AWS elasticloadbalancing high security documentation change
Summary
Updated S3 bucket policy examples and guidance to enforce stricter resource ARN formatting for access logging. Added explicit security recommendations to include account IDs in ARNs, avoid wildcards, and use full resource paths.
Security assessment
The changes explicitly address security by requiring precise S3 bucket ARNs with account IDs and prohibiting wildcards in the account ID portion. This prevents overly permissive policies that could allow unintended access to S3 buckets from other accounts. The added 'Enhance security' section directly provides security hardening guidance.
Diff
diff --git a/elasticloadbalancing/latest/application/enable-access-logging.md b/elasticloadbalancing/latest/application/enable-access-logging.md index 87b57a32a..2474690ab 100644 --- a//elasticloadbalancing/latest/application/enable-access-logging.md +++ b//elasticloadbalancing/latest/application/enable-access-logging.md @@ -68 +68,12 @@ The bucket policy that you'll use depends on the AWS Region and the type of zone -This policy grants permissions to the specified log delivery service. Use this policy for load balancers in Availability Zones and Local Zones in the following Regions: +###### Enhance security by using precise S3 bucket ARNs. + + * Use the full resource path, not just the S3 bucket ARN. + + * Include the account ID portion of the S3 bucket ARN. + + * Don't use wildcards (*) in the account ID portion of the S3 bucket ARN. + + + + +This policy grants permissions to the specified log delivery service. Use this policy for load balancers in the following Regions: @@ -103 +114 @@ This policy grants permissions to the specified log delivery service. Use this p - "Resource": "arn:aws:s3:::s3-bucket-name/prefix/AWSLogs/elb-account-id/*" + "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/prefix/AWSLogs/123456789012/*" @@ -108 +119 @@ This policy grants permissions to the specified log delivery service. Use this p -Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. +For `Resource`, enter the ARN of the location for the access logs, using the format shown in the example policy. Always include the account ID of the account with the load balancer in the resource path of the S3 bucket ARN. This ensures that only load balancers from the specified account can write access logs to the S3 bucket. @@ -110 +121 @@ Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with -Ensure your AWS account ID is always included in the resource path of your Amazon S3 bucket ARN. This ensures only Application Load Balancers from the specified AWS account are able to write access logs to the S3 bucket. +The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. @@ -114 +125 @@ Ensure your AWS account ID is always included in the resource path of your Amazo -The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging-prefix`, and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. +The S3 bucket name is amzn-s3-demo-logging-bucket and the prefix is logging-prefix. @@ -117 +128 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging- - arn:aws:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/111122223333/* + arn:aws:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/123456789012/* @@ -121,13 +132 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging- -The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. - - - arn:aws:s3:::amzn-s3-demo-logging-bucket/AWSLogs/111122223333/* - -###### Enhance security by using precise S3 bucket ARNs. - - * Use the full resource path, not just the S3 bucket ARN. - - * Ensure your S3 bucket ARN includes your AWS account ID. - - * Don't use wildcards (*) in the `elb-account-id` portion of your S3 bucket ARN. - +The S3 bucket name is amzn-s3-demo-logging-bucket. There is no prefix portion in the S3 bucket ARN. @@ -135,0 +135 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` o + arn:aws:s3:::amzn-s3-demo-logging-bucket/AWSLogs/123456789012/* @@ -152 +152 @@ If the Amazon S3 bucket policy uses `Effect` with the value `Deny` and includes -This policy grants permissions to the specified Elastic Load Balancing account ID. Use this policy for load balancers in Availability Zones or Local Zones in the Regions in the list below. +This policy grants permissions to the specified Elastic Load Balancing account ID. Use this policy for load balancers in the Regions listed below. @@ -164 +164 @@ This policy grants permissions to the specified Elastic Load Balancing account I - "Resource": "arn:aws:s3:::s3-bucket-name/prefix/AWSLogs/elb-account-id/*" + "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/prefix/AWSLogs/123456789012/*" @@ -169 +169 @@ This policy grants permissions to the specified Elastic Load Balancing account I -Replace `elb-account-id` with the ID of the AWS account for Elastic Load Balancing for your Region: +For `Principal`, replace `elb-account-id` with the ID of the Elastic Load Balancing account for the Region of the load balancer: @@ -218 +218 @@ Replace `elb-account-id` with the ID of the AWS account for Elastic Load Balanci -Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. +For `Resource`, enter the ARN of the location for the access logs, using the format shown in the example policy. Always include the account ID of the account with the load balancer in the resource path of the S3 bucket ARN. This ensures that only load balancers from the specified account can write access logs to the S3 bucket. @@ -220 +220 @@ Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with -Ensure your AWS account ID is always included in the resource path of your Amazon S3 bucket ARN. This ensures only Application Load Balancers from the specified AWS account are able to write access logs to the S3 bucket. +The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. @@ -224 +224 @@ Ensure your AWS account ID is always included in the resource path of your Amazo -The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging-prefix`, and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. +The S3 bucket name is amzn-s3-demo-logging-bucket and the prefix is logging-prefix. @@ -227 +227 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging- - arn:aws:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/111122223333/* + arn:aws:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/123456789012/* @@ -231,13 +231 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging- -The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and ID of the AWS account with the load balancer is `111122223333`. - - - arn:aws:s3:::amzn-s3-demo-logging-bucket/AWSLogs/111122223333/* - -###### Enhance security by using precise S3 bucket ARNs. - - * Use the full resource path, not just the S3 bucket ARN. - - * Ensure your S3 bucket ARN includes your AWS account ID. - - * Don't use wildcards (*) in the `elb-account-id` portion of your S3 bucket ARN. - +The S3 bucket name is amzn-s3-demo-logging-bucket. There is no prefix portion in the S3 bucket ARN. @@ -245,0 +234 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and ID of the AWS account + arn:aws:s3:::amzn-s3-demo-logging-bucket/AWSLogs/123456789012/* @@ -262 +251 @@ If the Amazon S3 bucket policy uses `Effect` with the value `Deny` and includes -This policy grants permissions to the specified Elastic Load Balancing account ID. Use this policy for load balancers in Availability Zones or Local Zones in the AWS GovCloud (US) Regions in the list below. +This policy grants permissions to the specified Elastic Load Balancing account ID. Use this policy for load balancers in the AWS GovCloud (US) Regions. @@ -274 +263 @@ This policy grants permissions to the specified Elastic Load Balancing account I - "Resource": "arn:aws:s3:::s3-bucket-name/prefix/AWSLogs/elb-account-id/*" + "Resource": "arn-aws-us-gov:s3:::amzn-s3-demo-bucket/prefix/AWSLogs/123456789012/*" @@ -279 +268 @@ This policy grants permissions to the specified Elastic Load Balancing account I -Replace `elb-account-id` with the ID of the AWS account for Elastic Load Balancing for your AWS GovCloud (US) Region: +For `Principal`, replace `elb-account-id` with the ID of the Elastic Load Balancing account for the Region of the load balancer: @@ -288 +277 @@ Replace `elb-account-id` with the ID of the AWS account for Elastic Load Balanci -Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. +For `Resource`, enter the ARN of the location for the access logs, using the format shown in the example policy. Always include the account ID of the account with the load balancer in the resource path of the S3 bucket ARN. This ensures that only load balancers from the specified account can write access logs to the S3 bucket. @@ -290 +279 @@ Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with -Ensure your AWS account ID is always included in the resource path of your Amazon S3 bucket ARN. This ensures only Application Load Balancers from the specified AWS account are able to write access logs to the S3 bucket. +The S3 bucket ARN that you specify depends on whether you plan to include a prefix when you enable access logs link step 3. @@ -294 +283 @@ Ensure your AWS account ID is always included in the resource path of your Amazo -The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging-prefix`, and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. +The S3 bucket name is amzn-s3-demo-logging-bucket and the prefix is logging-prefix. @@ -297 +286 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging- - arn:aws-us-gov:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/111122223333/* + arn:aws-us-gov:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/123456789012/* @@ -301,13 +290 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging- -The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. - - - arn:aws-us-gov:s3:::amzn-s3-demo-logging-bucket/AWSLogs/111122223333/* - -###### Enhance security by using precise S3 bucket ARNs. - - * Use the full resource path, not just the S3 bucket ARN. - - * Ensure your S3 bucket ARN includes your AWS account ID. - - * Don't use wildcards (*) in the `elb-account-id` portion of your S3 bucket ARN. - +The S3 bucket name is amzn-s3-demo-logging-bucket. There is no prefix portion in the S3 bucket ARN. @@ -315,0 +293 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` o + arn:aws-us-gov:s3:::amzn-s3-demo-logging-bucket/AWSLogs/123456789012/* @@ -341 +319 @@ The following policy grants permissions to the specified log delivery service. U - "Resource": "arn:aws:s3:::s3-bucket-name/prefix/AWSLogs/elb-account-id/*" + "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/prefix/AWSLogs/123456789012/*", @@ -349 +327 @@ The following policy grants permissions to the specified log delivery service. U -Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. +For `Resource`, enter the ARN of the location for the access logs, using the format shown in the example policy. Always include the account ID of the account with the load balancer in the resource path of the S3 bucket ARN. This ensures that only load balancers from the specified account can write access logs to the S3 bucket. @@ -351 +329 @@ Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with -Ensure your AWS account ID is always included in the resource path of your Amazon S3 bucket ARN. This ensures only Application Load Balancers from the specified AWS account are able to write access logs to the S3 bucket. +The S3 bucket ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. @@ -355 +333 @@ Ensure your AWS account ID is always included in the resource path of your Amazo -The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging-prefix`, and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. +The S3 bucket name is amzn-s3-demo-logging-bucket and the prefix is logging-prefix. @@ -358 +336 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging- - arn:aws:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/111122223333/* + arn:aws:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/123456789012/* @@ -362,13 +340 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging- -The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. - - - arn:aws:s3:::amzn-s3-demo-logging-bucket/AWSLogs/111122223333/* - -###### Enhance security by using precise S3 bucket ARNs. - - * Use the full resource path, not just the S3 bucket ARN. - - * Ensure your S3 bucket ARN includes your AWS account ID. - - * Don't use wildcards (*) in the `elb-account-id` portion of your S3 bucket ARN. - +The S3 bucket name is amzn-s3-demo-logging-bucket. There is no prefix portion in the S3 bucket ARN. @@ -376,0 +343 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` o + arn:aws:s3:::amzn-s3-demo-logging-bucket/AWSLogs/123456789012/*