Control: 1 Auto Scaling groups associated with a load balancer should use load balancer health checks
Description
This control checks whether your Auto Scaling groups that are associated with a load balancer are using Elastic Load Balancing health checks.
PCI DSS does not require load balancing or highly available configurations. However, this check aligns with AWS best practices.
Remediation
To enable Elastic Load Balancing health checks
- Open the Amazon EC2 console
- On the navigation pane, under
Auto Scaling, choose Auto Scaling Groups - To select the group from the list, choose the right box
- Choose Edit
- For
Health Check Type, choose ELB - For
Health Check Grace Period, enter300 - Choose Save
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_autoscaling_1Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_autoscaling_1 --shareSQL
This control uses a named query:
select autoscaling_group_arn as resource, case when load_balancer_names is null and target_group_arns is null then 'alarm' when health_check_type != 'ELB' then 'alarm' else 'ok' end as status, case when load_balancer_names is null and target_group_arns is null then title || ' not associated with a load balancer.' when health_check_type != 'ELB' then title || ' does not use ELB health check.' else title || ' uses ELB health check.' end as reason , region, account_idfrom aws_ec2_autoscaling_group;