Back to Checks
huaweicloud

ELB load balancers should not have public IP addresses

elb_public_exposure
Service: elbSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

Ensure that Elastic Load Balancer (ELB) instances do not have public IP addresses unless explicitly required, to reduce the attack surface.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

ELB load balancers with public IP addresses are accessible from the internet, increasing the attack surface and potentially exposing internal services to unauthorized access.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks elb_public_exposure

Recommendation

Avoid assigning public IP addresses to ELB load balancers unless they are intended to be internet-facing.

Remediation

CLI

hcloud EIP DisassociatePublicips --publicip_id=<eip_id>

Other

1Log on to the **Huawei Cloud console**.
2Navigate to **Elastic Load Balance**.
3Select the **load balancer**.
4Disassociate the public IP or recreate the **load balancer** with an internal IP.

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.elb.elb_client import elb_client


class elb_public_exposure(Check):
    """Check if ELB load balancers have public IP addresses exposed."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        for load_balancer in elb_client.load_balancers:
            report = CheckReportHuaweiCloud(
                metadata=self.metadata(), resource=load_balancer
            )
            report.region = load_balancer.region
            report.resource_id = load_balancer.id
            report.resource_arn = f"huaweicloud:elb:{load_balancer.region}:{elb_client.audited_account}:loadbalancer/{load_balancer.id}"

            if load_balancer.is_public:
                report.status = "FAIL"
                report.status_extended = (
                    f"ELB load balancer {load_balancer.name} ({load_balancer.id}) "
                    f"has a public IP address {load_balancer.public_ip}."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"ELB load balancer {load_balancer.name} ({load_balancer.id}) "
                    f"does not have a public IP address."
                )

            findings.append(report)

        return findings

References