ELB Access Log

01 Login to the AWS Management Console.

02 Navigate to EC2 dashboard at https://console.aws.amazon.com/ec2/.

03 In the navigation panel, under LOAD BALANCING, click Load Balancers.

04 Select the Elastic Load Balancer that you want to examine.

05 Select the Description tab from the bottom panel and check the Access Logs status:

If the current status is Disabled, the feature is disabled for the selected ELB.

06 Repeat step no. 4 and 5 for each load balancer available in the current region. Change the AWS region from the navigation bar to repeat the process for other regions.

01 Run describe-load-balancer-attributes command (OSX/Linux/UNIX) to check if access logging is enabled for the selected ELB. The following example return the attributes metadata for an ELB called MyWebELB:

aws elb describe-load-balancer-attributes
	--region us-east-1
	--load-balancer-name MyWebELB

02 The command output should expose the ELB access logging status. If the AccessLog Enabled value is false, the feature is not enabled.

{
    "LoadBalancerAttributes": {
        "ConnectionDraining": {
            "Enabled": true,
            "Timeout": 300
        },
        "CrossZoneLoadBalancing": {
            "Enabled": true
        },
        "ConnectionSettings": {
            "IdleTimeout": 60
        },
        "AccessLog": {
            "Enabled": false
        }
    }
}

03 Repeat step no. 1 for each load balancer available in the current region. Change the AWS region by using the --region filter to repeat the process for other regions.

01 Login to the AWS Management Console.

02 Navigate to EC2 dashboard at https://console.aws.amazon.com/ec2/.

03 In the navigation panel, under LOAD BALANCING, click Load Balancers.

04 Select the Elastic Load Balancer that you want to update.

05 Select the Description tab from the bottom panel and click Edit next to the Access Logs status.

06 In the Configure Access Logs dialog box, set the following:

1. Check Enable Access Logs checkbox to enable the feature.
2. For Interval, select the time interval between deliveries of the logging files to S3 bucket.
3. For S3 Location, enter a name and a prefix (e.g. elb-logging-bucket/webapp) for the S3 bucket that will store the log files. Check Create the location for me to enable AWS to create the new bucket for you. If you don’t request this option, you must provide the name of an existing bucket available in the same region with the load balancer.

07 Click Save to apply the changes. The Access Logs status value should change now to Enabled:

08 Repeat step no. 4 – 7 for each load balancer available in the current region. Change the AWS region from the navigation bar to repeat the process for other regions.

01 Run create-bucket command (OSX/Linux/UNIX) to create the S3 bucket that will store the ELB log files (note that the bucket must be created in the same AWS region with the ELB):

aws s3api create-bucket
	--region us-east-1
	--bucket elb-logging-bucket

02 Now create a policy that grants the ELB permission to write to the newly created bucket. Make a new policy document called elb-access-logging-policy.json and paste the following (replace the highlighted details with your details or use AWS Policy Generator - http://awspolicygen.s3.amazonaws.com/policygen.html, to create your own policy):

{
  "Id": "ELB-Access-Logging-Policy",
  "Version": "2012-10-17",
  "Statement": [
    {
     "Sid": "Stmt1891778271523",
     "Action": [
       "s3:PutObject"
     ],
     "Effect": "Allow",
     "Resource":"arn:aws:s3:::elb-logging-bucket/AWSLogs/123456789012/*",
     "Principal": {
       "AWS": [
         "127311923021"
        ]
      }
    }
  ]
}

03 Run put-bucket-policy command (OSX/Linux/UNIX) to attach the policy document saved in the elb-access-logging-policy.json file to the elb-logging-bucket S3 bucket:

aws s3api put-bucket-policy
	--bucket elb-logging-bucket
	--policy file://elb-access-logging-policy.json

04 Run modify-load-balancer-attributes command (OSX/Linux/UNIX) to enable access logging for the selected Elastic Load Balancer:

aws elb modify-load-balancer-attributes
	--region us-east-1
	--load-balancer-name MyWebELB
	--load-balancer-attributes
	"{\"AccessLog\":{\"Enabled\":true,\"EmitInterval\":60,\"S3BucketName\":\"elb-logging-bucket\"}}"

05 The command output should return the new configuration metadata for the load balancer access logging:

{
    "LoadBalancerAttributes": {
        "AccessLog": {
            "EmitInterval": 60,
            "Enabled": true,
            "S3BucketName": "elb-logging-bucket"
        }
    },
    "LoadBalancerName": "MyWebELB"
}