AWS elasticloadbalancing high security documentation change
Summary
Updated S3 bucket policy guidance to enforce precise ARN formatting, added account ID requirements, removed wildcards in resource paths, added Mexico (Central) region, and expanded examples/security considerations for access logging configurations.
Security assessment
The changes explicitly address security risks by mandating specific account IDs in S3 ARNs (e.g., replacing 'aws-account-id/*' with '123456789012/*'), prohibiting wildcards in account ID fields, and adding warnings about NotPrincipal usage. These changes prevent bucket policy misconfigurations that could allow unauthorized cross-account access to sensitive logs. The emphasis on exact resource paths reduces the risk of privilege escalation via overly permissive policies.
Diff
diff --git a/elasticloadbalancing/latest/application/enable-connection-logging.md b/elasticloadbalancing/latest/application/enable-connection-logging.md index c4aed63f1..12bd68e78 100644 --- a//elasticloadbalancing/latest/application/enable-connection-logging.md +++ b//elasticloadbalancing/latest/application/enable-connection-logging.md @@ -68 +68,12 @@ The bucket policy that you'll use depends on the AWS Region and the type of zone -This policy grants permissions to the specified log delivery service. Use this policy for load balancers in Availability Zones and Local Zones in the following Regions: +###### Enhance security by using precise S3 bucket ARNs. + + * Use the full resource path, not just the S3 bucket ARN. + + * Include the account ID portion of the S3 bucket ARN. + + * Don't use wildcards (*) in the account ID portion of the S3 bucket ARN. + + + + +This policy grants permissions to the specified log delivery service. Use this policy for load balancers in the following Regions: @@ -87,0 +99,2 @@ This policy grants permissions to the specified log delivery service. Use this p + * Mexico (Central) + @@ -101 +114 @@ This policy grants permissions to the specified log delivery service. Use this p - "Resource": "arn:aws:s3:::bucket-name/prefix/AWSLogs/aws-account-id/*" + "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/prefix/AWSLogs/123456789012/*" @@ -106 +119,34 @@ This policy grants permissions to the specified log delivery service. Use this p -This policy grants permissions to the specified Elastic Load Balancing account ID. Use this policy for load balancers in Availability Zones or Local Zones in the Regions in the list below. +For `Resource`, enter the ARN of the location for the access logs, using the format shown in the example policy. Always include the account ID of the account with the load balancer in the resource path of the S3 bucket ARN. This ensures that only load balancers from the specified account can write access logs to the S3 bucket. + +The S3 bucket ARN that you specify depends on whether you plan to include a prefix when you enable access logs in [step 3](./enable-access-logging.html#enable-access-logs). + +###### Example S3 bucket ARN with a prefix + +The S3 bucket name is amzn-s3-demo-logging-bucket and the prefix is logging-prefix. + + + arn:aws:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/123456789012/* + +###### Example S3 bucket ARN with no prefix + +The S3 bucket name is amzn-s3-demo-logging-bucket. There is no prefix portion in the S3 bucket ARN. + + + arn:aws:s3:::amzn-s3-demo-logging-bucket/AWSLogs/123456789012/* + +###### Using NotPrincipal when Effect is Deny + +If the Amazon S3 bucket policy uses `Effect` with the value `Deny` and includes `NotPrincipal` as shown in the example below, ensure that `logdelivery.elasticloadbalancing.amazonaws.com` is included in the `Service` list. + + + { + "Effect": "Deny", + "NotPrincipal": { + "Service": [ + "logdelivery.elasticloadbalancing.amazonaws.com", + "example.com" + ] + } + }, + +This policy grants permissions to the specified Elastic Load Balancing account. Use this policy for load balancers in the Regions listed below. @@ -118 +164 @@ This policy grants permissions to the specified Elastic Load Balancing account I - "Resource": "arn:aws:s3:::s3-bucket-name/prefix/AWSLogs/elb-account-id/*" + "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/prefix/AWSLogs/123456789012/*" @@ -123 +169 @@ This policy grants permissions to the specified Elastic Load Balancing account I -Replace `elb-account-id` with the ID of the AWS account for Elastic Load Balancing for your Region: +For `Principal`, replace `elb-account-id` with the ID of the Elastic Load Balancing account for the Region of the load balancer: @@ -172 +218 @@ Replace `elb-account-id` with the ID of the AWS account for Elastic Load Balanci -Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with the ARN of the location for your connection logs. The ARN that you specify depends on whether you plan to specify a prefix when you enable connection logs in step 3. +For `Resource`, enter the ARN of the location for the access logs, using the format shown in the example policy. Always include the account ID of the account with the load balancer in the resource path of the S3 bucket ARN. This ensures that only load balancers from the specified account can write access logs to the S3 bucket. @@ -174 +220 @@ Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with -Ensure your AWS account ID is always included in the resource path of your Amazon S3 bucket ARN. This ensures only Application Load Balancers from the specified AWS account are able to write access logs to the S3 bucket. +The S3 bucket ARN that you specify depends on whether you plan to include a prefix when you enable access logs in [step 3](./enable-access-logging.html#enable-access-logs). @@ -178 +224 @@ Ensure your AWS account ID is always included in the resource path of your Amazo -The `s3-bucket-name` is amzn-s3-demo-logging-bucket, the `prefix` is `logging-prefix` and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. +The S3 bucket name is amzn-s3-demo-logging-bucket and the prefix is logging-prefix. @@ -181 +227 @@ The `s3-bucket-name` is amzn-s3-demo-logging-bucket, the `prefix` is `logging-pr - arn:aws:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/111122223333/* + arn:aws:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/123456789012/* @@ -185 +231 @@ The `s3-bucket-name` is amzn-s3-demo-logging-bucket, the `prefix` is `logging-pr -The `s3-bucket-name` is amzn-s3-demo-logging-bucket and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. +The S3 bucket name is amzn-s3-demo-logging-bucket. There is no prefix portion in the S3 bucket ARN. @@ -188 +234 @@ The `s3-bucket-name` is amzn-s3-demo-logging-bucket and the `elb-account-id` of - arn:aws:s3:::amzn-s3-demo-logging-bucket/AWSLogs/111122223333/* + arn:aws:s3:::amzn-s3-demo-logging-bucket/AWSLogs/123456789012/* @@ -190 +236 @@ The `s3-bucket-name` is amzn-s3-demo-logging-bucket and the `elb-account-id` of -This policy grants permissions to the specified Elastic Load Balancing account ID. Use this policy for load balancers in Availability Zones or Local Zones in the AWS GovCloud (US) Regions in the list below. +This policy grants permissions to the specified Elastic Load Balancing account. Use this policy for load balancers in Availability Zones or Local Zones in the AWS GovCloud (US) Regions in the list below. @@ -202 +248 @@ This policy grants permissions to the specified Elastic Load Balancing account I - "Resource": "arn:aws:s3:::s3-bucket-name/prefix/AWSLogs/elb-account-id/*" + "Resource": "arn:aws-us-gov:s3:::amzn-s3-demo-bucket/prefix/AWSLogs/123456789012/*" @@ -207 +253 @@ This policy grants permissions to the specified Elastic Load Balancing account I -Replace `elb-account-id` with the ID of the AWS account for Elastic Load Balancing for your AWS GovCloud (US) Region: +For `Principal` replace `elb-account-id` with the ID of the Elastic Load Balancing account for the Region of the load balancer: @@ -216 +262 @@ Replace `elb-account-id` with the ID of the AWS account for Elastic Load Balanci -Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with the ARN of the bucket for your access logs. +For `Resource`, enter the ARN of the location for the access logs, using the format shown in the example policy. Always include the account ID of the account with the load balancer in the resource path of the S3 bucket ARN. The ensures that you load balancers from the specified account can write access logs to teh S3 bucket. @@ -218 +264 @@ Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with -Ensure your AWS account ID is always included in the resource path of your Amazon S3 bucket ARN. This ensures only Application Load Balancers from the specified AWS account are able to write access logs to the S3 bucket. +The S3 bucket ARN that you specify depends on whether you plan to include a prefix when you enable access logs. @@ -222 +268 @@ Ensure your AWS account ID is always included in the resource path of your Amazo -The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging-prefix`, and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. +The S3 bucket name is amzn-s3-demo-logging-bucket and the prefix is logging-prefix. @@ -225 +271 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging- - arn:aws-us-gov:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/111122223333/* + arn:aws-us-gov:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/123456789012/* @@ -229 +275,4 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging- -The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. +The S3 bucket name is amzn-s3-demo-logging-bucket. There is no prefix portion in the S3 bucket ARN. + + + arn:aws-us-gov:s3:::amzn-s3-demo-logging-bucket/AWSLogs/123456789012/* @@ -230,0 +280 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` o +The following policy grants permissions to the specified log delivery service. Use this policy for load balancers in Outposts Zones. @@ -232 +282,47 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` o - arn:aws-us-gov:s3:::amzn-s3-demo-logging-bucket/AWSLogs/111122223333/* + + { + "Effect": "Allow", + "Principal": { + "Service": "logdelivery.elb.amazonaws.com" + }, + "Action": "s3:PutObject", + "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/prefix/AWSLogs/123456789012/*" + "Condition": { + "StringEquals": { + "s3:x-amz-acl": "bucket-owner-full-control" + } + } + } + +For `Resource`, enter the ARN of the location for the access logs. Always include the account ID of the account with the load balancer in the resource path of the S3 bucket ARN. This ensures that only load balancers from the specified account can write access logs to the S3 bucket. + +The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in [step 3](./enable-access-logging.html#enable-access-logs). + +###### Example S3 bucket ARN with a prefix + +The S3 bucket name is amzn-s3-demo-logging-bucket and the prefix is logging-prefix. + + + arn:aws:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/123456789012/* + +###### Example S3 bucket ARN with no prefix + +The S3 bucket name is amzn-s3-demo-logging-bucket. There is no prefix portion in the S3 bucket ARN. + + + arn:aws:s3:::amzn-s3-demo-logging-bucket/AWSLogs/123456789012/* + +###### Using NotPrincipal when Effect is Deny + +If the Amazon S3 bucket policy uses `Effect` with the value `Deny` and includes `NotPrincipal` as shown in the example below, ensure that `logdelivery.elasticloadbalancing.amazonaws.com` is included in the `Service` list. + + + { + "Effect": "Deny", + "NotPrincipal": { + "Service": [ + "logdelivery.elasticloadbalancing.amazonaws.com", + "example.com" + ] + } + },