All checks
Medium
Application and Network Load Balancers with listeners should use recommended security policies
Verifies that every HTTPS listener on an Application Load Balancer and every TLS listener on a Network Load Balancer uses one of the eight security policies AWS recommends for encrypting data in transit. The list is fixed, so a stricter policy outside it still fails; where that is deliberate, mark the finding Won't fix rather than weaken the listener.
- service
- ELB
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
EC2 → Load balancers → the load balancer → Listeners and rules → the listener → Secure listener settings
With the AWS CLI
aws elbv2 modify-listener --listener-arn <listener-arn> --ssl-policy ELBSecurityPolicy-TLS13-1-2-Res-2021-06 --region <region>With Terraform
resource "aws_lb_listener" "https" {
load_balancer_arn = var.load_balancer_arn
port = 443
protocol = "HTTPS"
certificate_arn = var.acm_certificate_arn
ssl_policy = "ELBSecurityPolicy-TLS13-1-2-Res-2021-06"
default_action {
type = "forward"
target_group_arn = var.target_group_arn
}
}See which of your accounts this check is failing on.
Book a demo