> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Elb alb security policy remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, here are the step-by-step instructions to remediate the misconfiguration of ALBs not having latest SSL/TLS configurations in AWS:

        1. Login to your AWS Management Console.
        2. Navigate to the EC2 dashboard.
        3. Click on the "Load Balancers" option under the "LOAD BALANCING" section in the left-hand menu.
        4. Select the ALB that you want to remediate and click on its name to open its configuration page.
        5. Click on the "Listeners" tab in the ALB configuration page.
        6. Click on the "Edit" button next to the listener that you want to update the SSL/TLS configuration for.
        7. In the "Edit Listener" dialog box, select the "HTTPS" protocol.
        8. Under the "SSL/TLS certificates" section, select the certificate that you want to use for the listener.
        9. Under the "Security policy" section, select the latest SSL/TLS policy that is available in the drop-down list.
        10. Click on the "Save" button to save the changes.

        After following these steps, your ALB will have the latest SSL/TLS configurations.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate this misconfiguration for AWS using AWS CLI, you can follow the below steps:

        1. Check the current SSL/TLS configuration of your Application Load Balancer (ALB) using the following AWS CLI command:

        ```
        aws elbv2 describe-load-balancers --load-balancer-arns <your-alb-arn> --query "LoadBalancers[].{Name:LoadBalancerName, Scheme:Scheme, SecurityGroups:SecurityGroups, SSLPolicy:SSLPolicy}"
        ```

        Note: Replace `<your-alb-arn>` with the ARN of your ALB.

        2. Identify the latest SSL/TLS configuration that you want to apply to your ALB. You can refer to the AWS documentation to find the latest SSL/TLS configurations supported by ALBs.

        3. Update the SSL/TLS configuration of your ALB using the following AWS CLI command:

        ```
        aws elbv2 modify-listener --listener-arn <your-listener-arn> --ssl-policy <your-ssl-policy>
        ```

        Note: Replace `<your-listener-arn>` with the ARN of your listener and `<your-ssl-policy>` with the name of the SSL/TLS policy that you want to apply.

        4. Verify the SSL/TLS configuration of your ALB using the following AWS CLI command:

        ```
        aws elbv2 describe-listeners --listener-arns <your-listener-arn> --query "Listeners[].{Protocol:Protocol, Port:Port, SSLPolicy:SSLPolicy}"
        ```

        Note: Replace `<your-listener-arn>` with the ARN of your listener.

        5. Repeat steps 1-4 for all your ALBs to ensure that they have the latest SSL/TLS configurations.

        Note: Make sure to test your application after updating the SSL/TLS configuration of your ALB to ensure that it is working as expected.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of ALBs not having the latest SSL/TLS configurations in AWS using Python, you can follow the below steps:

        1. Install the required Python libraries: boto3 and botocore. You can install them using the following command:

        ```
        pip install boto3 botocore
        ```

        2. Create a boto3 client for AWS Application Load Balancer (ALB) using the following code:

        ```python theme={null}
        import boto3

        elbv2 = boto3.client('elbv2')
        ```

        3. Get the list of all the existing ALBs using the following code:

        ```python theme={null}
        response = elbv2.describe_load_balancers()
        load_balancers = response['LoadBalancers']
        ```

        4. Loop through all the ALBs and check if they are using the latest SSL/TLS configurations. You can use the following code to check if the ALB is using the latest SSL/TLS configurations:

        ```python theme={null}
        for lb in load_balancers:
            arn = lb['LoadBalancerArn']
            response = elbv2.describe_listeners(LoadBalancerArn=arn)
            listeners = response['Listeners']
            for listener in listeners:
                if listener['Protocol'] == 'HTTPS':
                    ssl_policy = listener.get('SslPolicy')
                    if ssl_policy != 'ELBSecurityPolicy-TLS-1-2-2017-01':
                        # Update the SSL/TLS configuration
                        elbv2.modify_listener(
                            ListenerArn=listener['ListenerArn'],
                            SslPolicy='ELBSecurityPolicy-TLS-1-2-2017-01'
                        )
        ```

        5. The above code will update the SSL/TLS configuration of the ALB to the latest one if it is not already using it.

        6. You can schedule this Python script to run periodically to ensure that all the ALBs are using the latest SSL/TLS configurations.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_lb" "APPLICATION_LOAD_BALANCER" {
          name               = "ALB_NAME"            # replace with your ALB name
          internal           = false
          load_balancer_type = "application"
          subnets            = [SUBNET_ID_1, SUBNET_ID_2] # replace with your subnet IDs

          security_groups = [SECURITY_GROUP_ID]           # replace with your SG ID
        }

        resource "aws_lb_target_group" "ALB_TARGET_GROUP" {
          name     = "ALB_TG_NAME"     # replace with your target group name
          port     = 80                # adjust as needed
          protocol = "HTTP"
          vpc_id   = VPC_ID            # replace with your VPC ID
        }

        resource "aws_lb_listener" "ALB_HTTPS_LISTENER" {
          load_balancer_arn = aws_lb.APPLICATION_LOAD_BALANCER.arn
          port              = 443
          protocol          = "HTTPS"

          # This is the key setting: use the recommended modern TLS policy
          ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"

          certificate_arn   = ACM_CERTIFICATE_ARN   # replace with your ACM certificate ARN

          default_action {
            type             = "forward"
            target_group_arn = aws_lb_target_group.ALB_TARGET_GROUP.arn
          }
        }
        ```

        This sets each HTTPS/TLS `aws_lb_listener` on your ALB to use `ELBSecurityPolicy-TLS13-1-2-2021-06`, matching the `aws elbv2 modify-listener --ssl-policy ELBSecurityPolicy-TLS13-1-2-2021-06` CLI remediation. This change is in-place (no load balancer replacement), but it can break clients that do not support the newer TLS versions/ciphers, so validate compatibility first.

        For existing listeners, `terraform plan` should show an in-place update like:

        * `~ resource "aws_lb_listener" "ALB_HTTPS_LISTENER"`
          * `ssl_policy: "OLD_POLICY_NAME" -> "ELBSecurityPolicy-TLS13-1-2-2021-06"`
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>