Ensure that subnets for the web-tier Elastic Load Balancers (ELBs) are created. Each web-tier ELB subnet must reside entirely in one Availability Zone and cannot span zones. Availability Zones (AZs) are distinct locations that are engineered to be isolated from failures occurred in other zones. There must be at least 2 web-tier subnets in 2 different Availability Zones where you want traffic to be routed by your ELB in order to provide higher availability for the web applications behind the load balancer. This conformity rule assumes that all AWS resources (ELBs, subnets, etc) provisioned inside your web tier are tagged with <web_tier_tag>:<web_tier_tag_value>, where <web_tier_tag> represents the tag name and <web_tier_tag_value> represents the tag value. Prior to running this rule by the Cloud Conformity engine, the web-tier tags must be configured in the rule settings, on your Cloud Conformity account dashboard.
At least two subnets in two different Availability Zones should be created in order to provide high availability and fault tolerance for your web-tier Elastic Load Balancer.
Note: Ensure that you replace all <web_tier_tag>:<web_tier_tag_value> tag placeholders found in the conformity rule content with your own tag name and value created for the web tier.
To determine if your web-tier ELB has at least two web-tier subnets attached, perform the following actions:
Remediation / Resolution
To create web-tier subnets (at least two subnets in different AZs) and associate them with your web-tier Elastic Load Balancer, perform the following actions:
- AWS Documentation
- VPCs and Subnets
- Working with VPCs and Subnets
- What Is Elastic Load Balancing?
- Add or Remove Subnets for Your Classic Load Balancer in a VPC
- CIS Amazon Web Services Foundations
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
You are auditing:
Create Web-Tier ELB Subnets
Risk level: Medium