All checks
Medium
Application and Network Load Balancer listeners should use secure protocols to encrypt data in transit
Confirms that each Application Load Balancer listener uses HTTPS and each Network Load Balancer listener uses an encrypted protocol, so client traffic to the load balancer is not carried in the clear. QUIC passes on a Network Load Balancer, though AWS's control names only TLS; a UDP listener passes only if the application moves to TLS over TCP or to QUIC.
- service
- ELB
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
EC2 → Load balancers → the load balancer → Listeners and rules → the listener → Actions → Edit listener
With the AWS CLI
aws elbv2 modify-listener --listener-arn <listener-arn> --protocol HTTPS --port 443 --certificates CertificateArn=<acm-certificate-arn> --ssl-policy ELBSecurityPolicy-TLS13-1-2-Res-2021-06 --region <region>With Terraform
resource "aws_lb_listener" "https" {
load_balancer_arn = var.load_balancer_arn
port = 443
protocol = "HTTPS"
certificate_arn = var.acm_certificate_arn
ssl_policy = "ELBSecurityPolicy-TLS13-1-2-Res-2021-06"
default_action {
type = "forward"
target_group_arn = var.target_group_arn
}
}See which of your accounts this check is failing on.
Book a demo