AWS elasticloadbalancing high security documentation change
Summary
Updated S3 bucket ARN patterns in IAM policies to include account ID specificity and added security guidance for access logging configuration. Changes include replacing generic bucket ARN placeholders with structured paths containing account IDs, adding explicit security recommendations about avoiding wildcards in ARNs, and emphasizing account isolation.
Security assessment
The changes explicitly address security by enforcing precise S3 bucket ARNs with account IDs to prevent unauthorized access. Added sections like 'Enhance security by using precise S3 bucket ARNs' and warnings about wildcards demonstrate concrete security improvements to prevent potential bucket policy misconfigurations.
Diff
diff --git a/elasticloadbalancing/latest/application/enable-access-logging.md b/elasticloadbalancing/latest/application/enable-access-logging.md index bd6257854..87b57a32a 100644 --- a//elasticloadbalancing/latest/application/enable-access-logging.md +++ b//elasticloadbalancing/latest/application/enable-access-logging.md @@ -103 +103 @@ This policy grants permissions to the specified log delivery service. Use this p - "Resource": "s3-bucket-arn/*" + "Resource": "arn:aws:s3:::s3-bucket-name/prefix/AWSLogs/elb-account-id/*" @@ -108 +108,3 @@ This policy grants permissions to the specified log delivery service. Use this p -Replace `s3-bucket-arn` with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. +Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. + +Ensure your AWS account ID is always included in the resource path of your Amazon S3 bucket ARN. This ensures only Application Load Balancers from the specified AWS account are able to write access logs to the S3 bucket. @@ -112 +114 @@ Replace `s3-bucket-arn` with the ARN of the location for your access logs. The A -The bucket name is `amzn-s3-demo-logging-bucket`, the prefix is `logging-prefix`, and the ID of the AWS account with the load balancer is `111122223333`. +The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging-prefix`, and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. @@ -119 +121 @@ The bucket name is `amzn-s3-demo-logging-bucket`, the prefix is `logging-prefix` -The bucket name is `amzn-s3-demo-logging-bucket` and the ID of the AWS account with the load balancer is `111122223333`. +The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. @@ -123,0 +126,11 @@ The bucket name is `amzn-s3-demo-logging-bucket` and the ID of the AWS account w +###### Enhance security by using precise S3 bucket ARNs. + + * Use the full resource path, not just the S3 bucket ARN. + + * Ensure your S3 bucket ARN includes your AWS account ID. + + * Don't use wildcards (*) in the `elb-account-id` portion of your S3 bucket ARN. + + + + @@ -151 +164 @@ This policy grants permissions to the specified Elastic Load Balancing account I - "Resource": "s3-bucket-arn/*" + "Resource": "arn:aws:s3:::s3-bucket-name/prefix/AWSLogs/elb-account-id/*" @@ -205 +218,3 @@ Replace `elb-account-id` with the ID of the AWS account for Elastic Load Balanci -Replace `s3-bucket-arn` with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. +Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. + +Ensure your AWS account ID is always included in the resource path of your Amazon S3 bucket ARN. This ensures only Application Load Balancers from the specified AWS account are able to write access logs to the S3 bucket. @@ -209 +224 @@ Replace `s3-bucket-arn` with the ARN of the location for your access logs. The A -The bucket name is `amzn-s3-demo-logging-bucket`, the prefix is `logging-prefix`, and the ID of the AWS account with the load balancer is `111122223333`. +The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging-prefix`, and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. @@ -216 +231 @@ The bucket name is `amzn-s3-demo-logging-bucket`, the prefix is `logging-prefix` -The bucket name is `amzn-s3-demo-logging-bucket` and ID of the AWS account with the load balancer is `111122223333`. +The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and ID of the AWS account with the load balancer is `111122223333`. @@ -220,0 +236,11 @@ The bucket name is `amzn-s3-demo-logging-bucket` and ID of the AWS account with +###### Enhance security by using precise S3 bucket ARNs. + + * Use the full resource path, not just the S3 bucket ARN. + + * Ensure your S3 bucket ARN includes your AWS account ID. + + * Don't use wildcards (*) in the `elb-account-id` portion of your S3 bucket ARN. + + + + @@ -248 +274 @@ This policy grants permissions to the specified Elastic Load Balancing account I - "Resource": "s3-bucket-arn/*" + "Resource": "arn:aws:s3:::s3-bucket-name/prefix/AWSLogs/elb-account-id/*" @@ -262 +288,3 @@ Replace `elb-account-id` with the ID of the AWS account for Elastic Load Balanci -Replace `s3-bucket-arn` with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. +Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. + +Ensure your AWS account ID is always included in the resource path of your Amazon S3 bucket ARN. This ensures only Application Load Balancers from the specified AWS account are able to write access logs to the S3 bucket. @@ -266 +294 @@ Replace `s3-bucket-arn` with the ARN of the location for your access logs. The A -The bucket name is `amzn-s3-demo-logging-bucket`, the prefix is `logging-prefix`, and the ID of the AWS account with the load balancer is `111122223333`. +The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging-prefix`, and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. @@ -273 +301 @@ The bucket name is `amzn-s3-demo-logging-bucket`, the prefix is `logging-prefix` -The bucket name is `amzn-s3-demo-logging-bucket` and the ID of the AWS account with the load balancer is `111122223333`. +The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. @@ -277,0 +306,11 @@ The bucket name is `amzn-s3-demo-logging-bucket` and the ID of the AWS account w +###### Enhance security by using precise S3 bucket ARNs. + + * Use the full resource path, not just the S3 bucket ARN. + + * Ensure your S3 bucket ARN includes your AWS account ID. + + * Don't use wildcards (*) in the `elb-account-id` portion of your S3 bucket ARN. + + + + @@ -302 +341 @@ The following policy grants permissions to the specified log delivery service. U - "Resource": "s3-bucket-arn/*" + "Resource": "arn:aws:s3:::s3-bucket-name/prefix/AWSLogs/elb-account-id/*" @@ -310 +349,3 @@ The following policy grants permissions to the specified log delivery service. U -Replace `s3-bucket-arn` with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. +Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. + +Ensure your AWS account ID is always included in the resource path of your Amazon S3 bucket ARN. This ensures only Application Load Balancers from the specified AWS account are able to write access logs to the S3 bucket. @@ -314 +355 @@ Replace `s3-bucket-arn` with the ARN of the location for your access logs. The A -The bucket name is `amzn-s3-demo-logging-bucket`, the prefix is `logging-prefix`, and the ID of the AWS account with the load balancer is `111122223333`. +The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging-prefix`, and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. @@ -321 +362 @@ The bucket name is `amzn-s3-demo-logging-bucket`, the prefix is `logging-prefix` -The bucket name is `amzn-s3-demo-logging-bucket` and the ID of the AWS account with the load balancer is `111122223333`. +The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. @@ -325,0 +367,11 @@ The bucket name is `amzn-s3-demo-logging-bucket` and the ID of the AWS account w +###### Enhance security by using precise S3 bucket ARNs. + + * Use the full resource path, not just the S3 bucket ARN. + + * Ensure your S3 bucket ARN includes your AWS account ID. + + * Don't use wildcards (*) in the `elb-account-id` portion of your S3 bucket ARN. + + + +