Latest AWS Security Policy for SSL Negotiations Should Be

More Info:

Your app-tier Elastic Load Balancers (ELBs) listeners should be using the latest AWS security policy for their SSL negotiation configuration.

Risk Level

Medium

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• AWS Well Architected Framework
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration "Latest AWS Security Policy for SSL Negotiations Should Be Used For App-Tier ELBs" in AWS using the AWS console, follow these steps:

1. Log in to the AWS Management Console.
2. Navigate to the EC2 dashboard.
3. Click on the "Load Balancers" link in the left-hand navigation menu.
4. Select the App-Tier ELB that needs remediation.
5. Click on the "Listeners" tab.
6. Select the HTTPS listener that needs remediation.
7. Click on the "Edit" button.
8. In the "Edit Listener" dialog box, select the latest AWS Security Policy from the "Security policy" drop-down menu.
9. Click the "Save" button to save the changes.

Once the above steps are completed, the App-Tier ELB will be configured to use the latest AWS Security Policy for SSL negotiations.

Using CLI

To remediate the misconfiguration of using the latest AWS Security Policy for SSL negotiations for App-Tier ELBs in AWS using AWS CLI, follow these steps:

1. Open your AWS CLI on your local machine or EC2 instance.

2. Run the following command to get the current SSL policy for your App-Tier ELB:

   aws elb describe-load-balancers --load-balancer-name <your-ELB-name> --query "LoadBalancerDescriptions[].ListenerDescriptions[].PolicyNames[]"

   Replace <your-ELB-name> with the name of your App-Tier ELB.

3. If the output includes any SSL policies other than the latest AWS Security Policy, you need to update the SSL policy. Run the following command to update the SSL policy for your App-Tier ELB:

   aws elb set-load-balancer-policies-of-listener --load-balancer-name <your-ELB-name> --load-balancer-port 443 --policy-names ELBSecurityPolicy-2016-08

   Replace <your-ELB-name> with the name of your App-Tier ELB.

4. Verify that the SSL policy has been updated by running the command in step 2 again.

5. Repeat steps 2-4 for all App-Tier ELBs in your AWS environment.

By following these steps, you can remediate the misconfiguration of using the latest AWS Security Policy for SSL negotiations for App-Tier ELBs in AWS using AWS CLI.

Using Python

To remediate the misconfiguration "Latest AWS Security Policy for SSL Negotiations Should Be Used For App-Tier ELBs" in AWS using Python, follow the steps below:

1. Import the necessary AWS libraries and modules:

import boto3
from botocore.exceptions import ClientError

2. Create an ELB client object:

elb_client = boto3.client('elbv2')

3. Get a list of all the existing load balancers:

response = elb_client.describe_load_balancers()
load_balancers = response['LoadBalancers']

4. Loop through the list of load balancers and check if they are application tier ELBs:

for lb in load_balancers:
    if lb['Type'] == 'application':
        # Do something

5. Once you have identified the application tier ELBs, update their SSL policy to use the latest AWS security policy:

try:
    response = elb_client.set_security_groups(
        LoadBalancerArn=lb['LoadBalancerArn'],
        SecurityGroups=[
            'security_group_id'
        ]
    )
except ClientError as e:
    print(e)

6. Replace 'security_group_id' with the ID of the security group that you want to associate with the ELB.

7. Finally, run the Python script to remediate the misconfiguration.

Using Terraform

# Application Load Balancer (ALB) HTTPS listener using the latest AWS SSL policy
resource "aws_lb" "APP_TIER_ALB" {
  name               = "APP_TIER_ALB_NAME"        # replace with your ALB name
  internal           = true                       # or false, as needed
  load_balancer_type = "application"
  subnets            = [SUBNET_ID_1, SUBNET_ID_2] # replace with your subnet IDs
  security_groups    = [SG_ID]                    # replace with your SG ID(s)
}

resource "aws_lb_target_group" "APP_TIER_TG" {
  name     = "APP_TIER_TG_NAME"   # replace with your target group name
  port     = 443                  # replace with your target port
  protocol = "HTTPS"
  vpc_id   = VPC_ID               # replace with your VPC ID
}

resource "aws_lb_listener" "APP_TIER_ALB_HTTPS" {
  load_balancer_arn = aws_lb.APP_TIER_ALB.arn
  port              = 443
  protocol          = "HTTPS"

  ssl_policy      = "ELBSecurityPolicy-TLS13-1-2-2021-06" # matches aws elbv2 modify-listener
  certificate_arn = ACM_CERTIFICATE_ARN                  # replace with your ACM cert ARN

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.APP_TIER_TG.arn
  }
}

# This change is applied in-place on the listener; it does not force replacement of the ALB.
# terraform plan should show an in-place update (~) to aws_lb_listener.APP_TIER_ALB_HTTPS.ssl_policy.


# Classic Load Balancer (CLB) HTTPS/SSL listener using the latest AWS SSL policy
resource "aws_elb" "APP_TIER_CLB" {
  name               = "APP_TIER_CLB_NAME"          # replace with your CLB name
  subnets            = [SUBNET_ID_1, SUBNET_ID_2]   # replace with your subnet IDs
  security_groups    = [SG_ID]                      # replace with your SG ID(s)
  cross_zone_load_balancing = true

  listener {
    instance_port     = 443                         # replace with your instance port
    instance_protocol = "HTTPS"
    lb_port           = 443                         # this is <listener-port> in the CLI example
    lb_protocol       = "HTTPS"
    ssl_certificate_id = ACM_CERTIFICATE_ARN        # replace with your ACM cert ARN
  }
}

# SSL negotiation policy matching ELBSecurityPolicy-TLS13-1-2-2021-06
resource "aws_load_balancer_policy" "APP_TIER_CLB_SSL" {
  load_balancer_name = aws_elb.APP_TIER_CLB.name
  policy_name        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  policy_type_name   = "SSLNegotiationPolicyType"
  # No attributes are needed when you use a predefined AWS policy name
}

# OPTIONAL: define any additional non-SSL policies you already use (e.g., ProxyProtocolPolicyType)
# Make sure to keep them attached to the listener together with the SSL policy,
# because Terraform replaces the entire policy_names list on aws_load_balancer_listener.

# Attach the SSL policy (and any other existing policies) to the specific HTTPS/SSL listener port
resource "aws_load_balancer_listener" "APP_TIER_CLB_HTTPS" {
  load_balancer_name = aws_elb.APP_TIER_CLB.name
  lb_port            = 443   # must match the HTTPS/SSL listener port you are remediating
  instance_port      = 443   # replace as needed
  lb_protocol        = "HTTPS"
  instance_protocol  = "HTTPS"
  ssl_certificate_id = ACM_CERTIFICATE_ARN

  # CRITICAL: This list REPLACES all policies on the listener, matching
  # aws elb set-load-balancer-policies-of-listener behavior.
  policy_names = [
    aws_load_balancer_policy.APP_TIER_CLB_SSL.policy_name,
    # OTHER_EXISTING_POLICY_NAME_1, # add any other existing policy names you need to preserve
    # OTHER_EXISTING_POLICY_NAME_2,
  ]
}

# These CLB changes are in-place; they do not force replacement of the CLB, but they do
# fully replace the set of policies on the listener port.
# terraform plan should show:
# - a new aws_load_balancer_policy.APP_TIER_CLB_SSL resource
# - an in-place update (~) to aws_load_balancer_listener.APP_TIER_CLB_HTTPS.policy_names

Additional Reading:

• https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-security-policy-table.html