Skip to main content

🛡️ AWS Elastic Beanstalk Environment does not have logs enabled🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS Elastic Beanstalk environments that are not configured to capture and retain application and system logs. Elastic Beanstalk supports automatic log delivery by uploading rotated logs to Amazon S3 or streaming logs in near real time to Amazon CloudWatch Logs.

Rationale​

By default, Elastic Beanstalk stores logs generated by EC2 instances in an Amazon S3 bucket managed by the service. However, many log files, such as bundle and trail logs, are deleted after creation unless log retention is explicitly configured. Enabling log rotation to Amazon S3 ensures that logs are retained and available for later analysis through the Elastic Beanstalk Management Console or the EB CLI. Additionally, streaming logs to Amazon CloudWatch Logs provides real-time visibility for monitoring, troubleshooting, and incident response.

Impact​

Enabling log retention and streaming may result in additional costs associated with Amazon S3 storage and Amazon CloudWatch Logs ingestion and retention.

Audit​

... see more

Remediation​

Open File

Remediation​

Enable log streaming to Amazon CloudWatch Logs and log rotation to Amazon S3​

Configure the Elastic Beanstalk environment to retain logs by enabling log rotation to Amazon S3 and stream logs in near real time to Amazon CloudWatch Logs.

From Command Line​

Run the update-environment command using the name of the Elastic Beanstalk environment you want to reconfigure.

aws elasticbeanstalk update-environment \
    --region us-east-1 \
    --environment-name CcProdWebsite-env \
    --option-settings \
        Namespace=aws:elasticbeanstalk:hostmanager,OptionName=LogPublicationControl,Value=true \
        Namespace=aws:elasticbeanstalk:cloudwatch:logs,OptionName=RetentionInDays,Value=90 \
        Namespace=aws:elasticbeanstalk:cloudwatch:logs,OptionName=StreamLogs,Value=true

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ElasticBeanstalk.3] Elastic Beanstalk should stream logs to CloudWatch1no data
💼 AWS Well-Architected → 💼 REL06-BP05 Analyze logs1no data
💼 AWS Well-Architected → 💼 SEC04-BP02 Capture logs, findings, and metrics in standardized locations3no data
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration71no data
💼 PCI DSS v3.2.1 → 💼 10.6.2 Review logs of all other system components periodically based on the organization's policies and risk management strategy, as determined by the organization's annual risk assessment.7no data
💼 PCI DSS v4.0.1 → 💼 10.4.2 Logs of all other system components are reviewed periodically.17no data
💼 PCI DSS v4.0 → 💼 10.4.2 Logs of all other system components are reviewed periodically.17no data