Skip to main content

🛡️ AWS ELB Load Balancer listeners are not using a secure protocol🟢

  • Contextual name: 🛡️ Load Balancer listeners are not using a secure protocol🟢
  • ID: /ce/ca/aws/elb/load-balancer-listener-security
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS Elastic Load Balancer (ELB) listeners that are configured with insecure protocols. It is recommended to use only secure protocols, such as HTTPS, TLS, SSL, or QUIC, to encrypt communications between clients and load balancers.

Rationale​

Using unencrypted protocols allows data to be transmitted in plaintext, which poses a significant security risk. Secure protocols such as HTTPS, TLS and QUIC provide encryption, ensuring that intercepted data cannot be read or modified. QUIC, which underpins HTTP/3, also delivers enhanced security and performance compared to earlier transport mechanisms. Encrypted communication helps prevent man-in-the-middle (MITM) attacks and protects the integrity and confidentiality of data in transit.

Audit​

This policy flags an AWS ELB Load Balancer as INCOMPLIANT if any related ELB Load Balancer Listener is not configured to use a secure protocol, such as HTTPS, TLS, SSL, or QUIC.

A Listener configured with the TCP protocol on port 443 is marked as COMPLIANT, as this configuration is commonly used to forward encrypted traffic directly to targets without decrypting it at the load balancer.

Remediation​

Open File

Remediation​

Create a Secure Listener for an AWS Load Balancer​

Prerequisites​

Before creating a secure listener, ensure you have the following resources configured in the same AWS Region as your load balancer:

  1. A Validated SSL/TLS Certificate: A certificate issued by AWS Certificate Manager (ACM) and in the ISSUED state.
  2. Backend Target: An existing target group (for ALB/NLB) or registered instances (for CLB) to forward traffic to.
  3. Certificate ARN: The Amazon Resource Name (ARN) of your certificate.
    • For Application and Network Load Balancers, use the certificate's ACM ARN.
    • For Classic Load Balancers, you can use the certificate's IAM Server Certificate ARN. You can find this in the IAM console or via the AWS CLI (aws iam list-server-certificates).
Create a Secure Listener​

Use the appropriate command based on the load balancer type.

Application Load Balancer​
aws elbv2 create-listener \
    --load-balancer-arn {{load-balancer-arn}} \
    --protocol HTTPS \

... [see more](remediation.md)

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [ELB.18] Application and Network Load Balancer listeners should use secure protocols to encrypt data in transit1no data
💼 AWS Well-Architected → 💼 SEC09-BP01 Implement secure key and certificate management5no data
💼 Cloudaware Framework → 💼 Data Encryption66no data