> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Internet Facing ELBs Should Be Regularly Reviewed

### More Info:

All Amazon internet-facing load balancers (Classic Load Balancers and Application Load Balancers) provisioned within your AWS account should be regularly reviewed for security purposes.

### Risk Level

Low

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        The following are the step by step instructions to remediate the misconfiguration "Internet Facing ELBs Should Be Regularly Reviewed" in AWS using the AWS console:

        1. Log in to the AWS Management Console.
        2. Navigate to the EC2 service.
        3. Click on the "Load Balancers" option in the left-hand menu.
        4. Select the Internet-facing ELB that needs to be reviewed.
        5. Click on the "Listeners" tab.
        6. Review the protocol and port configuration for each listener. Ensure that they are configured according to your organization's security policies.
        7. Click on the "Security" tab.
        8. Review the security groups associated with the ELB. Ensure that only necessary ports are open and that the source IP ranges are restricted to only authorized IPs.
        9. Click on the "Instances" tab.
        10. Review the instances associated with the ELB. Ensure that they are running the latest security patches and that they are not exposing any unnecessary services.
        11. Click on the "Health Check" tab.
        12. Review the health check configuration. Ensure that it is configured according to your organization's security policies.
        13. Click on the "Attributes" tab.
        14. Review the attributes associated with the ELB. Ensure that they are configured according to your organization's security policies.
        15. Make any necessary changes to the ELB configuration.
        16. Click on the "Save" button to save the changes.

        By following the above steps, the misconfiguration "Internet Facing ELBs Should Be Regularly Reviewed" can be remediated in AWS using the AWS console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration for AWS using AWS CLI, follow these steps:

        1. Open the AWS CLI and run the following command to list all the internet-facing Elastic Load Balancers (ELBs) in your account:

           ```
           aws elbv2 describe-load-balancers --query "LoadBalancers[?Scheme=='internet-facing'].LoadBalancerArn" --output text
           ```

        2. Review the output and identify any ELBs that are no longer needed or should not be internet-facing.

        3. For each internet-facing ELB that needs to be reviewed, run the following command to modify the scheme to internal:

           ```
           aws elbv2 modify-load-balancer-attributes --load-balancer-arn <ELB_ARN> --attributes Key=scheme,Value=internal
           ```

           Replace `<ELB_ARN>` with the ARN of the ELB that needs to be modified.

        4. Verify that the ELB's scheme has been changed to internal by running the following command:

           ```
           aws elbv2 describe-load-balancers --load-balancer-arns <ELB_ARN> --query "LoadBalancers[0].Scheme" --output text
           ```

           Replace `<ELB_ARN>` with the ARN of the ELB that was modified.

        5. Repeat steps 3-4 for each internet-facing ELB that needs to be reviewed.

        6. Once all internet-facing ELBs have been reviewed and modified, run the first command again to verify that all internet-facing ELBs have been remediated.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of Internet Facing ELBs in AWS, you can use the following Python script:

        ```
        import boto3

        # Create a boto3 client for ELB
        elb_client = boto3.client('elbv2')

        # Define the ELB ARN
        elb_arn = 'arn:aws:elasticloadbalancing:us-west-2:123456789012:loadbalancer/app/my-load-balancer/50dc6c495c0c9188'

        # Set the desired security group ID
        security_group_id = 'sg-1234567890abcdef'

        # Update the ELB security group
        response = elb_client.set_security_groups(
            LoadBalancerArn=elb_arn,
            SecurityGroups=[
                security_group_id,
            ]
        )

        # Print the response
        print(response)
        ```

        This script uses the boto3 library to create a client for Elastic Load Balancing (ELB) in AWS. It then sets the desired security group ID for the specified ELB ARN using the `set_security_groups` function. Finally, it prints the response from the API call.

        To use this script, replace the `elb_arn` and `security_group_id` values with the appropriate values for your environment. You can then run the script to remediate the misconfiguration of Internet Facing ELBs in AWS.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Application / Network Load Balancer (ELBv2) – change scheme to internal
        resource "aws_lb" "THIS_LOAD_BALANCER" {
          name               = "REPLACE_WITH_LB_NAME"
          internal           = true            # sets scheme=internal instead of internet-facing
          load_balancer_type = "application"  # or "network"
          subnets            = [AWS_SUBNET_ID_1, AWS_SUBNET_ID_2]

          security_groups = [AWS_SECURITY_GROUP_ID]

          # other arguments as required...
        }
        ```

        ```hcl theme={null}
        # Classic Load Balancer (ELBv1) – must be recreated as internal
        resource "aws_elb" "THIS_CLASSIC_LB" {
          name   = "REPLACE_WITH_LB_NAME"
          subnets = [AWS_SUBNET_ID_1, AWS_SUBNET_ID_2]

          internal = true  # creates an internal Classic Load Balancer

          listener {
            instance_port     = 80
            instance_protocol = "http"
            lb_port           = 80
            lb_protocol       = "http"
          }

          # other arguments as required...
        }
        ```

        * Substitute:
          * `THIS_LOAD_BALANCER` / `THIS_CLASSIC_LB` with your Terraform resource names.
          * `REPLACE_WITH_LB_NAME` with the actual load balancer name.
          * `AWS_SUBNET_ID_*` with subnet IDs.
          * `AWS_SECURITY_GROUP_ID` with the security group ID for ALB/NLB.

        Changing `internal` from `false` (internet-facing) to `true` forces replacement of the load balancer for both `aws_lb` and `aws_elb`, causing downtime while the old load balancer is destroyed and the new internal one is created. This matches the CLI remediation, which changes the scheme to `internal` and makes the load balancer inaccessible from the internet.

        Verification: `terraform plan` should show the existing load balancer resource being destroyed and a new one created with `internal = true` (scheme `internal`) and no other unexpected changes.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-internet-facing-load-balancers.html](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-internet-facing-load-balancers.html)