AWS ELB

This plugin collects read-only AWS Elastic Load Balancing v2 evidence and evaluates CCF Rego policy bundles against one normalized input document per ELBv2 resource.

It implements the RunnerV2 gRPC plugin protocol from github.com/compliance-framework/agent.

Component subject templates registered during Init:

aws-elbv2-loadbalancer
aws-elbv2-listener
aws-elbv2-target-group
aws-elbv2-target-health

Account and region are labels and input context. They are not standalone subjects.

This page is for operators who run the plugin-aws-elb plugin with the CCF Agent, and for developers who write policies for it. It documents v0.1.1 and is generated from the plugin's README at v0.1.1.

Configuration

The CCF agent passes configuration as flat string fields. Structured values are JSON-encoded strings.

Key	Default	Description
`accounts`	`[]`	JSON array of `{account_id, regions[], role_arn, external_id, session_name, tags{}}`. Empty means use the configured AWS credential chain.
`default_regions`	`[]`	JSON array used when an account omits `regions`; falls back to the AWS SDK default region.
`lookback_days`	`90`	Positive integer no greater than `90`, used for CloudTrail LookupEvents.
`policy_inputs`	`{}`	JSON object exposed to Rego as `input.policy_inputs`.
`policy_input`	`{}`	Alias for `policy_inputs`.
`policy_labels`	`{}`	JSON string map merged into generated evidence labels.
`max_concurrency`	`4`	Positive integer no greater than `32`, used as the worker count for account/region collection.
`api_timeout_seconds`	`60`	Positive integer timeout per account/region target.
`tag_batch_size`	`20`	Positive integer no greater than `20`, used as the ELBv2 `DescribeTags` resource ARN batch size.

Example:

{
  "accounts": "[{\"account_id\":\"123456789012\",\"regions\":[\"us-east-1\"],\"role_arn\":\"arn:aws:iam::123456789012:role/elbv2-readonly\",\"external_id\":\"ccf\",\"session_name\":\"ccf-elbv2\",\"tags\":{\"environment\":\"prod\"}}]",
  "default_regions": "[\"us-east-1\"]",
  "lookback_days": "90",
  "policy_inputs": "{\"minimum_availability_zones\":2}",
  "policy_labels": "{\"team\":\"security\"}"
}

Evidence collected

Coverage

CONFIG evidence includes:

DescribeLoadBalancers
DescribeListeners
DescribeTargetGroups
DescribeTargetHealth
DescribeTags for load balancer, listener, and target group tags

DYNAMIC evidence includes CloudTrail LookupEvents for elasticloadbalancing.amazonaws.com, filtered to CreateListener, ModifyListener, DeleteListener, CreateRule, ModifyRule, and DeleteRule, and attached to matching load balancer records as dynamic.cloudtrail_events.

Out of scope:

ACM certificate expiry and renewal status. This plugin does not call acm.DescribeCertificate; it only records the listener certificate_arn.
SSL policy cipher inspection. This plugin records only the listener ssl_policy string.
AWS Artifact SOC reports and privacy endpoint inventory.

Policies

No policy bundles are mapped to this plugin yet.

Rego Input Schema

All records share this envelope:

schema_version: v1
source: aws-elbv2
account: {account_id, role_arn, tags}
region: {name}
resource: {id, arn, type}
config: resource-specific fields listed below
dynamic: dynamic evidence enrichment; empty for non-loadbalancer records
tags: ELBv2 tags for load balancer, listener, and target-group records; empty for target-health records
collection: collection metadata, raw payload hash, errors, and optional lookback window
policy_inputs: parsed policy input object

`loadbalancer`

{
  "schema_version": "v1",
  "source": "aws-elbv2",
  "account": {"account_id": "123456789012", "role_arn": "", "tags": {"environment": "prod"}},
  "region": {"name": "us-east-1"},
  "resource": {
    "id": "app/my-alb/abc123",
    "arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-alb/abc123",
    "type": "loadbalancer"
  },
  "config": {
    "load_balancer_arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-alb/abc123",
    "dns_name": "my-alb-123.us-east-1.elb.amazonaws.com",
    "scheme": "internet-facing",
    "type": "application",
    "state": "active",
    "availability_zones": ["us-east-1a", "us-east-1b"]
  },
  "dynamic": {
    "cloudtrail_events": [
      {"event_name": "ModifyListener", "event_time": "2026-04-01T10:00:00Z", "user_identity_arn": "arn:aws:iam::123456789012:role/admin"}
    ]
  },
  "tags": {"owner": "platform-team"},
  "collection": {
    "collected_at": "2026-05-14T12:00:00Z",
    "collector_version": "aws-elbv2",
    "collection_type": "config_dynamic",
    "lookback_window": {"start": "2026-02-13T12:00:00Z", "end": "2026-05-14T12:00:00Z"},
    "raw_payload_hashes": {"primary": "sha256:..."},
    "errors": []
  },
  "policy_inputs": {"minimum_availability_zones": 2}
}

`listener`

{
  "schema_version": "v1",
  "source": "aws-elbv2",
  "account": {"account_id": "123456789012", "role_arn": "", "tags": {"environment": "prod"}},
  "region": {"name": "us-east-1"},
  "resource": {
    "id": "listener/app/my-alb/abc123/def456",
    "arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/my-alb/abc123/def456",
    "type": "listener"
  },
  "config": {
    "listener_arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/my-alb/abc123/def456",
    "load_balancer_arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-alb/abc123",
    "protocol": "HTTPS",
    "port": 443,
    "ssl_policy": "ELBSecurityPolicy-TLS13-1-2-2021-06",
    "certificate_arn": "arn:aws:acm:us-east-1:123456789012:certificate/cert1"
  },
  "dynamic": {},
  "tags": {"tls": "public"},
  "collection": {
    "collected_at": "2026-05-14T12:00:00Z",
    "collector_version": "aws-elbv2",
    "collection_type": "config",
    "raw_payload_hashes": {"primary": "sha256:..."},
    "errors": []
  },
  "policy_inputs": {"minimum_availability_zones": 2}
}

`target-group`

{
  "schema_version": "v1",
  "source": "aws-elbv2",
  "account": {"account_id": "123456789012", "role_arn": "", "tags": {"environment": "prod"}},
  "region": {"name": "us-east-1"},
  "resource": {
    "id": "app-tg/ghi789",
    "arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/app-tg/ghi789",
    "type": "target-group"
  },
  "config": {
    "target_group_arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/app-tg/ghi789",
    "load_balancer_arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-alb/abc123",
    "protocol": "HTTP",
    "port": 80,
    "health_check_protocol": "HTTP",
    "health_check_path": "/healthz",
    "healthy_threshold_count": 3,
    "unhealthy_threshold_count": 2
  },
  "dynamic": {},
  "tags": {"service": "orders"},
  "collection": {
    "collected_at": "2026-05-14T12:00:00Z",
    "collector_version": "aws-elbv2",
    "collection_type": "config",
    "raw_payload_hashes": {"primary": "sha256:..."},
    "errors": []
  },
  "policy_inputs": {"minimum_availability_zones": 2}
}

`target-health`

{
  "schema_version": "v1",
  "source": "aws-elbv2",
  "account": {"account_id": "123456789012", "role_arn": "", "tags": {"environment": "prod"}},
  "region": {"name": "us-east-1"},
  "resource": {
    "id": "app-tg/ghi789/i-1234567890abcdef0",
    "arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/app-tg/ghi789",
    "type": "target-health"
  },
  "config": {
    "target_group_arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/app-tg/ghi789",
    "target_id": "i-1234567890abcdef0",
    "target_health_state": "healthy"
  },
  "dynamic": {},
  "tags": {},
  "collection": {
    "collected_at": "2026-05-14T12:00:00Z",
    "collector_version": "aws-elbv2",
    "collection_type": "config",
    "raw_payload_hashes": {"primary": "sha256:..."},
    "errors": []
  },
  "policy_inputs": {"minimum_availability_zones": 2}
}

Configuration​

Evidence collected​

Coverage​

Policies​

Rego Input Schema​

loadbalancer​

listener​

target-group​

target-health​