ELBv2 ALB access log disabled

Docs > Datadog Security > Code Security > Infrastructure as Code (IaC) Security > IaC Security Rules > ELBv2 ALB access log disabled

Metadata

Id: cloudformation-aws-elb-v2-alb-access-log-disabled

Provider: AWS

Platform: CloudFormation

Severity: Medium

Category: Observability

Learn More

Provider Reference

Description

Application Load Balancers must have access logging enabled so you retain detailed request records for incident investigation and traffic analysis. Without logs, security incidents are harder to investigate and you may not meet auditing or compliance requirements.

For CloudFormation, check AWS::ElasticLoadBalancingV2::LoadBalancer resources have a LoadBalancerAttributes entry with Key equal to access_logs.s3.enabled and Value set to true (or the string "true" in templates). Resources missing the LoadBalancerAttributes property, or that include access_logs.s3.enabled with Value set to false (or "false"), will be flagged as non-compliant.

Secure CloudFormation example:

MyLoadBalancer:
  Type: AWS::ElasticLoadBalancingV2::LoadBalancer
  Properties:
    Name: my-alb
    Type: application
    LoadBalancerAttributes:
      - Key: access_logs.s3.enabled
        Value: "true"
      - Key: access_logs.s3.bucket
        Value: my-alb-logs-bucket
      - Key: access_logs.s3.prefix
        Value: alb-logs/

Compliant Code Examples

AWSTemplateFormatVersion: "2010-09-09"
Description: A simple EC2 instance
Parameters:
  EnvironmentName:
    Description: An environment name that will be prefixed to resource names
    Type: String

  VPC:
    Type: AWS::EC2::VPC::Id
    Description: Choose which VPC the Application Load Balancer should be deployed to

  Subnets:
    Description: Choose which subnets the Application Load Balancer should be deployed to
    Type: List<AWS::EC2::Subnet::Id>

  SecurityGroup:
    Description: Select the Security Group to apply to the Application Load Balancer
    Type: AWS::EC2::SecurityGroup::Id
Resources:
  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: !Ref EnvironmentName
      Subnets: !Ref Subnets
      SecurityGroups:
        - !Ref SecurityGroup
      Tags:
        - Key: Name
          Value: !Ref EnvironmentName
      LoadBalancerAttributes:
        - Key: access_logs.s3.enabled
          Value: true

Non-Compliant Code Examples

AWSTemplateFormatVersion: "2010-09-09"
Description: A simple EC2 instance
Parameters:
  EnvironmentName:
    Description: An environment name that will be prefixed to resource names
    Type: String

  VPC:
    Type: AWS::EC2::VPC::Id
    Description: Choose which VPC the Application Load Balancer should be deployed to

  Subnets:
    Description: Choose which subnets the Application Load Balancer should be deployed to
    Type: List<AWS::EC2::Subnet::Id>

  SecurityGroup:
    Description: Select the Security Group to apply to the Application Load Balancer
    Type: AWS::EC2::SecurityGroup::Id
Resources:
  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: !Ref EnvironmentName
      Subnets: !Ref Subnets
      SecurityGroups:
        - !Ref SecurityGroup
      Tags:
        - Key: Name
          Value: !Ref EnvironmentName

AWSTemplateFormatVersion: "2010-09-09"
Description: A simple EC2 instance
Parameters:
  EnvironmentName:
    Description: An environment name that will be prefixed to resource names
    Type: String

  VPC:
    Type: AWS::EC2::VPC::Id
    Description: Choose which VPC the Application Load Balancer should be deployed to

  Subnets:
    Description: Choose which subnets the Application Load Balancer should be deployed to
    Type: List<AWS::EC2::Subnet::Id>

  SecurityGroup:
    Description: Select the Security Group to apply to the Application Load Balancer
    Type: AWS::EC2::SecurityGroup::Id
Resources:
  LoadBalancertest:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: !Ref EnvironmentName
      Subnets: !Ref Subnets
      SecurityGroups:
        - !Ref SecurityGroup
      Tags:
        - Key: Name
          Value: !Ref EnvironmentName
      LoadBalancerAttributes:
        - Key: access_logs.s3.enabled
          Value: false