aws.elbv2 resources¶
aws.app-elb¶
Resource manager for v2 ELBs (AKA ALBs and NLBs).
Filters¶
default-vpc¶
Filter all ELB that exist within the default vpc
- example
policies:
- name: appelb-in-default-vpc
resource: app-elb
filters:
- default-vpc
properties:
type:
enum:
- default-vpc
required:
- type
healthcheck-protocol-mismatch¶
Filter AppELBs with mismatched health check protocols
A mismatched health check protocol is where the protocol on the target group does not match the load balancer health check protocol
- example
policies:
- name: appelb-healthcheck-mismatch
resource: app-elb
filters:
- healthcheck-protocol-mismatch
properties:
type:
enum:
- healthcheck-protocol-mismatch
required:
- type
is-logging¶
- Matches AppELBs that are logging to S3.
bucket and prefix are optional
- example
policies:
- name: alb-is-logging-test
resource: app-elb
filters:
- type: is-logging
- name: alb-is-logging-bucket-and-prefix-test
resource: app-elb
filters:
- type: is-logging
bucket: prodlogs
prefix: alblogs
properties:
bucket:
type: string
prefix:
type: string
type:
enum:
- is-logging
required:
- type
is-not-logging¶
- Matches AppELBs that are NOT logging to S3.
or do not match the optional bucket and/or prefix.
- example
policies:
- name: alb-is-not-logging-test
resource: app-elb
filters:
- type: is-not-logging
- name: alb-is-not-logging-bucket-and-prefix-test
resource: app-elb
filters:
- type: is-not-logging
bucket: prodlogs
prefix: alblogs
properties:
bucket:
type: string
prefix:
type: string
type:
enum:
- is-not-logging
required:
- type
listener¶
Filter ALB based on matching listener attributes
Adding the matched flag will filter on previously matched listeners
- example
policies:
- name: app-elb-invalid-ciphers
resource: app-elb
filters:
- type: listener
key: Protocol
value: HTTPS
- type: listener
key: SslPolicy
value: ['ELBSecurityPolicy-TLS-1-1-2017-01','ELBSecurityPolicy-TLS-1-2-2017-01']
op: ni
matched: true
actions:
- type: modify-listener
sslpolicy: "ELBSecurityPolicy-TLS-1-2-2017-01"
properties:
default:
type: object
key:
type: string
matched:
type: boolean
op:
enum:
- eq
- equal
- ne
- not-equal
- gt
- greater-than
- ge
- gte
- le
- lte
- lt
- less-than
- glob
- regex
- regex-case
- in
- ni
- not-in
- contains
- difference
- intersect
type:
enum:
- listener
value:
oneOf:
- type: array
- type: string
- type: boolean
- type: number
- type: 'null'
value_from:
additionalProperties: 'False'
properties:
expr:
oneOf:
- type: integer
- type: string
format:
enum:
- csv
- json
- txt
- csv2dict
url:
type: string
required:
- url
type: object
value_regex:
type: string
value_type:
enum:
- age
- integer
- expiration
- normalize
- size
- cidr
- cidr_size
- swap
- resource_count
- expr
- unique_size
- date
required:
- type
shield-enabled¶
properties:
state:
type: boolean
type:
enum:
- shield-enabled
required:
- type
target-group¶
Filter ALB based on matching target group value
properties:
default:
type: object
key:
type: string
op:
enum:
- eq
- equal
- ne
- not-equal
- gt
- greater-than
- ge
- gte
- le
- lte
- lt
- less-than
- glob
- regex
- regex-case
- in
- ni
- not-in
- contains
- difference
- intersect
type:
enum:
- target-group
value:
oneOf:
- type: array
- type: string
- type: boolean
- type: number
- type: 'null'
value_from:
additionalProperties: 'False'
properties:
expr:
oneOf:
- type: integer
- type: string
format:
enum:
- csv
- json
- txt
- csv2dict
url:
type: string
required:
- url
type: object
value_regex:
type: string
value_type:
enum:
- age
- integer
- expiration
- normalize
- size
- cidr
- cidr_size
- swap
- resource_count
- expr
- unique_size
- date
required:
- type
waf-enabled¶
properties:
state:
type: boolean
type:
enum:
- waf-enabled
web-acl:
type: string
required:
- type
Actions¶
delete¶
Action to delete an ELB
To avoid unwanted deletions of ELB, it is recommended to apply a filter to the rule
- example
policies:
- name: appelb-delete-failed-elb
resource: app-elb
filters:
- State: failed
actions:
- delete
properties:
force:
type: boolean
type:
enum:
- delete
required:
- type
modify-listener¶
Action to modify the policy for an App ELB
- example
policies:
- name: appelb-modify-listener
resource: app-elb
filters:
- type: listener
key: Protocol
value: HTTP
actions:
- type: modify-listener
protocol: HTTPS
sslpolicy: "ELBSecurityPolicy-TLS-1-2-2017-01"
certificate: "arn:aws:acm:region:123456789012:certificate/12345678- 1234-1234-1234-123456789012"
properties:
certificate:
type: string
port:
type: integer
protocol:
enum:
- HTTP
- HTTPS
sslpolicy:
type: string
type:
enum:
- modify-listener
required:
- type
set-s3-logging¶
Action to enable/disable S3 logging for an application loadbalancer.
- example
policies:
- name: elbv2-test
resource: app-elb
filters:
- type: value
key: Attributes."access_logs.s3.enabled"
value: False
actions:
- type: set-s3-logging
bucket: elbv2logtest
prefix: dahlogs
state: enabled
properties:
bucket:
type: string
prefix:
type: string
state:
enum:
- enabled
- disabled
type:
enum:
- set-s3-logging
required:
- state
set-shield¶
Enable shield protection on applicable resource.
setting sync parameter will also clear out stale shield protections for resources that no longer exist.
properties:
state:
type: boolean
sync:
type: boolean
type:
enum:
- set-shield
required:
- type
set-waf¶
Enable/Disable waf protection on applicable resource.
properties:
state:
type: boolean
type:
enum:
- set-waf
web-acl:
type: string
required:
- web-acl
- type
aws.app-elb-target-group¶
Resource manager for v2 ELB target groups.
Filters¶
default-vpc¶
Filter all application elb target groups within the default vpc
- example
policies:
- name: appelb-targetgroups-default-vpc
resource: app-elb-target-group
filters:
- default-vpc
properties:
type:
enum:
- default-vpc
required:
- type
Actions¶
delete¶
Action to delete ELB target group
It is recommended to apply a filter to the delete policy to avoid unwanted deletion of any app elb target groups.
- example
policies:
- name: appelb-targetgroups-delete-unused
resource: app-elb-target-group
filters:
- "tag:SomeTag": absent
actions:
- delete
properties:
type:
enum:
- delete
required:
- type