How to Integrate Elastic Load Balancer | Defense.com Help Centre

The Elastic Load Balancer integration is available on our Advanced and Enterprise packages.

Creating an S3 Bucket

Sign in to the AWS Management Console and open the Amazon S3 console at https://console.aws.amazon.com/s3/
Click Create bucket.
In Region, choose the AWS Region where you want the bucket to reside — this must be the same Region as your Load Balancer.
Under Object Ownership, select ACLs disabled.
In Block Public Access settings for this bucket, select Block all public access.
For Default encryption, choose Amazon S3-managed keys (SSE-S3) — this is currently the only supported encryption option for ELB access logs.
Leave the rest of the settings as their default values and click Create Bucket.
Make a note of the ARN of the new S3 bucket, as this will be required later.

Creating an IAM Role

Type IAM in the search bar at the top of the AWS console and select IAM from the search results.
In the IAM view, click on the section named Roles in the left-hand toolbar.
Click Create role.
On the Create role page, select the entity type AWS account.
Under An AWS account, click the checkbox marked Another AWS account and enter the Account ID: 653730588838.
In the Options, select Require external ID, then in the External ID box enter a random string of letters and numbers. Please do not include any special characters. Make a note of the External ID, as this will be required later.
Click Next and you'll be taken to the Add permissions page.
Select the permissions AmazonSQSFullAccess and AmazonS3ReadOnlyAccess, then click Next.
Give the role a name (we recommend DefenseAssumedRole), then click Create role in the bottom right corner.
Once the role is created, you'll see a View role option in a green bar at the top of the page. Click on this, then click on Edit in the Summary section of the next page.
Change the value of Maximum session duration to 12 hours and click Save changes.
Make a note of the ARN of this role, as it will be required later.

Setting up ELB access logging

Once your S3 bucket is created (per above), navigate to its Permissions tab and choose Bucket policy, Edit.
Copy the policy below into the bucket policy editor, replacing the placeholders with the relevant values:
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "logdelivery.elasticloadbalancing.amazonaws.com"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::bucket-name/prefix/AWSLogs/your-aws-account-id/*"
    }
  ]
}
```
1. Replace bucket-name with your S3 bucket name, and your-aws-account-id with the AWS account ID that owns the Load Balancer.
2. If you're not using a prefix, drop /prefix from the resource path (e.g. bucket-name/AWSLogs/your-aws-account-id/*).
3. Always include the account ID in the resource path — don't use a wildcard there — as this ensures only Load Balancers from that account can write to the bucket.
4. Choose Save changes.
Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/
In the navigation pane, choose Load Balancers.
Select the name of your Load Balancer to open its details page.
On the Attributes tab, choose Edit.
For Monitoring, turn on Access logs.
For S3 URI, enter the URI for your log files:
1. With a prefix: s3://bucket-name/prefix
2. Without a prefix: s3://bucket-name
Choose Save changes.
AWS will validate the bucket policy and drop a test file called ELBAccessLogTestFile into the bucket (under AWSLogs/your-account-id/, or prefix/AWSLogs/your-account-id/ if you used a prefix). Check for this file to confirm the policy is working before moving on.

Configuring an SQS queue

Note: each S3 bucket will require its own SQS queue.

Type SQS in the search bar at the top of the AWS console and select Simple Queue Service from the search results.
Click Create queue.
Name the queue after the service you will be logging to it (e.g. elb-logs).
Under Access policy, select Advanced, then copy the code below into the text box and replace the placeholders with the relevant values:
{
"Version": "2012-10-17",
"Id": "__default_policy_ID",
"Statement": [
{
"Sid": "__owner_statement",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::your-aws-account-id:root"
},
"Action": "SQS:*",
"Resource": "your-sqs-queue-arn"
},
{
"Sid": "__sender_statement",
"Effect": "Allow",
"Principal": {
"Service": "s3.amazonaws.com"
},
"Action": "SQS:SendMessage",
"Resource": "your-sqs-queue-arn",
"Condition": {
"StringEquals": {
"aws:SourceAccount": "your-aws-account-id"
},
"ArnLike": {
"aws:SourceArn": "your-s3-bucket-arn"
}
}
},
{
"Sid": "__receiver_statement",
"Effect": "Allow",
"Principal": {
"AWS": "the-arn-of-the-role-we-asked-you-to-create-in-the-IAM-Role-step"
},
"Action": [
"SQS:ChangeMessageVisibility",
"SQS:DeleteMessage",
"SQS:ReceiveMessage"
],
"Resource": "your-sqs-queue-arn"
}
]
}
Leave the rest of the settings as their defaults, then click Create queue.

Configuring ELB to log to S3

Open the Amazon S3 console at https://console.aws.amazon.com/s3/ and select the S3 bucket you set up earlier.
Go to the Properties tab, scroll down until you find Event notifications and click Create event notification.
Give the event an identifiable name, for example, elb-logs.
In the Event Types section, we recommend logging All object create events.
In the Destination section, select the SQS queue you created earlier, then Save changes.
To test that this has worked, wait for a new ELB access log to land in the bucket, then go to the SQS queue and select the Monitoring tab. Please give a few minutes to see the message come through.

Completing the integration

Once you've completed the above, please provide us with the following information via a support ticket:

The AWS Region of the SQS Queue
The ARN of the SQS Queue
The ARN of the Role we asked you to create
The External ID of the Role

And that's it! You've successfully integrated Elastic Load Balancer 🎉