Skip to main content

​
More Info:

For higher availability and reliability, ELBs should work with cross zone nodes.

​
Risk Level

Low

​
Address

Reliability, Security

​
Compliance Standards

NIST, SOC2, GDPR, HITRUST, NISTCSF

​
Triage and Remediation

  • Remediation

​
Remediation

Using Console

Sure, here are the step-by-step instructions to remediate the ELBs should have cross-zone enabled misconfiguration for AWS using the AWS Console:
  1. Open the AWS Management Console and navigate to the EC2 Dashboard.
  2. From the left-hand menu, select “Load Balancers”.
  3. Select the ELB that you want to remediate.
  4. Click on the “Attributes” tab.
  5. Scroll down to the “Cross-Zone Load Balancing” section and click on the “Edit” button.
  6. Select “Yes” for the “Enable Cross-Zone Load Balancing” option.
  7. Click on the “Save” button to save the changes.
That’s it! You have now successfully remediated the ELBs should have cross-zone enabled misconfiguration for AWS using the AWS Console.

​

To remediate the misconfiguration “ELBs should have cross-zone enabled” in AWS using AWS CLI, follow these steps:
  1. Open the AWS CLI on your local machine.
  2. Run the following command to enable cross-zone load balancing for all existing ELBs in the current region: 
aws elb modify-load-balancer-attributes --load-balancer-name <ELB_NAME> --load-balancer-attributes "{\"CrossZoneLoadBalancing\":{\"Enabled\":true}}"
Replace <ELB_NAME> with the name of the ELB that needs to be remediated.
  1. Run the following command to enable cross-zone load balancing for all new ELBs created in the current region:
aws elb create-lb-cookie-stickiness-policy --load-balancer-name <ELB_NAME> --policy-name "cross-zone-policy" --cookie-expiration-period 60
Replace <ELB_NAME> with the name of the ELB that needs to be remediated.
  1. Verify that cross-zone load balancing is enabled for the ELB by running the following command:
aws elb describe-load-balancer-attributes --load-balancer-name <ELB_NAME> --query 'LoadBalancerAttributes.CrossZoneLoadBalancing.Enabled'
Replace <ELB_NAME> with the name of the ELB that was remediated.
  1. Repeat these steps for all ELBs in the current region that require remediation.
To remediate the misconfiguration of ELBs not having cross-zone enabled in AWS using Python, you can follow the below steps:
  1. Import the necessary libraries:
import boto3
  1. Create an AWS client for Elastic Load Balancing:
elb_client = boto3.client('elbv2')
  1. Get the list of all the ELBs:
elbs = elb_client.describe_load_balancers()
  1. Loop through each ELB and check if cross-zone load balancing is enabled. If not, enable it:
for elb in elbs['LoadBalancers']:
    elb_arn = elb['LoadBalancerArn']
    elb_attributes = elb_client.describe_load_balancer_attributes(LoadBalancerArn=elb_arn)
    if not elb_attributes['Attributes'][0]['Value']:
        elb_client.modify_load_balancer_attributes(
            LoadBalancerArn=elb_arn,
            Attributes=[
                {
                    'Key': 'load_balancing.cross_zone.enabled',
                    'Value': 'true'
                }
            ]
        )
  1. Verify that cross-zone load balancing is enabled for all the ELBs:
for elb in elbs['LoadBalancers']:
    elb_arn = elb['LoadBalancerArn']
    elb_attributes = elb_client.describe_load_balancer_attributes(LoadBalancerArn=elb_arn)
    if not elb_attributes['Attributes'][0]['Value']:
        print(f"{elb['LoadBalancerName']} - Cross-Zone Load Balancing is not Enabled")
    else:
        print(f"{elb['LoadBalancerName']} - Cross-Zone Load Balancing is Enabled")
By following these steps, you can remediate the misconfiguration of ELBs not having cross-zone enabled in AWS using Python.

​
Additional Reading:

⌘I