More Info:
All Amazon internet-facing load balancers (Classic Load Balancers and Application Load Balancers) provisioned within your AWS account should be regularly reviewed for security purposes.Risk Level
LowAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
The following are the step by step instructions to remediate the misconfiguration “Internet Facing ELBs Should Be Regularly Reviewed” in AWS using the AWS console:
- Log in to the AWS Management Console.
- Navigate to the EC2 service.
- Click on the “Load Balancers” option in the left-hand menu.
- Select the Internet-facing ELB that needs to be reviewed.
- Click on the “Listeners” tab.
- Review the protocol and port configuration for each listener. Ensure that they are configured according to your organization’s security policies.
- Click on the “Security” tab.
- Review the security groups associated with the ELB. Ensure that only necessary ports are open and that the source IP ranges are restricted to only authorized IPs.
- Click on the “Instances” tab.
- Review the instances associated with the ELB. Ensure that they are running the latest security patches and that they are not exposing any unnecessary services.
- Click on the “Health Check” tab.
- Review the health check configuration. Ensure that it is configured according to your organization’s security policies.
- Click on the “Attributes” tab.
- Review the attributes associated with the ELB. Ensure that they are configured according to your organization’s security policies.
- Make any necessary changes to the ELB configuration.
- Click on the “Save” button to save the changes.
Using CLI
Using CLI
To remediate the misconfiguration for AWS using AWS CLI, follow these steps:
-
Open the AWS CLI and run the following command to list all the internet-facing Elastic Load Balancers (ELBs) in your account:
- Review the output and identify any ELBs that are no longer needed or should not be internet-facing.
-
For each internet-facing ELB that needs to be reviewed, run the following command to modify the scheme to internal:
Replace
<ELB_ARN>with the ARN of the ELB that needs to be modified. -
Verify that the ELB’s scheme has been changed to internal by running the following command:
Replace
<ELB_ARN>with the ARN of the ELB that was modified. - Repeat steps 3-4 for each internet-facing ELB that needs to be reviewed.
- Once all internet-facing ELBs have been reviewed and modified, run the first command again to verify that all internet-facing ELBs have been remediated.
Using Python
Using Python
To remediate the misconfiguration of Internet Facing ELBs in AWS, you can use the following Python script:This script uses the boto3 library to create a client for Elastic Load Balancing (ELB) in AWS. It then sets the desired security group ID for the specified ELB ARN using the
set_security_groups function. Finally, it prints the response from the API call.To use this script, replace the elb_arn and security_group_id values with the appropriate values for your environment. You can then run the script to remediate the misconfiguration of Internet Facing ELBs in AWS.