AWS elasticloadbalancing medium security documentation change
Summary
Updated S3 bucket ARN structure in IAM policy examples and added emphasis on including AWS account ID in resource path to restrict log writing access
Security assessment
Explicitly requires account ID in S3 resource ARN to prevent unauthorized ALBs from writing logs, improving access control
Diff
diff --git a/elasticloadbalancing/latest/application/enable-connection-logging.md b/elasticloadbalancing/latest/application/enable-connection-logging.md index 649c3bdb0..c4aed63f1 100644 --- a//elasticloadbalancing/latest/application/enable-connection-logging.md +++ b//elasticloadbalancing/latest/application/enable-connection-logging.md @@ -118 +118 @@ This policy grants permissions to the specified Elastic Load Balancing account I - "Resource": "s3-bucket-arn/*" + "Resource": "arn:aws:s3:::s3-bucket-name/prefix/AWSLogs/elb-account-id/*" @@ -172 +172,3 @@ Replace `elb-account-id` with the ID of the AWS account for Elastic Load Balanci -Replace `s3-bucket-arn` with the ARN of the location for your connection logs. The ARN that you specify depends on whether you plan to specify a prefix when you enable connection logs in step 3. +Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with the ARN of the location for your connection logs. The ARN that you specify depends on whether you plan to specify a prefix when you enable connection logs in step 3. + +Ensure your AWS account ID is always included in the resource path of your Amazon S3 bucket ARN. This ensures only Application Load Balancers from the specified AWS account are able to write access logs to the S3 bucket. @@ -176 +178 @@ Replace `s3-bucket-arn` with the ARN of the location for your connection logs. T -The bucket name is amzn-s3-demo-logging-bucket, the prefix is `logging-prefix` and the ID of the AWS account with the load balancer is `111122223333`. +The `s3-bucket-name` is amzn-s3-demo-logging-bucket, the `prefix` is `logging-prefix` and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. @@ -181 +183 @@ The bucket name is amzn-s3-demo-logging-bucket, the prefix is `logging-prefix` a -###### Example S3 bucket ARN example without a prefix +###### Example S3 bucket ARN with no prefix @@ -183 +185 @@ The bucket name is amzn-s3-demo-logging-bucket, the prefix is `logging-prefix` a -The bucket name is amzn-s3-demo-logging-bucket and the ID of the AWS account with the load balancer is `111122223333`. +The `s3-bucket-name` is amzn-s3-demo-logging-bucket and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. @@ -200 +202 @@ This policy grants permissions to the specified Elastic Load Balancing account I - "Resource": "s3-bucket-arn/*" + "Resource": "arn:aws:s3:::s3-bucket-name/prefix/AWSLogs/elb-account-id/*" @@ -214 +216,3 @@ Replace `elb-account-id` with the ID of the AWS account for Elastic Load Balanci -Replace `s3-bucket-arn` with the ARN of the bucket for your access logs. +Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with the ARN of the bucket for your access logs. + +Ensure your AWS account ID is always included in the resource path of your Amazon S3 bucket ARN. This ensures only Application Load Balancers from the specified AWS account are able to write access logs to the S3 bucket. @@ -218 +222 @@ Replace `s3-bucket-arn` with the ARN of the bucket for your access logs. -The bucket name is `amzn-s3-demo-logging-bucket`, the prefix is `logging-prefix`, and the ID of the AWS account with the load balancer is `111122223333`. +The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging-prefix`, and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. @@ -225 +229 @@ The bucket name is `amzn-s3-demo-logging-bucket`, the prefix is `logging-prefix` -The bucket name is `amzn-s3-demo-logging-bucket` and the ID of the AWS account with the load balancer is `111122223333`. +The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` of the AWS account with the load balancer is `111122223333`.