Internet Facing ELBs

01 Sign in to the AWS Management Console.

02 Navigate to Amazon EC2 console at https://console.aws.amazon.com/ec2/v2/.

03 In the main navigation panel, under Load Balancing, choose Load Balancers.

04 Click inside the Filter by tags and attributes or search by keyword box, select Type and choose classic to list the Classic Load Balancers available in the current AWS region.

05 Select the Classic Load Balancer that you want to examine.

06 Choose the Description tab from the console bottom panel to view the configuration information available for the selected load balancer.

07 In the Basic Configuration section, check the Schemeconfiguration attribute value. If the attribute value is set to internet-facing, the selected Classic Load Balancer is internet-facing and routes requests from clients over the Internet to the registered EC2 instances, therefore the load balancer must be reviewed from the security standpoint.

08 Repeat steps no. 5 – 7 for each Classic Load Balancer provisioned within the current AWS region.

09 Change the AWS cloud region from the console navigation bar and repeat the Audit process for other regions.

01 Run describe-load-balancers command (OSX/Linux/UNIX) with custom query filters to list the name of each Classic Load Balancer available in the selected AWS region:

aws elb describe-load-balancers
  --region us-east-1
  --output table
  --query 'LoadBalancerDescriptions[*].LoadBalancerName'

02 The command output should return a table with the requested load balancer names:

-------------------------------
|    DescribeLoadBalancers    |
+-----------------------------+
|  cc-web-prod-load-balancer  |
|  cc-frontend-load-balancer  |
+-----------------------------+

03 Run describe-load-balancers command (OSX/Linux/UNIX) using the name of the Classic Load Balancer that you want to examine as the identifier parameter and custom query filters to describe the scheme name used by the selected ELB resource:

aws elb describe-load-balancers
  --region us-east-1
  --load-balancer-name cc-web-prod-load-balancer
  --query 'LoadBalancerDescriptions[*].Scheme'

04 The command output should return the name of the scheme used by the selected load balancer:

[
	"internet-facing"
]

05 Repeat steps no. 3 and 4 to determine the scheme used by other Amazon ELB load balancers available in the current AWS region.

06 Change the AWS cloud region by updating the --region command parameter value and repeat the Audit process for other regions.

01 CloudFormation template (JSON):

{
	"AWSTemplateFormatVersion": "2010-09-09",
	"Resources": {
		"ClassicLoadBalancer": {
			"Type": "AWS::ElasticLoadBalancing::LoadBalancer",
			"Properties": {
				"LoadBalancerName": "cc-internal-prod-load-balancer",
				"SecurityGroups": [
					"sg-0abcd1234abcd1234",
					"sg-01234abcd1234abcd"
				],
				"Subnets": [
					"subnet-01234abcd1234abcd",
					"subnet-0abcd1234abcd1234"
				],
				"Instances": [
					"i-0abcd1234abcd1234",
					"i-01234abcd1234abcd"
				],
				"Listeners": [
					{
						"InstancePort": "8080",
						"InstanceProtocol": "HTTP",
						"LoadBalancerPort": "8080",
						"Protocol": "HTTP",
						"PolicyNames": []
					}
				],
				"AvailabilityZones": [
					"us-east-1a",
					"us-east-1b"
				],
				"Scheme": "internal"
			}
		}
	}
}

02 CloudFormation template (YAML):

AWSTemplateFormatVersion: '2010-09-09'
	Resources:
	ClassicLoadBalancer:
		Type: AWS::ElasticLoadBalancing::LoadBalancer
		Properties:
		LoadBalancerName: cc-internal-prod-load-balancer
		SecurityGroups:
			- sg-0abcd1234abcd1234
			- sg-01234abcd1234abcd
		Subnets:
			- subnet-01234abcd1234abcd
			- subnet-0abcd1234abcd1234
		Instances:
			- i-0abcd1234abcd1234
			- i-01234abcd1234abcd
		Listeners:
			- InstancePort: '8080'
			InstanceProtocol: HTTP
			LoadBalancerPort: '8080'
			Protocol: HTTP
			PolicyNames: []
		AvailabilityZones:
			- us-east-1a
			- us-east-1b
		Scheme: internal

01 Terraform configuration file (.tf):

terraform {
	required_providers {
		aws = {
			source  = "hashicorp/aws"
			version = "~> 4.0"
		}
	}

	required_version = ">= 0.14.9"
}

provider "aws" {
	profile = "default"
	region  = "us-east-1"
}

resource "aws_elb" "aws-load-balancer" {
	name                = "cc-internal-prod-load-balancer"
	instances           = ["i-0abcd1234abcd1234", "i-01234abcd1234abcd"]
	subnets             = ["subnet-01234abcd1234abcd", "subnet-0abcd1234abcd1234"]
	security_groups     = ["sg-0abcd1234abcd1234", "sg-01234abcd1234abcd"]
	availability_zones  = ["us-east-1a", "us-east-1b"]
	listener {
		instance_port     = 8080
		instance_protocol = "http"
		lb_port           = 8080
		lb_protocol       = "http"
	}
	internal            = true

01 Sign in to the AWS Management Console.

02 Navigate to Amazon EC2 console at https://console.aws.amazon.com/ec2/v2/.

03 In the main navigation panel, under Load Balancing, choose Load Balancers.

04 Choose Create Load Balancer from the console top menu to initiate the setup process.

05 On the Select load balancer type page, choose Classic Load Balancer - previous generationto set up a new Classic Load Balancer, then select Createto start the setup.

06 On the load balancer setup page, perform the following operations:

1. For Step 1: Define Load Balancer, provide a unique name for your new load balancer, select the target VPC, select Create an internal load balancer to deploy an internal load balancer, and set up the required listener configuration. Choose Next: Assign Security Groups to continue the setup.
2. For Step 2: Assign Security Groups, choose one or more existing security groups for the new load balancer or create new ones. These security groups should act as a set of firewall rules that control the traffic to your load balancer. Choose Next: Configure Security Settings to continue.
3. For Step 3: Configure Security Settings, create and configure the necessary HTTPS listeners for your new Classic Load Balancer. Choose Next: Configure Health Checkto continue.
4. For Step 4: Configure Health Check, configure the health check settings to meet your specific needs. Choose Next: Add EC2 instances to continue the setup.
5. For Step 5: Add EC2 Instances, add the necessary Amazon EC2 instances to your load balancer. Configure Availability Zone (AZ) distribution. Choose Next: Add EC2 instancesto continue the setup.
6. For Step 6: Add Tags, apply tags to your load balancer to help organize and identify the resource. Choose Review and Create to continue.
7. For Step 7: Review, review your load balancer configuration, then choose Create to deploy your new, internal Classic Load Balancer.
8. Choose Close to return to the Amazon EC2 console.

07 If required, repeat steps no. 4 – 6 to deploy more internal Classic Load Balancer within the current AWS region.

08 Change the AWS cloud region from the console navigation bar and repeat the Remediation process for other regions.

01 Run create-security-group command (OSX/Linux/UNIX) to create the security group that will be used by the internal Classic Load Balancer. The following command example creates a security group named "cc-elb-security-group" inside a VPC identified with the ID vpc-abcd1234abcd1234, available within the US East (N. Virginia) region:

aws ec2 create-security-group
  --region us-east-1
  --group-name cc-elb-security-group
  --description "Classic Load Balancer Security Group"
  --vpc-id vpc-abcd1234abcd234

02 The command output should return the ID of the new security group:

{
	"GroupId": "sg-01234abcd1234abcd"
}

03 Run authorize-security-group-ingress command (OSX/Linux/UNIX) using the group ID returned at the previous step as the identifier parameter, to set up the inbound rules based on your application requirements (the command does not produce an output):

aws ec2 authorize-security-group-ingress
  --region us-east-1
  --group-id sg-01234abcd1234abcd
  --protocol tcp
  --port 8080
  --cidr 0.0.0.0/0

04 Run authorize-security-group-egress command (OSX/Linux/UNIX) using the ID of the newly created security group as the identifier parameter to configure the outbound rules based on your application needs (the command does not return an output):

aws ec2 authorize-security-group-egress
  --region us-east-1
  --group-id sg-01234abcd1234abcd
  --ip-permissions '[{"IpProtocol": "tcp", "FromPort": 8080, "ToPort": 8080, "IpRanges": [{"CidrIp": "0.0.0.0/0"}]}]'

05 Run create-load-balancer command (OSX/Linux/UNIX) to create a new, internal Classic Load Balancer in the selected AWS region:

aws elb create-load-balancer
  --region us-east-1
  --load-balancer-name cc-internal-prod-load-balancer
  --listeners "Protocol=HTTP,LoadBalancerPort=8080,InstanceProtocol=HTTP,InstancePort=8080"
  --subnets "subnet-01234abcd1234abcd" "subnet-0abcd1234abcd1234"
  --security-groups sg-01234abcd1234abcd
  --scheme internal

06 The command output should return the DNS name for the new load balancer:

{
	"DNSName": "cc-internal-prod-load-balancer-123456789012.us-east-1.elb.amazonaws.com"
}

07 Run register-instances-with-load-balancer command (OSX/Linux/UNIX) to register the necessary EC2 instances with the internal Classic Load Balancer created at the previous steps:

aws elb register-instances-with-load-balancer
  --region us-east-1
  --load-balancer-name cc-internal-prod-load-balancer
  --instances i-0abcd1234abcd1234 i-01234abcd1234abcd

08 The command output should return the IDs of the backend instances registered with the new load balancer:

{
	"Instances": [
		{
			"InstanceId": "i-0abcd1234abcd1234"
		},
		{
			"InstanceId": "i-01234abcd1234abcd"
		}
	]
}

09 If required, repeat steps no. 5 – 8 to deploy more internal Classic Load Balancer in the selected AWS region.

10 Change the AWS cloud region by updating the --region command parameter value and repeat the Remediation process for other regions.