Checks

Classic Load Balancer spans at least the configured number of Availability Zones.

The evaluation identifies load balancers enabled in fewer AZs than the specified minimum.

Elastic Load Balancers have access logs configured to deliver request metadata (client IPs, paths, status, TLS details) to Amazon S3

Ensure that Elastic Load Balancer (ELB) instances do not have public IP addresses unless explicitly required, to reduce the attack surface.

Elastic Load Balancers are assessed for client-facing listener protocols. Only HTTPS or SSL are considered encrypted; any HTTP or TCP listener indicates plaintext between clients and the load balancer.

Classic Load Balancer HTTPS/SSL listeners use AWS Certificate Manager certificates that are Amazon-issued (certificate type AMAZON_ISSUED).

Ensure that Application Load Balancers (ALB) are configured to drop invalid HTTP header fields. The check fails when routing.http.drop_invalid_header_fields.enabled is not set to true. By default, ALBs do not remove HTTP headers that do not conform to RFC 7230.

Network and Gateway Load Balancers have cross-zone load balancing enabled (load_balancing.cross_zone.enabled), so each node distributes requests to targets in all enabled Availability Zones rather than only its own.

ELBv2 load balancers with deletion protection (deletion_protection.enabled) are resistant to deletion through standard APIs.

The assessment determines whether this attribute is enabled on each load balancer.

Application Load Balancer settings are reviewed for HTTP desync protections. It evaluates routing.http.desync_mitigation_mode for strictest or defensive; when neither is configured, it checks routing.http.drop_invalid_header_fields.enabled is true as a compensating control.

ELBv2 HTTPS listeners are assessed for use of strong TLS policies. Listeners whose ssl_policy is not in the approved set (TLS 1.2/1.3-focused policies) may include weak protocols or ciphers.

ELBv2 Application Load Balancers configured as internet-facing are assessed for exposure by reviewing attached security groups.

Inbound TCP rules that allow 0.0.0.0/0 or ::/0 indicate unrestricted internet reachability.

ELBv2 load balancers (Application, Network, or Gateway) are assessed for distribution across multiple Availability Zones. The finding indicates whether each load balancer spans at least the configured minimum number of AZs (default 2).

ELBv2 HTTPS and TLS listeners are assessed for use of a FIPS TLS security policy (ELBSecurityPolicy-*-FIPS-*). FIPS policies terminate TLS with the AWS-LC FIPS validated cryptographic module.

ELBv2 HTTPS and TLS listeners are assessed for use of post-quantum (PQ) TLS security policies. Listeners whose SslPolicy is not in the approved PQ set lack hybrid key exchange (ML-KEM 768 + ECDHE), which can increase harvest-now-decrypt-later exposure for recorded traffic.

ELBv2 load balancer requires at least one listener (protocol and port) to accept client connections and route requests to target groups. The finding indicates whether listeners are defined on the load balancer.

ELBv2 Application Load Balancers are evaluated for access logging enabled to Amazon S3, capturing request details such as timestamps, client IPs, paths, and response codes.

Network Load Balancers with listeners using the TLS protocol indicate TLS termination at the load balancer. The evaluation identifies NLBs that have at least one TLS listener versus those using plain TCP/UDP or deferring encryption to targets.

Application Load Balancer listeners are assessed for encrypted ingress: either only HTTPS listeners are present, or any HTTP listener redirects to HTTPS.

Application Load Balancers are evaluated for an associated AWS WAF web ACL that governs HTTP(S) requests. The evaluation detects ALBs missing a web ACL and recognizes associations from WAFv2 or regional WAF Classic.

Amazon EMR account-level Block Public Access configuration is assessed per Region. When BlockPublicSecurityGroupRules is enabled, clusters cannot use security groups that allow inbound public sources (0.0.0.0/0, ::/0) except on permitted ports.

Amazon EMR clusters in non-terminated states are assessed for public IP assignment on cluster nodes (primary and workers). The finding identifies clusters whose instances are reachable via public IPs rather than private VPC addresses.

Amazon EMR clusters are assessed for public network exposure by examining master and core/task node security groups for inbound rules that allow any source (0.0.0.0/0 or ::/0).

Only active clusters are considered, and findings identify exposure via the specific security groups attached to the cluster nodes.

An access review scoped to guest users should exist and be active so that external guest access is periodically recertified by reviewers. Requires a Microsoft Entra ID P2 license.

An access review scoped to privileged (PIM) directory roles should exist and be active so privileged role assignments are periodically recertified by reviewers. Requires a Microsoft Entra ID P2 license.