Checks whether any ALB listener's access control whitelist includes the specified IP addresses or CIDR blocks. If yes, the result is Compliant.
Scenarios
Use this rule to verify that ALB listener whitelists contain required IP addresses or CIDR blocks, reducing network exposure in your cloud environment.
Risk level
Default risk level: high.
You can change the risk level when you configure this rule.
Evaluation logic
- If any ALB listener's access control whitelist includes the specified IP addresses or CIDR blocks, the result is Compliant.
- If no ALB listener whitelist includes the specified IP addresses or CIDR blocks, the result is Incompliant. Follow the Incompliance remediation steps to fix this.
Rule details
| Item | Description |
| Rule name | alb-acl-has-specified-ip |
| Rule identifier | alb-acl-has-specified-ip |
| Tag | ALB and LoadBalancer |
| Automatic remediation | Not supported |
| Trigger type | Periodic execution |
| Evaluation frequency | Every 24 hours |
| Supported resource type | ALB instances |
| Input parameter | IpAddress |
Incompliance remediation
Update the ALB listener's access control whitelist so that its IP addresses or CIDR blocks match those specified in Cloud Config. For more information, see Access control.