Elastic Load Balancer has access logs to S3 configured

Check ID: elb_logging_enabled
Provider: AWS
Service: elb
Severity: MEDIUM
Categories: logging
Resource type: AwsElbLoadBalancer

What this check verifies

Elastic Load Balancers have access logs configured to deliver request metadata (client IPs, paths, status, TLS details) to Amazon S3

Risk

Without ELB access logs, you lose visibility into edge traffic, reducing detection of reconnaissance, brute-force, and exploitation attempts. This hampers forensics and incident timelines, risking undetected data exfiltration (confidentiality), untraceable changes (integrity), and delayed response to outages or DDoS (availability).

Recommendation

Enable access logs to Amazon S3 (access_logs.s3.enabled=true). Apply least privilege bucket policies, encrypt objects, and restrict read access. Define lifecycle retention and centralize analysis. Monitor for delivery failures and alert on anomalies. Standardize across all load balancers via IaC as part of defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elb modify-load-balancer-attributes --load-balancer-name <lb_name> --load-balancer-attributes AccessLog={Enabled=true,S3BucketName=<bucket_name>}

# Enable access logs for an ELBv2 load balancer (minimal)
resource "aws_lb" "<example_resource_name>" {
  load_balancer_type = "network"
  subnets            = ["<example_resource_id>", "<example_resource_id>"]

  access_logs {                   # CRITICAL: Enables S3 access logs
    bucket  = "<example_resource_name>"  # CRITICAL: S3 bucket for logs
    enabled = true                 # CRITICAL: Turn on access logging
  }
}

# CloudFormation: Enable access logs for a Classic Load Balancer (CLB)
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      Listeners:
        - LoadBalancerPort: 80
          InstancePort: 80
          Protocol: HTTP
      AvailabilityZones:
        - <example_resource_id>
      AccessLoggingPolicy:               # CRITICAL: Enables S3 access logs
        Enabled: true                    # CRITICAL: Turn on access logging
        S3BucketName: <example_resource_name>  # CRITICAL: S3 bucket to store logs

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elb_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Classic Load Balancer is in multiple Availability Zones Elastic Load Balancer has only HTTPS or SSL listeners

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires