AWS Elastic Beanstalk controls

These controls are related to Elastic Beanstalk resources.

[ElasticBeanstalk.1] Elastic Beanstalk environments should have enhanced health reporting enabled

Related requirements: NIST.800-53.r5 CA-7,NIST.800-53.r5 SI-2

Category: Detect > Detection services > Application monitoring

Severity: Low

Resource type: AWS::ElasticBeanstalk::Environment

AWS Config rule: beanstalk-enhanced-health-reporting-enabled

Schedule type: Change triggered

Parameters: None

This control checks whether enhanced health reporting is enabled for your AWS Elastic Beanstalk environments.

Elastic Beanstalk enhanced health reporting enables a more rapid response to changes in the health of the underlying infrastructure. These changes could result in a lack of availability of the application.

Elastic Beanstalk enhanced health reporting provides a status descriptor to gauge the severity of the identified issues and identify possible causes to investigate. The Elastic Beanstalk health agent, included in supported Amazon Machine Images (AMIs), evaluates logs and metrics of environment EC2 instances.

For additional information, see Enhanced health reporting and monitoring in the AWS Elastic Beanstalk Developer Guide.

Note

This control isn't supported in the following Regions:

• Asia Pacific (Hyderabad)

• Asia Pacific (Jakarta)

• Asia Pacific (Osaka)

• China (Beijing)

• China (Ningxia)

• Europe (Spain)

• Europe (Zurich)

• Middle East (UAE)

• AWS GovCloud (US-East)

• AWS GovCloud (US-West)

Remediation

For instructions on how to enable enhanced health reporting, see Enabling enhanced health reporting using the Elastic Beanstalk console in the AWS Elastic Beanstalk Developer Guide.

[ElasticBeanstalk.2] Elastic Beanstalk managed platform updates should be enabled

Related requirements: NIST.800-53.r5 SI-2,NIST.800-53.r5 SI-2(2),NIST.800-53.r5 SI-2(4),NIST.800-53.r5 SI-2(5)

Category: Detect > Vulnerability, patch, and version management

Severity: High

Resource type: AWS::ElasticBeanstalk::Environment

AWS Config rule: elastic-beanstalk-managed-updates-enabled

Schedule type: Change triggered

Parameters: None

This control checks whether managed platform updates are enabled for the Elastic Beanstalk environment.

Enabling managed platform updates ensures that the latest available platform fixes, updates, and features for the environment are installed. Keeping up to date with patch installation is an important step in securing systems.

Note

This control isn't supported in the following Regions:

• Asia Pacific (Hyderabad)

• Asia Pacific (Jakarta)

• Asia Pacific (Osaka)

• China (Beijing)

• China (Ningxia)

• Europe (Spain)

• Europe (Zurich)

• Middle East (UAE)

• AWS GovCloud (US-East)

• AWS GovCloud (US-West)

Remediation

For instructions on how to enable managed platform updates, see To configure managed platform updates under Managed platform updates in the AWS Elastic Beanstalk Developer Guide.