ALB does not have access logs enabled
- Severity
- Low
- Service
- Elastic Load Balancing
- Check ID
- ALB_ACCESS_LOGS_DISABLED
What this check finds
Access logs capture detailed information about every request sent to the load balancer including client IP, latency, request path, and response code. Without them, there is no record to support security investigations, traffic audits, or incident response involving the ALB.
Passing looks like: ALB access logs enabled.
How to fix it
Enable access logs and specify an S3 bucket.
AWS CLI
aws elbv2 modify-load-balancer-attributes --load-balancer-arn ALB_ARN --attributes Key=access_logs.s3.enabled,Value=true Key=access_logs.s3.bucket,Value=YOUR_BUCKET
Names in capitals are placeholders for your own resource. Review a command before you run it.
AWS console
EC2 → Load Balancers → select ALB → Attributes → Edit → Access logs → Enable.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs