Back to Checks
aws

Elastic Load Balancer has access logs to S3 configured

elb_logging_enabled
Service: elbSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsElbLoadBalancer

Elastic Load Balancers have access logs configured to deliver request metadata (client IPs, paths, status, TLS details) to Amazon S3

Prowler logoProwlerprowler-provider-aws

Risk

Without ELB access logs, you lose visibility into edge traffic, reducing detection of reconnaissance, brute-force, and exploitation attempts. This hampers forensics and incident timelines, risking undetected data exfiltration (confidentiality), untraceable changes (integrity), and delayed response to outages or DDoS (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elb_logging_enabled

Recommendation

Enable access logs to Amazon S3 (access_logs.s3.enabled=true). Apply least privilege bucket policies, encrypt objects, and restrict read access. Define lifecycle retention and centralize analysis. Monitor for delivery failures and alert on anomalies. Standardize across all load balancers via IaC as part of defense in depth.

Remediation

CLI

aws elb modify-load-balancer-attributes --load-balancer-name <lb_name> --load-balancer-attributes AccessLog={Enabled=true,S3BucketName=<bucket_name>}

Terraform

# Enable access logs for an ELBv2 load balancer (minimal)
resource "aws_lb" "<example_resource_name>" {
  load_balancer_type = "network"
  subnets            = ["<example_resource_id>", "<example_resource_id>"]

  access_logs {                   # CRITICAL: Enables S3 access logs
    bucket  = "<example_resource_name>"  # CRITICAL: S3 bucket for logs
    enabled = true                 # CRITICAL: Turn on access logging
  }
}

NativeIaC

# CloudFormation: Enable access logs for a Classic Load Balancer (CLB)
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      Listeners:
        - LoadBalancerPort: 80
          InstancePort: 80
          Protocol: HTTP
      AvailabilityZones:
        - <example_resource_id>
      AccessLoggingPolicy:               # CRITICAL: Enables S3 access logs
        Enabled: true                    # CRITICAL: Turn on access logging
        S3BucketName: <example_resource_name>  # CRITICAL: S3 bucket to store logs

Other

1In the AWS Console, go to EC2 > Load Balancers
2Select the load balancer and choose Edit attributes (or the Attributes tab)
3Turn on Access logs
4Enter the S3 URI (e.g., s3://<bucket_name>)
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elb.elb_client import elb_client


class elb_logging_enabled(Check):
    def execute(self):
        findings = []
        for lb in elb_client.loadbalancers.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
            report.status = "FAIL"
            report.status_extended = (
                f"ELB {lb.name} does not have access logs configured."
            )
            if lb.access_logs:
                report.status = "PASS"
                report.status_extended = (
                    f"ELB {lb.name} has access logs to S3 configured."
                )

            findings.append(report)

        return findings

References