Description

This detector identifies AWS Application/Network Load Balancers that have access logging disabled. Access logging is a critical security feature that records detailed information about requests sent to the load balancer, which is essential for security analysis, troubleshooting, and audit compliance.

Detection Strategy

• Scans all Application and Network Load Balancers in the specified AWS region

• Checks the load balancer attributes for the 'access_logs.s3.enabled' setting

• Reports a vulnerability if access logging is not configured (attribute missing)

• Reports a vulnerability if access logging is explicitly disabled (attribute value is not 'true')