Terraform AWS ALB¶
Terraform module which creates Application Load Balancer resources on AWS with target groups, listeners, listener rules, SSL certificates, and WAF integration.
Implemented Controls¶
The following compliance controls are implemented in this module.
- ELB application and classic load balancer logging should be enabled
- ELB load balancers should prohibit public access
- ELB application load balancer deletion protection should be enabled
- ELB application load balancers should be configured with defensive or strictest desync mitigation mode
- ELB application load balancers should be configured to drop HTTP headers
- Application Load Balancer should be configured to drop invalid http headers
- Application and Network Load Balancers with listeners should use recommended security policies
- ELB application and network load balancers should only use SSL or HTTPS listeners
- Application and Network Load Balancer listeners should use secure protocols to encrypt data in transit
- ELB network load balancers should have TLS listener security policy configured
- ELB listeners SSL/TLS protocol version should be checked
Compliance.tf registry endpoints¶
module "alb" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "acscism2023.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "awscontroltower.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "awsgenai.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "cccsmedium.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "cfrpart11.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "cis.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "cisv500.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "cisv600.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "cisv80ig1.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "cisacyberessentials.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "eugmpannex11.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "fedramplow.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "fedrampmoderate.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "ffiec.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "gdpr.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "hipaa.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "iso27001.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "nist800171.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "nist80053.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "nistcsf.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "nydfs23.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "pcidss.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "rbicybersecurity.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "rbiitfnbfc.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
module "alb" {
source = "soc2.compliance.tf/terraform-aws-modules/alb/aws"
version = "<version>"
# ... your arguments here
}
See the Technical Usage Guide to get started and read the Features section for more details on how to customize the module for your requirements.
Mapped compliance frameworks¶
ISM-0260: Using web proxies
- ELB application and classic load balancer logging should be enabled
- ELB application load balancer deletion protection should be enabled
- ELB application load balancers should be configured to drop HTTP headers
- Application Load Balancer should be configured to drop invalid http headers
- ELB application and network load balancers should only use SSL or HTTPS listeners
- ELB application and classic load balancer logging should be enabled
- ELB application load balancer deletion protection should be enabled
- ELB application load balancers should be configured to drop HTTP headers
- Application Load Balancer should be configured to drop invalid http headers
- ELB application and network load balancers should only use SSL or HTTPS listeners
6.2.4: Bespoke and custom software are developed securely.