AWS elasticloadbalancing high security documentation change
Summary
Updated S3 bucket policy documentation to enforce precise ARNs with account IDs, removed wildcards in account ID portions, added security best practices section, and standardized example configurations
Security assessment
The changes explicitly require including account IDs in S3 ARNs and prohibit wildcards in account ID fields to prevent cross-account access. The added 'Enhance security' section specifically addresses potential misconfigurations that could lead to unauthorized access to log data.
Diff
diff --git a/elasticloadbalancing/latest/classic/enable-access-logs.md b/elasticloadbalancing/latest/classic/enable-access-logs.md index 57deef081..370f51afe 100644 --- a//elasticloadbalancing/latest/classic/enable-access-logs.md +++ b//elasticloadbalancing/latest/classic/enable-access-logs.md @@ -68 +68,12 @@ The bucket policy that you'll use depends on the AWS Region of the bucket. Each -This policy grants permissions to the specified log delivery service. Use this policy for load balancers in Availability Zones and Local Zones in the following Regions: +###### Enhance security by using precise S3 bucket ARNs. + + * Use the full resource path, not just the S3 bucket ARN. + + * Include the account ID portion of the S3 bucket ARN. + + * Don't use wildcards (*) in the account ID portion of the S3 bucket ARN. + + + + +This policy grants permissions to the specified log delivery service. Use this policy for load balancers in the following Regions: @@ -87,0 +99,2 @@ This policy grants permissions to the specified log delivery service. Use this p + * Mexico (Central) + @@ -101 +114 @@ This policy grants permissions to the specified log delivery service. Use this p - "Resource": "arn:aws:s3:::s3-bucket-name/prefix/AWSLogs/elb-account-id/*" + "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/prefix/AWSLogs/123456789012/*" @@ -106 +119 @@ This policy grants permissions to the specified log delivery service. Use this p -Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. +For `Resource`, enter the ARN of the location for the access logs, using the format shown in the example policy. Always include the account ID of the account with the load balancer in the resource path of the S3 bucket ARN. This ensures that only load balancers from the specified account can write access logs to the S3 bucket. @@ -108 +121 @@ Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with -Ensure your AWS account ID is always included in the resource path of your Amazon S3 bucket ARN. This ensures only Application Load Balancers from the specified AWS account are able to write access logs to the S3 bucket. +The S3 bucket ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. @@ -112 +125 @@ Ensure your AWS account ID is always included in the resource path of your Amazo -The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging-prefix`, and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. +The S3 bucket name is amzn-s3-demo-logging-bucket and the prefix is logging-prefix. @@ -115 +128 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging- - arn:aws:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/111122223333/* + arn:aws:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/123456789012/* @@ -119,13 +132 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging- -The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. - - - arn:aws:s3:::amzn-s3-demo-logging-bucket/AWSLogs/111122223333/* - -###### Enhance security by using precise S3 bucket ARNs. - - * Use the full resource path, not just the S3 bucket ARN. - - * Ensure your S3 bucket ARN includes your AWS account ID. - - * Don't use wildcards (*) in the `elb-account-id` portion of your S3 bucket ARN. - +The S3 bucket name is amzn-s3-demo-logging-bucket. There is no prefix portion in the S3 bucket ARN. @@ -133,0 +135 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` o + arn:aws:s3:::amzn-s3-demo-logging-bucket/AWSLogs/123456789012/* @@ -135 +137 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` o -This policy grants permissions to the specified Elastic Load Balancing account ID. Use this policy for load balancers in Availability Zones or Local Zones in the Regions in the list below. +This policy grants permissions to the specified Elastic Load Balancing account. Use this policy for load balancers in the Regions listed below. @@ -147 +149 @@ This policy grants permissions to the specified Elastic Load Balancing account I - "Resource": "arn:aws:s3:::s3-bucket-name/prefix/AWSLogs/elb-account-id/*" + "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/prefix/AWSLogs/123456789012/*" @@ -152 +154 @@ This policy grants permissions to the specified Elastic Load Balancing account I -Replace `elb-account-id` with the ID of the AWS account for Elastic Load Balancing for your Region: +For `Principal`, replace `elb-account-id` with the ID of the Elastic Load Balancing account for the Region of the load balancer: @@ -201 +203 @@ Replace `elb-account-id` with the ID of the AWS account for Elastic Load Balanci -Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. +For `Resource`, enter the ARN of the location for the access logs, using the format shown in the example policy. Always include the account ID of the account with the load balancer in the resource path of the S3 bucket ARN. This ensures that only load balancers from the specified account can write access logs to the S3 bucket. @@ -203 +205 @@ Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with -Ensure your AWS account ID is always included in the resource path of your Amazon S3 bucket ARN. This ensures only Application Load Balancers from the specified AWS account are able to write access logs to the S3 bucket. +The S3 bucket ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. @@ -207 +209 @@ Ensure your AWS account ID is always included in the resource path of your Amazo -The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging-prefix`, and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. +The S3 bucket name is amzn-s3-demo-logging-bucket and the prefix is logging-prefix. @@ -210 +212 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging- - arn:aws:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/111122223333/* + arn:aws:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/123456789012/* @@ -214 +216 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging- -The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and ID of the AWS account with the load balancer is `111122223333`. +The S3 bucket name is `amzn-s3-demo-logging-bucket`. @@ -217 +219 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and ID of the AWS account - arn:aws:s3:::amzn-s3-demo-logging-bucket/AWSLogs/111122223333/* + arn:aws:s3:::amzn-s3-demo-logging-bucket/AWSLogs/123456789012/* @@ -219,12 +221 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and ID of the AWS account -###### Enhance security by using precise S3 bucket ARNs. - - * Use the full resource path, not just the S3 bucket ARN. - - * Ensure your S3 bucket ARN includes your AWS account ID. - - * Don't use wildcards (*) in the `elb-account-id` portion of your S3 bucket ARN. - - - - -This policy grants permissions to the specified Elastic Load Balancing account ID. Use this policy for load balancers in Availability Zones or Local Zones in the AWS GovCloud (US) Regions in the list below. +This policy grants permissions to the specified Elastic Load Balancing account ID. Use this policy for load balancers in the AWS GovCloud (US) Regions. @@ -242 +233 @@ This policy grants permissions to the specified Elastic Load Balancing account I - "Resource": ""arn:aws:s3:::s3-bucket-name/prefix/AWSLogs/elb-account-id/*" + "Resource": "arn:aws-us-gov:s3:::amzn-s3-demo-bucket/prefix/AWSLogs/123456789012/*" @@ -247 +238 @@ This policy grants permissions to the specified Elastic Load Balancing account I -Replace `elb-account-id` with the ID of the AWS account for Elastic Load Balancing for your AWS account Region: +For `Principal`, replace `elb-account-id` with the ID of the Elastic Load Balancing account for the Region of the load balancer: @@ -256 +247 @@ Replace `elb-account-id` with the ID of the AWS account for Elastic Load Balanci -Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with the ARN of the location for your access logs. The ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. +For `Resource`, enter the ARN of the location for the access logs. Always include the account ID of the account with the load balancer in the resource path of the S3 bucket ARN. This ensures that only load balancers from the specified account can write access logs to the S3 bucket. @@ -258 +249 @@ Replace "arn:aws:s3:::`s3-bucket-name`/`prefix`/AWSLogs/`elb-account-id`/*" with -Ensure your AWS account ID is always included in the resource path of your Amazon S3 bucket ARN. This ensures only Application Load Balancers from the specified AWS account are able to write access logs to the S3 bucket. +The S3 bucket ARN that you specify depends on whether you plan to include a prefix when you enable access logs in step 3. @@ -262 +253 @@ Ensure your AWS account ID is always included in the resource path of your Amazo -The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging-prefix`, and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. +The S3 bucket name is amzn-s3-demo-logging-bucket and the prefix is logging-prefix. @@ -265 +256 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging- - arn:aws-us-gov:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/111122223333/* + arn:aws-us-gov:s3:::amzn-s3-demo-logging-bucket/logging-prefix/AWSLogs/123456789012/* @@ -269,13 +260 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket`, the `prefix` is `logging- -The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` of the AWS account with the load balancer is `111122223333`. - - - arn:aws-us-gov:s3:::amzn-s3-demo-logging-bucket/AWSLogs/111122223333/* - -###### Enhance security by using precise S3 bucket ARNs. - - * Use the full resource path, not just the S3 bucket ARN. - - * Ensure your S3 bucket ARN includes your AWS account ID. - - * Don't use wildcards (*) in the `elb-account-id` portion of your S3 bucket ARN. - +The S3 bucket name is `amzn-s3-demo-logging-bucket`. There is no prefix portion in the S3 bucket ARN. @@ -283,0 +263 @@ The `s3-bucket-name` is `amzn-s3-demo-logging-bucket` and the `elb-account-id` o + arn:aws-us-gov:s3:::amzn-s3-demo-logging-bucket/AWSLogs/123456789012/* @@ -324 +304 @@ The bucket must meet the requirements described in step 1, and you must attach a - * URI with a prefix: `s3://`amzn-s3-demo-loadbalancer-logs`/`logging-prefix`` + * URI with a prefix: `s3://`amzn-s3-demo-logging-bucket`/`logging-prefix`` @@ -326 +306 @@ The bucket must meet the requirements described in step 1, and you must attach a - * URI without a prefix: `s3://`amzn-s3-demo-loadbalancer-logs`` + * URI without a prefix: `s3://`amzn-s3-demo-logging-bucket`` @@ -343 +323 @@ First, create a .json file that enables Elastic Load Balancing to capture and de - "S3BucketName": "amzn-s3-demo-loadbalancer-logs", + "S3BucketName": "amzn-s3-demo-logging-bucket", @@ -362 +342 @@ The following is an example response. - "S3BucketName": "amzn-s3-demo-loadbalancer-logs", + "S3BucketName": "amzn-s3-demo-logging-bucket",