Question 1

Is access_logs enforced for GDPR?

Accepted Answer

Yes, Elastic Load Balancing activity is a central point of communication within an environment.

Question 2

Is drop_invalid_header_fields enforced for GDPR?

Accepted Answer

Yes, Ensure that your Elastic Load Balancers (ELB) are configured to drop http headers.

Question 3

Is listeners enforced for GDPR?

Accepted Answer

Yes, This control checks whether the listener for an Application Load Balancer or Network Load Balancer is configured to use a secure protocol for encryption of data in transit. The control fails if an Application Load Balancer listener isn't configured to use the HTTPS protocol, or a Network Load Balancer listener isn't configured to use the TLS protocol.

Control	Clause	Change
ELB application and classic load balancer logging should be enabledelb_application_classic_lb_logging_enabled None	None
ELB application load balancers should be configured to drop HTTP headerselb_application_lb_drop_http_headers None	None
ELB application and network load balancer listeners should use secure protocolselb_application_network_listener_uses_secure_protocol None	None

Controls