Application Load Balancer has S3 access logs enabled

Check ID: elbv2_logging_enabled
Provider: AWS
Service: elbv2
Severity: MEDIUM
Categories: logging
Resource type: AwsElbv2LoadBalancer

What this check verifies

ELBv2 Application Load Balancers are evaluated for access logging enabled to Amazon S3, capturing request details such as timestamps, client IPs, paths, and response codes.

Risk

Absent ALB access logs reduces visibility and hampers incident detection and forensics. Malicious requests, credential stuffing, or data exfiltration via the load balancer can go unnoticed, undermining confidentiality and integrity, and delaying recovery from availability incidents.

Recommendation

Enable ALB access logging to a dedicated, encrypted S3 bucket. Apply least privilege to the bucket for delivery and readers, set lifecycle policies for retention, and consider Object Lock to deter tampering. Centralize logs in a SIEM and alert on anomalies as part of defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elbv2 modify-load-balancer-attributes --load-balancer-arn <lb_arn> --attributes Key=access_logs.s3.enabled,Value=true Key=access_logs.s3.bucket,Value=<bucket_name>

# Terraform: enable ALB access logs to S3
resource "aws_lb" "<example_resource_name>" {
  name            = "<example_resource_name>"
  security_groups = ["<example_security_group_id>"]
  subnets         = ["<subnet_id_1>", "<subnet_id_2>"]

  access_logs {
    bucket  = "<example_resource_name>"  # critical: destination S3 bucket for logs
    enabled = true                        # critical: enable ALB access logging
  }
}

# CloudFormation: enable ALB access logs to S3
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Subnets:
        - <subnet_id_1>
        - <subnet_id_2>
      SecurityGroups:
        - <example_security_group_id>
      LoadBalancerAttributes:
        - Key: access_logs.s3.enabled  # critical: enable ALB access logging
          Value: "true"
        - Key: access_logs.s3.bucket   # critical: destination S3 bucket for logs
          Value: "<example_resource_name>"

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elbv2_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ELBv2 load balancer has at least one listener ELBv2 Network Load Balancer has TLS termination enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires