AWS elasticloadbalancing medium security documentation change
Summary
Updated S3 bucket ARN examples and added security guidance for access log configuration. Enhanced documentation with explicit instructions to include AWS account IDs in resource paths and avoid wildcards in account ID portions of ARNs.
Security assessment
The changes explicitly warn against using wildcards in account ID portions of S3 ARNs and emphasize including specific AWS account IDs to restrict access. This prevents potential bucket write access from unintended accounts, addressing a security misconfiguration risk.
Diff
diff --git a/elasticloadbalancing/latest/classic/enable-access-logs.md b/elasticloadbalancing/latest/classic/enable-access-logs.md index fb5284136..57deef081 100644 --- a//elasticloadbalancing/latest/classic/enable-access-logs.md +++ b//elasticloadbalancing/latest/classic/enable-access-logs.md @@ -101 +101 @@ This policy grants permissions to the specified log delivery service. Use this p - "Resource": "arn:aws:s3:::amzn-s3-demo-loadbalancer-logs/logging-prefix/AWSLogs/012345678912/*" + "Resource": "arn:aws:s3:::s3-bucket-name/prefix/AWSLogs/elb-account-id/*" @@ -105,0 +106,29 @@ This policy grants permissions to the specified log delivery service. Use this p +Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. + +Ensure your AWS account ID is always included in the resource path of your Amazon S3 bucket ARN. This ensures only Application Load Balancers from the specified AWS account are able to write access logs to the S3 bucket. + +###### Example S3 bucket ARN with a prefix + +The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging-prefix`, and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. + + + arn:aws:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/111122223333/* + +###### Example S3 bucket ARN with no prefix + +The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. + + + arn:aws:s3:::amzn-s3-demo-logging-bucket/AWSLogs/111122223333/* + +###### Enhance security by using precise S3 bucket ARNs. + + * Use the full resource path, not just the S3 bucket ARN. + + * Ensure your S3 bucket ARN includes your AWS account ID. + + * Don't use wildcards (*) in the `elb-account-id` portion of your S3 bucket ARN. + + + + @@ -118 +147 @@ This policy grants permissions to the specified Elastic Load Balancing account I - "Resource": "s3-bucket-arn" + "Resource": "arn:aws:s3:::s3-bucket-name/prefix/AWSLogs/elb-account-id/*" @@ -172 +201,3 @@ Replace `elb-account-id` with the ID of the AWS account for Elastic Load Balanci -Replace `s3-bucket-arn` with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to specify a prefix when you enable access logs in [step 3](./enable-access-logs.html). +Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. + +Ensure your AWS account ID is always included in the resource path of your Amazon S3 bucket ARN. This ensures only Application Load Balancers from the specified AWS account are able to write access logs to the S3 bucket. @@ -174 +205 @@ Replace `s3-bucket-arn` with the ARN of the location for your access logs. The A - * ARN example with a prefix +###### Example S3 bucket ARN with a prefix @@ -176 +207 @@ Replace `s3-bucket-arn` with the ARN of the location for your access logs. The A - arn:aws:s3:::amzn-s3-demo-loadbalancer-logs/logging-prefix/AWSLogs/012345678912/* +The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging-prefix`, and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. @@ -178 +208,0 @@ Replace `s3-bucket-arn` with the ARN of the location for your access logs. The A - * ARN example without a prefix @@ -180 +210,16 @@ Replace `s3-bucket-arn` with the ARN of the location for your access logs. The A - arn:aws:s3:::amzn-s3-demo-loadbalancer-logs/AWSLogs/012345678912/* + arn:aws:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/111122223333/* + +###### Example S3 bucket ARN with no prefix + +The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and ID of the AWS account with the load balancer is `111122223333`. + + + arn:aws:s3:::amzn-s3-demo-logging-bucket/AWSLogs/111122223333/* + +###### Enhance security by using precise S3 bucket ARNs. + + * Use the full resource path, not just the S3 bucket ARN. + + * Ensure your S3 bucket ARN includes your AWS account ID. + + * Don't use wildcards (*) in the `elb-account-id` portion of your S3 bucket ARN. @@ -197 +242 @@ This policy grants permissions to the specified Elastic Load Balancing account I - "Resource": "s3-bucket-arn" + "Resource": ""arn:aws:s3:::s3-bucket-name/prefix/AWSLogs/elb-account-id/*" @@ -211 +256,17 @@ Replace `elb-account-id` with the ID of the AWS account for Elastic Load Balanci -Replace `s3-bucket-arn` with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to specify a prefix when you enable access logs in [step 3](./enable-access-logs.html). +Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. + +Ensure your AWS account ID is always included in the resource path of your Amazon S3 bucket ARN. This ensures only Application Load Balancers from the specified AWS account are able to write access logs to the S3 bucket. + +###### Example S3 bucket ARN with a prefix + +The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging-prefix`, and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. + + + arn:aws-us-gov:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/111122223333/* + +###### Example S3 bucket ARN with no prefix + +The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. + + + arn:aws-us-gov:s3:::amzn-s3-demo-logging-bucket/AWSLogs/111122223333/* @@ -213 +274 @@ Replace `s3-bucket-arn` with the ARN of the location for your access logs. The A - * ARN example with a prefix +###### Enhance security by using precise S3 bucket ARNs. @@ -215 +276 @@ Replace `s3-bucket-arn` with the ARN of the location for your access logs. The A - arn:aws-us-gov:s3:::amzn-s3-demo-loadbalancer-logs/logging-prefix/AWSLogs/012345678912/* + * Use the full resource path, not just the S3 bucket ARN. @@ -217 +278 @@ Replace `s3-bucket-arn` with the ARN of the location for your access logs. The A - * ARN example without a prefix + * Ensure your S3 bucket ARN includes your AWS account ID. @@ -219 +280 @@ Replace `s3-bucket-arn` with the ARN of the location for your access logs. The A - arn:aws-us-gov:s3:::amzn-s3-demo-loadbalancer-logs/AWSLogs/012345678912/* + * Don't use wildcards (*) in the `elb-account-id` portion of your S3 bucket ARN.