> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Elb app tier security policy remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration "Latest AWS Security Policy for SSL Negotiations Should Be Used For App-Tier ELBs" in AWS using the AWS console, follow these steps: 1. Log in to the AWS Management Console. 2. Navigate to the EC2 dashboard. 3. Click on the "Load Balancers" link in the left-hand navigation menu. 4. Select the App-Tier ELB that needs remediation. 5. Click on the "Listeners" tab. 6. Select the HTTPS listener that needs remediation. 7. Click on the "Edit" button. 8. In the "Edit Listener" dialog box, select the latest AWS Security Policy from the "Security policy" drop-down menu. 9. Click the "Save" button to save the changes. Once the above steps are completed, the App-Tier ELB will be configured to use the latest AWS Security Policy for SSL negotiations. # To remediate the misconfiguration of using the latest AWS Security Policy for SSL negotiations for App-Tier ELBs in AWS using AWS CLI, follow these steps: 1. Open your AWS CLI on your local machine or EC2 instance. 2. Run the following command to get the current SSL policy for your App-Tier ELB: ``` aws elb describe-load-balancers --load-balancer-name --query "LoadBalancerDescriptions[].ListenerDescriptions[].PolicyNames[]" ``` Replace `` with the name of your App-Tier ELB. 3. If the output includes any SSL policies other than the latest AWS Security Policy, you need to update the SSL policy. Run the following command to update the SSL policy for your App-Tier ELB: ``` aws elb set-load-balancer-policies-of-listener --load-balancer-name --load-balancer-port 443 --policy-names ELBSecurityPolicy-2016-08 ``` Replace `` with the name of your App-Tier ELB. 4. Verify that the SSL policy has been updated by running the command in step 2 again. 5. Repeat steps 2-4 for all App-Tier ELBs in your AWS environment. By following these steps, you can remediate the misconfiguration of using the latest AWS Security Policy for SSL negotiations for App-Tier ELBs in AWS using AWS CLI. To remediate the misconfiguration "Latest AWS Security Policy for SSL Negotiations Should Be Used For App-Tier ELBs" in AWS using Python, follow the steps below: 1. Import the necessary AWS libraries and modules: ```python theme={null} import boto3 from botocore.exceptions import ClientError ``` 2. Create an ELB client object: ```python theme={null} elb_client = boto3.client('elbv2') ``` 3. Get a list of all the existing load balancers: ```python theme={null} response = elb_client.describe_load_balancers() load_balancers = response['LoadBalancers'] ``` 4. Loop through the list of load balancers and check if they are application tier ELBs: ```python theme={null} for lb in load_balancers: if lb['Type'] == 'application': # Do something ``` 5. Once you have identified the application tier ELBs, update their SSL policy to use the latest AWS security policy: ```python theme={null} try: response = elb_client.set_security_groups( LoadBalancerArn=lb['LoadBalancerArn'], SecurityGroups=[ 'security_group_id' ] ) except ClientError as e: print(e) ``` 6. Replace `'security_group_id'` with the ID of the security group that you want to associate with the ELB. 7. Finally, run the Python script to remediate the misconfiguration. ```hcl theme={null} # Application Load Balancer (ALB) HTTPS listener using the latest AWS SSL policy resource "aws_lb" "APP_TIER_ALB" { name = "APP_TIER_ALB_NAME" # replace with your ALB name internal = true # or false, as needed load_balancer_type = "application" subnets = [SUBNET_ID_1, SUBNET_ID_2] # replace with your subnet IDs security_groups = [SG_ID] # replace with your SG ID(s) } resource "aws_lb_target_group" "APP_TIER_TG" { name = "APP_TIER_TG_NAME" # replace with your target group name port = 443 # replace with your target port protocol = "HTTPS" vpc_id = VPC_ID # replace with your VPC ID } resource "aws_lb_listener" "APP_TIER_ALB_HTTPS" { load_balancer_arn = aws_lb.APP_TIER_ALB.arn port = 443 protocol = "HTTPS" ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06" # matches aws elbv2 modify-listener certificate_arn = ACM_CERTIFICATE_ARN # replace with your ACM cert ARN default_action { type = "forward" target_group_arn = aws_lb_target_group.APP_TIER_TG.arn } } # This change is applied in-place on the listener; it does not force replacement of the ALB. # terraform plan should show an in-place update (~) to aws_lb_listener.APP_TIER_ALB_HTTPS.ssl_policy. # Classic Load Balancer (CLB) HTTPS/SSL listener using the latest AWS SSL policy resource "aws_elb" "APP_TIER_CLB" { name = "APP_TIER_CLB_NAME" # replace with your CLB name subnets = [SUBNET_ID_1, SUBNET_ID_2] # replace with your subnet IDs security_groups = [SG_ID] # replace with your SG ID(s) cross_zone_load_balancing = true listener { instance_port = 443 # replace with your instance port instance_protocol = "HTTPS" lb_port = 443 # this is in the CLI example lb_protocol = "HTTPS" ssl_certificate_id = ACM_CERTIFICATE_ARN # replace with your ACM cert ARN } } # SSL negotiation policy matching ELBSecurityPolicy-TLS13-1-2-2021-06 resource "aws_load_balancer_policy" "APP_TIER_CLB_SSL" { load_balancer_name = aws_elb.APP_TIER_CLB.name policy_name = "ELBSecurityPolicy-TLS13-1-2-2021-06" policy_type_name = "SSLNegotiationPolicyType" # No attributes are needed when you use a predefined AWS policy name } # OPTIONAL: define any additional non-SSL policies you already use (e.g., ProxyProtocolPolicyType) # Make sure to keep them attached to the listener together with the SSL policy, # because Terraform replaces the entire policy_names list on aws_load_balancer_listener. # Attach the SSL policy (and any other existing policies) to the specific HTTPS/SSL listener port resource "aws_load_balancer_listener" "APP_TIER_CLB_HTTPS" { load_balancer_name = aws_elb.APP_TIER_CLB.name lb_port = 443 # must match the HTTPS/SSL listener port you are remediating instance_port = 443 # replace as needed lb_protocol = "HTTPS" instance_protocol = "HTTPS" ssl_certificate_id = ACM_CERTIFICATE_ARN # CRITICAL: This list REPLACES all policies on the listener, matching # aws elb set-load-balancer-policies-of-listener behavior. policy_names = [ aws_load_balancer_policy.APP_TIER_CLB_SSL.policy_name, # OTHER_EXISTING_POLICY_NAME_1, # add any other existing policy names you need to preserve # OTHER_EXISTING_POLICY_NAME_2, ] } # These CLB changes are in-place; they do not force replacement of the CLB, but they do # fully replace the set of policies on the listener port. # terraform plan should show: # - a new aws_load_balancer_policy.APP_TIER_CLB_SSL resource # - an in-place update (~) to aws_load_balancer_listener.APP_TIER_CLB_HTTPS.policy_names ```