Back to Checks
aws

ELBv2 Application Load Balancer has access logs to S3 configured

elbv2_logging_enabled
Service: elbv2Severity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsElbv2LoadBalancer

ELBv2 Application Load Balancers are evaluated for access logging enabled to Amazon S3, capturing request details such as timestamps, client IPs, paths, and response codes.

Prowler logoProwlerprowler-provider-aws

Risk

Absent ALB access logs reduces visibility and hampers incident detection and forensics. Malicious requests, credential stuffing, or data exfiltration via the load balancer can go unnoticed, undermining confidentiality and integrity, and delaying recovery from availability incidents.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elbv2_logging_enabled

Recommendation

Enable ALB access logging to a dedicated, encrypted S3 bucket. Apply least privilege to the bucket for delivery and readers, set lifecycle policies for retention, and consider Object Lock to deter tampering. Centralize logs in a SIEM and alert on anomalies as part of defense in depth.

Remediation

CLI

aws elbv2 modify-load-balancer-attributes --load-balancer-arn <lb_arn> --attributes Key=access_logs.s3.enabled,Value=true Key=access_logs.s3.bucket,Value=<bucket_name>

Terraform

# Terraform: enable ALB access logs to S3
resource "aws_lb" "<example_resource_name>" {
  name            = "<example_resource_name>"
  security_groups = ["<example_security_group_id>"]
  subnets         = ["<subnet_id_1>", "<subnet_id_2>"]

  access_logs {
    bucket  = "<example_resource_name>"  # critical: destination S3 bucket for logs
    enabled = true                        # critical: enable ALB access logging
  }
}

NativeIaC

# CloudFormation: enable ALB access logs to S3
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Subnets:
        - <subnet_id_1>
        - <subnet_id_2>
      SecurityGroups:
        - <example_security_group_id>
      LoadBalancerAttributes:
        - Key: access_logs.s3.enabled  # critical: enable ALB access logging
          Value: "true"
        - Key: access_logs.s3.bucket   # critical: destination S3 bucket for logs
          Value: "<example_resource_name>"

Other

1In AWS Console, go to EC2 > Load Balancers and select your Application Load Balancer
2Open the Attributes (or Edit attributes) section and find Access logs
3Check Enable access logs and choose the S3 bucket for delivery
4Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client


class elbv2_logging_enabled(Check):
    def execute(self):
        findings = []
        for lb in elbv2_client.loadbalancersv2.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
            report.status = "FAIL"
            report.status_extended = (
                f"ELBv2 ALB {lb.name} does not have access logs configured."
            )
            if lb.access_logs == "true":
                report.status = "PASS"
                report.status_extended = (
                    f"ELBv2 ALB {lb.name} has access logs to S3 configured."
                )

            findings.append(report)

        return findings

References