AWS elasticloadbalancing documentation change
Summary
Added documentation for new ALB access log fields related to request transforms (transformed_host, transformed_uri, request_transform_status) and associated transform status codes. Updated log examples to demonstrate new fields.
Security assessment
The changes add logging capabilities for request transformation features, which helps with auditing and debugging of URL/host header rewrites. While this improves visibility into ALB behavior, there is no evidence it addresses a specific security vulnerability. Enhanced logging can support security monitoring but is not itself a security fix.
Diff
diff --git a/elasticloadbalancing/latest/application/load-balancer-access-logs.md b/elasticloadbalancing/latest/application/load-balancer-access-logs.md index 2c39abd5d..d479be37f 100644 --- a//elasticloadbalancing/latest/application/load-balancer-access-logs.md +++ b//elasticloadbalancing/latest/application/load-balancer-access-logs.md @@ -124,0 +125,2 @@ Elastic Load Balancing logs requests on a best-effort basis. We recommend that y + * Transform status codes + @@ -155 +157 @@ sent_bytes (12) | The size of the response, in bytes, sent to the client (reque -"request" (13) | The request line from the client, enclosed in double quotes and logged using the following format: HTTP method + protocol://host:port/uri + HTTP version. The load balancer preserves the URL sent by the client, as is, when recording the request URI. It does not set the content type for the access log file. When you process this field, consider how the client sent the URL. +"request_line" (13) | The request line from the client, enclosed in double quotes and logged using the following format: HTTP method + protocol://host:port/uri + HTTP version. The load balancer preserves the URL sent by the client, as is, when recording the request URI. It does not set the content type for the access log file. When you process this field, consider how the client sent the URL. @@ -172,0 +175,16 @@ conn_trace_id (30) | The connection traceability ID is a **unique opaque ID** u +"transformed_host" (31) | The host header after it is modified by a host header rewrite transform. If any of the following are true, this value is set to -. + + * No transform was applied + * The transform failed + * The transform succeeded by there was no change to the host header + * There is no original host header (for example, HTTP/1.0 requests) + + +"transformed_uri" (32) | The URI after it is modified by a URL rewrite transform. If any of the following are true, this value is set to -. + + * No transform was applied + * The transform failed + * The transform succeeded by there was no change to the URI + + +"request_transform_status" (33) | The status of the rewrite transform. If no rewrite transform was applied, this value is set to -. Otherwise, this value is one of the status values described in Transform status codes. @@ -185,0 +204,2 @@ The load balancer stores the actions that it takes in the actions_executed field + * `rewrite` — The load balancer rewrote the request URL, as specified by the rule configuration. + @@ -289,0 +310,13 @@ Code | Description +### Transform status codes + +Code | Description +---|--- +`TransformBufferTooSmall` | The rewrite transform failed because the result exceeded the size of an internal buffer. Try to make the regular expression less complex. +`TransformCompileError` | The compilation of the regular expression failed. +`TransformCompileTooBig` | The compiled regular expression was too large. Try to make the regular expression less complex. +`TransformInvalidHost` | The host header rewrite transform failed because the resulting host is not valid. +`TransformInvalidPath` | The URL rewrite transform failed because the resulting path is not valid. +`TransformRegexSyntaxError` | The regular expression contained a syntax error. +`TransformReplaceError` | The transform replacement failed. +`TransformSuccess` | The rewrite transform completed successfully. + @@ -304 +337,2 @@ The following is an example log entry for an HTTP listener (port 80 to port 80): - 0 2018-07-02T22:22:48.364000Z "forward" "-" "-" "10.0.0.1:80" "200" "-" "-" TID_1234abcd5678ef90 + 0 2018-07-02T22:22:48.364000Z "forward" "-" "-" "10.0.0.1:80" "200" "-" "-" + TID_1234abcd5678ef90 "-" "-" "-" @@ -316 +350,2 @@ The following is an example log entry for an HTTPS listener (port 443 to port 80 - 1 2018-07-02T22:22:48.364000Z "authenticate,forward" "-" "-" "10.0.0.1:80" "200" "-" "-" TID_1234abcd5678ef90 + 1 2018-07-02T22:22:48.364000Z "authenticate,forward" "-" "-" "10.0.0.1:80" "200" "-" "-" + TID_1234abcd5678ef90 "m.example.com" "-" "TransformSuccess" @@ -328 +363,2 @@ The following is an example log entry for an HTTP/2 stream. - 1 2018-07-02T22:22:48.364000Z "redirect" "https://example.com:80/" "-" "10.0.0.66:9000" "200" "-" "-" TID_1234abcd5678ef90 + 1 2018-07-02T22:22:48.364000Z "redirect" "https://example.com:80/" "-" "10.0.0.66:9000" "200" "-" "-" + TID_1234abcd5678ef90 "-" "-" "-" @@ -340 +376,2 @@ The following is an example log entry for a WebSockets connection. - 1 2018-07-02T22:22:48.364000Z "forward" "-" "-" "10.0.1.192:8010" "101" "-" "-" TID_1234abcd5678ef90 + 1 2018-07-02T22:22:48.364000Z "forward" "-" "-" "10.0.1.192:8010" "101" "-" "-" + TID_1234abcd5678ef90 "-" "-" "-" @@ -352 +389,2 @@ The following is an example log entry for a secured WebSockets connection. - 1 2018-07-02T22:22:48.364000Z "forward" "-" "-" "10.0.0.171:8010" "101" "-" "-" TID_1234abcd5678ef90 + 1 2018-07-02T22:22:48.364000Z "forward" "-" "-" "10.0.0.171:8010" "101" "-" "-" + TID_1234abcd5678ef90 "-" "-" "-" @@ -364 +402,2 @@ The following is an example log entry for a request to a Lambda function that su - 0 2018-11-30T22:22:48.364000Z "forward" "-" "-" "-" "-" "-" "-" TID_1234abcd5678ef90 + 0 2018-11-30T22:22:48.364000Z "forward" "-" "-" "-" "-" "-" "-" + TID_1234abcd5678ef90 "-" "-" "-" @@ -374 +413,2 @@ The following is an example log entry for a request to a Lambda function that fa - 0 2018-11-30T22:22:48.364000Z "forward" "-" "LambdaInvalidResponse" "-" "-" "-" "-" TID_1234abcd5678ef90 + 0 2018-11-30T22:22:48.364000Z "forward" "-" "LambdaInvalidResponse" "-" "-" "-" "-" + TID_1234abcd5678ef90 "-" "-" "-"