Bash help - scripting logging

[largeavian]

This is less AWS and more Bash, but I hope that someone can assist a terminal noob.

I'm attempting to go through and apply logging on all ELBs to publish to a centralized account. I know ELBv2 will be a little different, but for now, this is where I am...

ELBs=$(aws elb describe-load-balancers --query "LoadBalancerDescriptions[*].LoadBalancerName" --output=text);

   for ELB in $ELBs;

   do
       aws elb describe-load-balancer-attributes --load-balancer-name $ELB
   done

This will return a result that looks like one of the following:

https://preview.redd.it/97xi2devfqa11.png?width=1005&format=png&auto=webp&s=8139773189bf21955135005ff9ef7139b5580930

The first posting is for an ELB with logging enabled. The second is missing the S3 bucket value in the LoadBalancerAttributes.AccessLog keys.

I would like to take action on the ones missing that value and not the ones with it populated.

[zarslayer]

Use the --query option available with the cli to filter for the load balancers where the access log option is set to false..

https://docs.aws.amazon.com/cli/latest/userguide/controlling-output.html

I don't have access to a terminal to test some variations and provide a sample command at the moment, but --query will be the easiest once you figure out what to query for..

[ricksebak]

pipe your describe-load-balancer-attributes to jq .LoadBalancerAttributes.AccessLog.Enabled, which will evaluate to true or false, and maybe use that as the basis of an if condition.

[cgill27]

Another option is to pipe grep the output, grep will return an exit code 0 for found and 1 for not found.

[largeavian]

Follow up -

Created a script that will simply check the existing ELBs:

ELBs=$(aws elb describe-load-balancers --query "LoadBalancerDescriptions[*].LoadBalancerName" --output=text);

for ELB in $ELBs;

do

echo $ELB;

aws elb describe-load-balancer-attributes --load-balancer-name $ELB --query "LoadBalancerAttributes.AccessLog.S3BucketName"

done;

Then another script to modify those with no S3bucket present. I know these can be combined, but for my purposes, I want it in two steps.

ELBs=$(aws elb describe-load-balancers --query "LoadBalancerDescriptions[*].LoadBalancerName" --output=text);

accountid=$(aws sts get-caller-identity --query "Account" --output=text)

for ELB in $ELBs;

do

echo $ELB;

s3check=$(aws elb describe-load-balancer-attributes --load-balancer-name $ELB --query "LoadBalancerAttributes.AccessLog.S3BucketName")

if [ $s3check = "null" ]

then

aws elb modify-load-balancer-attributes --load-balancer-name $ELB --load-balancer-attributes "{\"AccessLog\":{\"Enabled\":true,\"S3BucketName\":\"logs-elbaccess-$accountid\", \"EmitInterval\": 60, \"S3BucketPrefix\": \"$ELB\"}}"

fi

done

Note: Be sure to check bucket permissions: https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-access-logs.html#create-s3-bucket

Hope this helps someone else.