🛡️ AWS ELB Application Load Balancer is not configured to redirect HTTP to HTTPS🟢
- Contextual name: 🛡️ Application Load Balancer is not configured to redirect HTTP to HTTPS🟢
- ID:
/ce/ca/aws/elb/load-balancer-redirects-http-to-https - Tags:
- Policy Type:
COMPLIANCE_POLICY - Policy Categories:
SECURITY
Logic
Similar Policies
- AWS Security Hub: [ELB.1] Application Load Balancer should be configured to redirect all HTTP requests to HTTPS
Description
Description
This policy identifies AWS Application Elastic Load Balancers that have an HTTP listener but do not enforce a redirect to an HTTPS listener on port 443.
Rationale
Unencrypted HTTP traffic is susceptible to interception and man-in-the-middle attacks. Although some applications may handle HTTPS enforcement internally, implementing an HTTP-to-HTTPS redirect at the load balancer level ensures that all client traffic is encrypted before reaching the application servers, providing a consistent and centralized security control.
Audit
This policy flags an AWS ELB Application Load Balancer as
INCOMPLIANTif it has an associated HTTP Listener that does not include either:
a Default Action, or
a Listener Rule
configured to redirect traffic to HTTPS on port 443.
Remediation
Remediation
Enable HTTP-to-HTTPS Redirection
Configure the Application Load Balancer to redirect all HTTP traffic to HTTPS (port 443). This can be achieved either by modifying the HTTP listener’s default action or by adding a high-priority listener rule.
An HTTPS listener on port 443 must already exist on your load balancer, configured with a valid SSL/TLS certificate
Note: Apply these changes only to the HTTP (port 80) listener.
Option 1: Modify the Listener Default Action (Recommended)
This approach changes the default behavior of the HTTP listener so that all requests are permanently redirected (HTTP 301) to HTTPS. Use this when the HTTP listener's sole purpose is redirection
From Command Line
aws elbv2 modify-listener \
--listener-arn {{listener-arn}} \
--default-actions '[
{
"Type": "redirect",
"RedirectConfig": {
"Protocol": "HTTPS",
"Port": "443",
"StatusCode": "HTTP_301"
}
}
]'... see more