> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # No Unused ELBs Should Be Present ### More Info: You should not have unused Elastic Load Balancers in your AWS account. Unused ELBs should be deleted to help lower the cost of your monthly AWS bill. ### Risk Level Low ### Address Cost Optimisation ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * HITRUST CSF * ISO/IEC 27017 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration of having no unused ELBs present in AWS, you can follow the below steps: 1. Sign in to the AWS Management Console. 2. Go to the EC2 dashboard. 3. Click on "Load Balancers" from the left-hand menu. 4. Identify any unused ELBs that are present in the list. 5. Select the unused ELB and click on "Actions" and then "Delete". 6. Confirm the deletion by clicking on "Yes, Delete". 7. Repeat the above steps for all unused ELBs that are present. By following these steps, you will be able to remediate the misconfiguration of having no unused ELBs present in AWS. # To remediate the misconfiguration of having unused ELBs in AWS, you can follow the below steps using AWS CLI: 1. List all the ELBs in the AWS account using the following command: ``` aws elb describe-load-balancers ``` 2. Identify the ELBs that are not being used and note down their names. 3. Delete the unused ELBs using the following command: ``` aws elb delete-load-balancer --load-balancer-name ``` 4. Repeat step 3 for all the unused ELBs that you identified in step 2. 5. Verify that all the unused ELBs have been deleted using the following command: ``` aws elb describe-load-balancers ``` This should remediate the misconfiguration of having unused ELBs in AWS. To remediate the misconfiguration "No Unused ELBs Should Be Present" in AWS using Python, you can follow the below steps: 1. Import the required AWS SDK modules using the boto3 library in Python. 2. Use the describe\_load\_balancers() method to list all the load balancers available in your AWS account. 3. Use the describe\_instance\_health() method to check the instances associated with each load balancer and their health status. 4. Identify the unused load balancers by checking if there are any instances associated with them. 5. Use the delete\_load\_balancer() method to delete the unused load balancers. Here's the sample Python code to remediate the misconfiguration "No Unused ELBs Should Be Present" in AWS: ``` import boto3 # Create an EC2 client elb_client = boto3.client('elbv2') # Get all the load balancers in the account response = elb_client.describe_load_balancers() # Loop through each load balancer and check if there are any instances associated with it for lb in response['LoadBalancers']: lb_arn = lb['LoadBalancerArn'] instances = elb_client.describe_target_health(TargetGroupArn=lb_arn) # If there are no instances associated with the load balancer, delete it if len(instances['TargetHealthDescriptions']) == 0: elb_client.delete_load_balancer(LoadBalancerArn=lb_arn) ``` Note: Before running the script, make sure that you have configured the AWS credentials in your environment. ```hcl theme={null} # This example shows an unused Application/Network Load Balancer # that should be removed from Terraform so it can be destroyed. resource "aws_lb" "UNUSED_LB" { name = "UNUSED_LB_NAME" # replace with the unused ALB/NLB name internal = false load_balancer_type = "application" # or "network" subnets = [ aws_subnet.PUBLIC_SUBNET_1.id, aws_subnet.PUBLIC_SUBNET_2.id, ] security_groups = [ aws_security_group.LB_SG.id, ] tags = { Name = "UNUSED_LB_NAME" } } # For a Classic Load Balancer the equivalent would be: resource "aws_elb" "UNUSED_CLASSIC_ELB" { name = "UNUSED_CLASSIC_ELB_NAME" # replace with the unused CLB name subnets = [ aws_subnet.PUBLIC_SUBNET_1.id, aws_subnet.PUBLIC_SUBNET_2.id, ] security_groups = [ aws_security_group.LB_SG.id, ] listener { lb_port = 80 lb_protocol = "HTTP" instance_port = 80 instance_protocol = "HTTP" } tags = { Name = "UNUSED_CLASSIC_ELB_NAME" } } ``` To actually perform the CLI-equivalent remediation in Terraform, you must delete the entire `aws_lb.UNUSED_LB` or `aws_elb.UNUSED_CLASSIC_ELB` resource block(s) from your configuration once you have verified via CloudWatch that the load balancer is truly unused. This is destructive and cannot be undone: on the next `terraform apply`, `terraform plan` should show these load balancers with `-/+` or `-` indicating they are marked for destruction (i.e., `Plan: 0 to add, 0 to change, 2 to destroy` or similar, depending on how many you removed). ### Additional Reading: * [https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-cloudwatch-metrics.html](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-cloudwatch-metrics.html)