subnets            = [AWS_SUBNET_ID_1, AWS_SUBNET_ID_2] # replace with your subnet IDs
  security_groups    = [AWS_SECURITY_GROUP_ID]            # replace with your SG ID
  availability_zones = [AWS_AZ_1, AWS_AZ_2]               # replace with your AZs

  listener {
    instance_port     = 80
    instance_protocol = "HTTP"
    lb_port           = 80
    lb_protocol       = "HTTP"
  }

  # Enable Connection Draining with 300-second timeout (1–3600 allowed)
  connection_draining         = true
  connection_draining_timeout = 300
}

This change is an in-place update for a Classic Load Balancer and does not force replacement, but it does modify live traffic handling; review the timeout value (in seconds) for your application before applying.To verify, terraform plan should show an in-place update on aws_elb.CLASSIC_ELB_NAME with connection_draining changing to true (if it was false or unset) and connection_draining_timeout set to 300.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

ELBs Should Have Connection Draining Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: