AWS elasticloadbalancing documentation change
Summary
Added section 'Prevent users from creating Classic Load Balancers' with an IAM policy example to block Classic LB creation
Security assessment
Introduces a security control to enforce migration to newer load balancer types via IAM policies. While proactive, there is no evidence this addresses an active security vulnerability. It documents a security best practice for limiting legacy resource usage.
Diff
diff --git a/elasticloadbalancing/latest/userguide/migrate-classic-load-balancer.md b/elasticloadbalancing/latest/userguide/migrate-classic-load-balancer.md index 33a2f154a..e37195755 100644 --- a//elasticloadbalancing/latest/userguide/migrate-classic-load-balancer.md +++ b//elasticloadbalancing/latest/userguide/migrate-classic-load-balancer.md @@ -5 +5 @@ -Benefits of migratingMigration wizardCopy utility migrationManual migration +Benefits of migratingMigration wizardCopy utility migrationManual migrationPrevent users from creating Classic Load Balancers @@ -240,0 +241,23 @@ You can delete the old Classic Load Balancer after: +## Prevent users from creating Classic Load Balancers + +You can create an IAM policy that prevents users from creating Classic Load Balancers in your account. + +Both the [Elastic Load Balancing V2](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticloadbalancingv2.html) and [Elastic Load Balancing V1](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticloadbalancing.html) APIs provide a `CreateLoadBalancer` API action. When you create a Classic Load Balancer, you use the V1 API action, which creates both the load balancer and listeners. When you create an Application Load Balancer, Network Load Balancer, or Gateway Load Balancer, you use the V2 API action, which creates only the load balancer. The V2 API provides a `CreateListener` action, which you use to create listeners for a load balancer after you create it. + +The following policy denies users permission to create a load balancer if the listener protocol is specified. Because you must configure at least one listener when you create a Classic Load Balancer, this policy prevents users from creating Classic Load Balancers. It does not prevent users from creating other types of load balancers, because there are separate API actions for creating those load balancers and their listeners. + + + { + "Version": "2012-10-17", + "Effect": "Deny", + "Action": "elasticloadbalancing:CreateLoadBalancer", + "Resource": [ + "arn:aws:elasticloadbalancing:*:*:loadbalancer/*" + ], + "Condition": { + "Null": { + "elasticloadbalancing:ListenerProtocol": false + } + } + } +