aws-beanstalk-web-tier-public
WebServer-tier environments front instances with an internet-facing ELB by default.
match (record)
{
"field": "Tier.Name == WebServer",
"resource_type": "AWS::ElasticBeanstalk::Environment"
}
where
load balancer scheme is internet-facing (option aws:ec2:vpc:ELBScheme != internal)
emit
| target type | AnonymousIdentity |
|---|---|
| source | <Elastic Beanstalk environment> |
| target | <AnonymousIdentity> |
| state logic | ACTIVE if ELBScheme is internet-facing; CONDITIONAL if scheme unknown; not emitted for Worker tier |
Narrative
{environment.name} is reachable from the internet via its web-tier load balancer.
Raw rule rules/derived/aws/beanstalk.yaml
id: aws-beanstalk-web-tier-public
emits: ExposedToInternet
description: WebServer-tier environments front instances with an internet-facing ELB by default.
match_record:
resource_type: AWS::ElasticBeanstalk::Environment
field: Tier.Name == WebServer
where:
- load balancer scheme is internet-facing (option aws:ec2:vpc:ELBScheme != internal)
emit:
target_type: AnonymousIdentity
source: <Elastic Beanstalk environment>
target: <AnonymousIdentity>
state_logic: ACTIVE if ELBScheme is internet-facing; CONDITIONAL if scheme unknown; not emitted for
Worker tier
false_positive_note: Worker-tier environments have no public ELB. Do not emit for internal-scheme load
balancers.
narrative: '{environment.name} is reachable from the internet via its web-tier load balancer.'