Terraform AWS ELB

Classic Load Balancers with listeners, health checks, SSL certificates, cross zone balancing, connection draining, access logging, and security group controlled ingress.

Quick start

module "elb" {
  source  = "acscessentialeight.compliance.tf/terraform-aws-modules/elb/aws"
  version = "~> 4.0"

  # ... your arguments here
}

module "elb" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/elb/aws"
  version = "~> 4.0"

  # ... your arguments here
}

module "elb" {
  source  = "cisacyberessentials.compliance.tf/terraform-aws-modules/elb/aws"
  version = "~> 4.0"

  # ... your arguments here
}

module "elb" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/elb/aws"
  version = "~> 4.0"

  # ... your arguments here
}

module "elb" {
  source  = "fedramplow.compliance.tf/terraform-aws-modules/elb/aws"
  version = "~> 4.0"

  # ... your arguments here
}

module "elb" {
  source  = "fedrampmoderate.compliance.tf/terraform-aws-modules/elb/aws"
  version = "~> 4.0"

  # ... your arguments here
}

module "elb" {
  source  = "ffiec.compliance.tf/terraform-aws-modules/elb/aws"
  version = "~> 4.0"

  # ... your arguments here
}

module "elb" {
  source  = "hipaa.compliance.tf/terraform-aws-modules/elb/aws"
  version = "~> 4.0"

  # ... your arguments here
}

This module on the compliance.tf registry lists its versions, inputs and outputs. The Get Started guide and Registry Endpoints cover authentication and how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "elb" {
  source  = "terraform-aws-modules/elb/aws"
  version = "~> 4.0"
}

module "elb" {
  source  = "soc2.compliance.tf/terraform-aws-modules/elb/aws"
  version = "~> 4.0"
}

Same arguments. Same outputs. Controls are checked at terraform plan. The Migration Guide has the step-by-step version.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "elb" {
  source  = "terraform-aws-modules/elb/aws"
}

Run terraform init -upgrade. Terraform state is unchanged: same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Controls enforced

Up to 3 controls are checked at terraform plan when this module comes from a compliance.tf endpoint. Which ones are active depends on the endpoint; see Framework coverage.

Control	Retrofit effort
Classic Load Balancers should have connection draining enabled	Low
ELB classic load balancers should have cross-zone load balancing enabled	Low
ELB classic load balancers should be configured with defensive or strictest desync mitigation mode	Low

Mapped compliance frameworks

Clause	Controls from this module
ACSC-EE-ML2-7.7: Multi-factor authentication ML2	ELB classic load balancers should be configured with defensive or strictest desync mitigation mode

Clause	Controls from this module
11.10(a) Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records	ELB classic load balancers should have cross-zone load balancing enabled

Clause	Controls from this module
Your Systems-3	ELB classic load balancers should have cross-zone load balancing enabled

Clause	Controls from this module
16 Business Continuity	ELB classic load balancers should have cross-zone load balancing enabled

Clause	Controls from this module
Denial Of Service Protection (SC-5)	ELB classic load balancers should have cross-zone load balancing enabled

Clause	Controls from this module
Denial Of Service Protection (SC-5)	ELB classic load balancers should have cross-zone load balancing enabled

Clause	Controls from this module
D5.IR.Pl.B.6	ELB classic load balancers should have cross-zone load balancing enabled

Clause	Controls from this module
164.308(a)(7)(ii)(C) Emergency mode operation plan	ELB classic load balancers should have cross-zone load balancing enabled

Framework coverage

Which controls from this module are active under each framework endpoint. Your framework preferences choose the columns.

Control	HIPAA Omnibus Rule 2013
Classic Load Balancers should have connection draining enabled	Not active
ELB classic load balancers should have cross-zone load balancing enabled	Enforced
ELB classic load balancers should be configured with defensive or strictest desync mitigation mode	Not active

3 controls enforced with a source URL change.

Start free trial Get started