Application Load Balancer should be configured to redirect all HTTP requests to HTTPS

How to fix it

Give every HTTP listener on the Application Load Balancer a default action that redirects to HTTPS on port 443. One HTTP listener without one fails this, and an HTTPS listener has to exist for the redirect to reach. Only the listener's DEFAULT action is read, so a redirect set on a path-matched rule does not clear it. Note that the redirecting listener still fails ELB.18, which wants no HTTP listener at all.

In the console

EC2 -> Load balancers -> the load balancer -> Listeners and rules -> the HTTP listener -> Default action

With the AWS CLI

aws elbv2 modify-listener --listener-arn <listener-arn> --default-actions Type=redirect,RedirectConfig='{Protocol=HTTPS,Port=443,StatusCode=HTTP_301}' --region <region>

With Terraform

resource "aws_lb_listener" "http_redirect" {
  load_balancer_arn = var.load_balancer_arn
  port              = 80
  protocol          = "HTTP"

  default_action {
    type = "redirect"

    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}