Terraform AWS ELB

Classic Load Balancers with listeners, health checks, SSL certificates, cross zone balancing, connection draining, access logging, and security group controlled ingress.

Controls enforced

These compliance controls are checked at terraform plan time.

Classic Load Balancers should have connection draining enabled(low effort)
ELB classic load balancers should have cross-zone load balancing enabled(low effort)
ELB classic load balancers should be configured with defensive or strictest desync mitigation mode(low effort)
ELB classic load balancers should span multiple availability zones(low effort)

Quick start

module "elb" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/elb/aws"
  version = "1.0"

  # ... your arguments here
}

module "elb" {
  source  = "rbiitfnbfc.compliance.tf/terraform-aws-modules/elb/aws"
  version = "1.0"

  # ... your arguments here
}

module "elb" {
  source  = "acscessentialeight.compliance.tf/terraform-aws-modules/elb/aws"
  version = "1.0"

  # ... your arguments here
}

module "elb" {
  source  = "awswellarchitected.compliance.tf/terraform-aws-modules/elb/aws"
  version = "1.0"

  # ... your arguments here
}

module "elb" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/elb/aws"
  version = "1.0"

  # ... your arguments here
}

module "elb" {
  source  = "cisacyberessentials.compliance.tf/terraform-aws-modules/elb/aws"
  version = "1.0"

  # ... your arguments here
}

module "elb" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/elb/aws"
  version = "1.0"

  # ... your arguments here
}

module "elb" {
  source  = "fedramplow.compliance.tf/terraform-aws-modules/elb/aws"
  version = "1.0"

  # ... your arguments here
}

See the Get Started guide and Registry Endpoints for details on how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "elb" {
  source  = "terraform-aws-modules/elb/aws"
  version = "1.0"
}

module "elb" {
  source  = "soc2.compliance.tf/terraform-aws-modules/elb/aws"
  version = "1.0"
}

Same arguments. Same outputs. Controls are checked at terraform plan. See the Migration Guide for step-by-step instructions.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "elb" {
  source  = "terraform-aws-modules/elb/aws"
}

Run terraform init -upgrade. Terraform state is unchanged — same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Mapped compliance frameworks

ID.BE-5

ELB classic load balancers should have cross-zone load balancing enabled

PR.DS-4

PR.PT-5

ELB classic load balancers should have cross-zone load balancing enabled

8.1 IT Systems

ACSC-EE-ML2-7.7: Multi-factor authentication ML2

ELB classic load balancers should be configured with defensive or strictest desync mitigation mode

REL13-BP05: Automate recovery

ELB classic load balancers should span multiple availability zones

11.10(a) Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records

ELB classic load balancers should have cross-zone load balancing enabled

Your Systems-3

ELB classic load balancers should have cross-zone load balancing enabled

16 Business Continuity

ELB classic load balancers should have cross-zone load balancing enabled

Denial Of Service Protection (SC-5)

ELB classic load balancers should have cross-zone load balancing enabled

Framework coverage

Which controls from this module are active under each framework endpoint.

Control	Cybersecurity Framework v2.0	Well-Architected Framework v10	CISA Cyber Essentials	RBI IT Framework for NBFCs	ACSC Essential Eight	Title 21 CFR Part 11	EU GMP Annex 11	FedRAMP Low Baseline Rev 4
Classic Load Balancers should have connection draining enabled	○	○	○	○	○	○	○	○
ELB classic load balancers should have cross-zone load balancing enabled	●	○	●	●	○	●	●	●
ELB classic load balancers should be configured with defensive or strictest desync mitigation mode	○	○	○	○	●	○	○	○
ELB classic load balancers should span multiple availability zones	●	●	○	●	○	○	○	○

● enforced by default · ○ not activated by this endpoint