AWS ELBv2 CCF Plugin

This plugin collects read-only AWS Elastic Load Balancing v2 evidence and evaluates CCF Rego policy bundles against one normalized input document per ELBv2 resource.

It implements the RunnerV2 gRPC plugin protocol from github.com/compliance-framework/agent.

Component subject templates registered during Init:

• aws-elbv2-loadbalancer
• aws-elbv2-listener
• aws-elbv2-target-group
• aws-elbv2-target-health

Account and region are labels and input context. They are not standalone subjects.

Configuration

The CCF agent passes configuration as flat string fields. Structured values are JSON-encoded strings.

Key	Default	Description
accounts	[]	JSON array of {account_id, regions[], role_arn, external_id, session_name, tags{}}. Empty means use the configured AWS credential chain.
default_regions	[]	JSON array used when an account omits regions; falls back to the AWS SDK default region.
lookback_days	90	Positive integer no greater than 90, used for CloudTrail LookupEvents.
policy_inputs	{}	JSON object exposed to Rego as input.policy_inputs.
policy_input	{}	Alias for policy_inputs.
policy_labels	{}	JSON string map merged into generated evidence labels.
max_concurrency	4	Positive integer no greater than 32, used as the worker count for account/region collection.
api_timeout_seconds	60	Positive integer timeout per account/region target.
tag_batch_size	20	Positive integer no greater than 20, used as the ELBv2 DescribeTags resource ARN batch size.

Example:

{
  "accounts": "[{\"account_id\":\"123456789012\",\"regions\":[\"us-east-1\"],\"role_arn\":\"arn:aws:iam::123456789012:role/elbv2-readonly\",\"external_id\":\"ccf\",\"session_name\":\"ccf-elbv2\",\"tags\":{\"environment\":\"prod\"}}]",
  "default_regions": "[\"us-east-1\"]",
  "lookback_days": "90",
  "policy_inputs": "{\"minimum_availability_zones\":2}",
  "policy_labels": "{\"team\":\"security\"}"
}

Rego Input Schema

All records share this envelope:

• schema_version: v1
• source: aws-elbv2
• account: {account_id, role_arn, tags}
• region: {name}
• resource: {id, arn, type}
• config: resource-specific fields listed below
• dynamic: dynamic evidence enrichment; empty for non-loadbalancer records
• tags: ELBv2 tags for load balancer, listener, and target-group records; empty for target-health records
• collection: collection metadata, raw payload hash, errors, and optional lookback window
• policy_inputs: parsed policy input object

loadbalancer

{
  "schema_version": "v1",
  "source": "aws-elbv2",
  "account": {"account_id": "123456789012", "role_arn": "", "tags": {"environment": "prod"}},
  "region": {"name": "us-east-1"},
  "resource": {
    "id": "app/my-alb/abc123",
    "arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-alb/abc123",
    "type": "loadbalancer"
  },
  "config": {
    "load_balancer_arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-alb/abc123",
    "dns_name": "my-alb-123.us-east-1.elb.amazonaws.com",
    "scheme": "internet-facing",
    "type": "application",
    "state": "active",
    "availability_zones": ["us-east-1a", "us-east-1b"]
  },
  "dynamic": {
    "cloudtrail_events": [
      {"event_name": "ModifyListener", "event_time": "2026-04-01T10:00:00Z", "user_identity_arn": "arn:aws:iam::123456789012:role/admin"}
    ]
  },
  "tags": {"owner": "platform-team"},
  "collection": {
    "collected_at": "2026-05-14T12:00:00Z",
    "collector_version": "aws-elbv2",
    "collection_type": "config_dynamic",
    "lookback_window": {"start": "2026-02-13T12:00:00Z", "end": "2026-05-14T12:00:00Z"},
    "raw_payload_hashes": {"primary": "sha256:..."},
    "errors": []
  },
  "policy_inputs": {"minimum_availability_zones": 2}
}

listener

{
  "schema_version": "v1",
  "source": "aws-elbv2",
  "account": {"account_id": "123456789012", "role_arn": "", "tags": {"environment": "prod"}},
  "region": {"name": "us-east-1"},
  "resource": {
    "id": "listener/app/my-alb/abc123/def456",
    "arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/my-alb/abc123/def456",
    "type": "listener"
  },
  "config": {
    "listener_arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/my-alb/abc123/def456",
    "load_balancer_arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-alb/abc123",
    "protocol": "HTTPS",
    "port": 443,
    "ssl_policy": "ELBSecurityPolicy-TLS13-1-2-2021-06",
    "certificate_arn": "arn:aws:acm:us-east-1:123456789012:certificate/cert1"
  },
  "dynamic": {},
  "tags": {"tls": "public"},
  "collection": {
    "collected_at": "2026-05-14T12:00:00Z",
    "collector_version": "aws-elbv2",
    "collection_type": "config",
    "raw_payload_hashes": {"primary": "sha256:..."},
    "errors": []
  },
  "policy_inputs": {"minimum_availability_zones": 2}
}

target-group

{
  "schema_version": "v1",
  "source": "aws-elbv2",
  "account": {"account_id": "123456789012", "role_arn": "", "tags": {"environment": "prod"}},
  "region": {"name": "us-east-1"},
  "resource": {
    "id": "app-tg/ghi789",
    "arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/app-tg/ghi789",
    "type": "target-group"
  },
  "config": {
    "target_group_arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/app-tg/ghi789",
    "load_balancer_arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-alb/abc123",
    "protocol": "HTTP",
    "port": 80,
    "health_check_protocol": "HTTP",
    "health_check_path": "/healthz",
    "healthy_threshold_count": 3,
    "unhealthy_threshold_count": 2
  },
  "dynamic": {},
  "tags": {"service": "orders"},
  "collection": {
    "collected_at": "2026-05-14T12:00:00Z",
    "collector_version": "aws-elbv2",
    "collection_type": "config",
    "raw_payload_hashes": {"primary": "sha256:..."},
    "errors": []
  },
  "policy_inputs": {"minimum_availability_zones": 2}
}

target-health

{
  "schema_version": "v1",
  "source": "aws-elbv2",
  "account": {"account_id": "123456789012", "role_arn": "", "tags": {"environment": "prod"}},
  "region": {"name": "us-east-1"},
  "resource": {
    "id": "app-tg/ghi789/i-1234567890abcdef0",
    "arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/app-tg/ghi789",
    "type": "target-health"
  },
  "config": {
    "target_group_arn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/app-tg/ghi789",
    "target_id": "i-1234567890abcdef0",
    "target_health_state": "healthy"
  },
  "dynamic": {},
  "tags": {},
  "collection": {
    "collected_at": "2026-05-14T12:00:00Z",
    "collector_version": "aws-elbv2",
    "collection_type": "config",
    "raw_payload_hashes": {"primary": "sha256:..."},
    "errors": []
  },
  "policy_inputs": {"minimum_availability_zones": 2}
}

Coverage

CONFIG evidence includes:

• DescribeLoadBalancers
• DescribeListeners
• DescribeTargetGroups
• DescribeTargetHealth
• DescribeTags for load balancer, listener, and target group tags

DYNAMIC evidence includes CloudTrail LookupEvents for elasticloadbalancing.amazonaws.com, filtered to CreateListener, ModifyListener, DeleteListener, CreateRule, ModifyRule, and DeleteRule, and attached to matching load balancer records as dynamic.cloudtrail_events.

Out of scope:

• ACM certificate expiry and renewal status. This plugin does not call acm.DescribeCertificate; it only records the listener certificate_arn.
• SSL policy cipher inspection. This plugin records only the listener ssl_policy string.
• AWS Artifact SOC reports and privacy endpoint inventory.

Development

make build
make test
goreleaser build --snapshot --clean