> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Elb https only remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration "ELB Should Accept HTTPS Connections Only" in AWS using AWS console, follow these steps: 1. Open the AWS Management Console and navigate to the EC2 Dashboard. 2. Click on Load Balancers from the left-hand menu. 3. Select the load balancer that you want to configure to accept HTTPS connections only. 4. Click on the Listeners tab. 5. Click on Edit in the Actions column for the HTTPS listener. 6. In the Edit Listener dialog box, select HTTPS as the Protocol. 7. In the SSL Certificate drop-down menu, select the SSL certificate that you want to use for the HTTPS listener. 8. In the Default Actions section, click on the X icon next to the existing action to remove it. 9. Click on Add Action and select Forward to from the drop-down menu. 10. In the Forward to drop-down menu, select the target group that you want to forward traffic to. 11. Click on Save. After following these steps, your ELB will be configured to accept HTTPS connections only. Any HTTP traffic will be automatically redirected to HTTPS. # To remediate the ELB accepting only HTTPS connections in AWS using AWS CLI, follow these steps: 1. Open the AWS CLI on your local machine. 2. Run the following command to describe the current configuration of the ELB: ``` aws elb describe-load-balancers --load-balancer-name ``` Replace `` with the name of your ELB. 3. Check if the ELB is currently accepting both HTTP and HTTPS connections. If it is, you need to modify the listener to accept HTTPS connections only. 4. Run the following command to modify the listener to accept HTTPS connections only: ``` aws elb modify-load-balancer-attributes --load-balancer-name --load-balancer-attributes "{\"LoadBalancerAttributes\":{\"ConnectionSettings\":{\"IdleTimeout\":3600},\"AccessLog\":{\"Enabled\":false},\"ConnectionDraining\":{\"Enabled\":false},\"CrossZoneLoadBalancing\":{\"Enabled\":false},\"SecurityGroups\":[\"\"],\"AdditionalAttributes\":[{\"Key\":\"listener.sslPolicy\",\"Value\":\"ELBSecurityPolicy-2016-08\"}],\"Listeners\":[{\"Protocol\":\"HTTPS\",\"LoadBalancerPort\":443,\"InstanceProtocol\":\"HTTP\",\"InstancePort\":80}]}}" ``` Replace `` with the name of your ELB and `` with the ID of the security group that the ELB should use. 5. Verify that the ELB is now accepting HTTPS connections only by running the following command: ``` aws elb describe-load-balancers --load-balancer-name ``` The output should show that the listener is now configured to accept HTTPS connections only. Note: Make sure to replace `` and `` with the appropriate values for your ELB. To remediate the misconfiguration "ELB Should Accept HTTPS Connections Only" for AWS using python, you can follow the below steps: 1. Import the necessary libraries: ``` import boto3 ``` 2. Create an AWS ELB client: ``` elb_client = boto3.client('elbv2') ``` 3. Get the list of all the load balancers: ``` lb_list = elb_client.describe_load_balancers() ``` 4. Iterate through the list of load balancers and update the listener protocol to HTTPS: ``` for lb in lb_list['LoadBalancers']: lb_arn = lb['LoadBalancerArn'] listener_list = elb_client.describe_listeners(LoadBalancerArn=lb_arn) for listener in listener_list['Listeners']: if listener['Protocol'] != 'HTTPS': elb_client.modify_listener( ListenerArn=listener['ListenerArn'], Protocol='HTTPS' ) ``` 5. Verify that the listener protocol has been updated to HTTPS: ``` listener_list = elb_client.describe_listeners(LoadBalancerArn=lb_arn) for listener in listener_list['Listeners']: if listener['Protocol'] != 'HTTPS': print('Listener protocol not updated to HTTPS') else: print('Listener protocol updated to HTTPS') ``` By following the above steps, the misconfiguration "ELB Should Accept HTTPS Connections Only" can be remediated for AWS using python. ```hcl theme={null} ############################ # 1) Application Load Balancer: HTTP → HTTPS redirect (modify listener) ############################ resource "aws_lb" "APP_ALB" { name = "APP_ALB_NAME" # replace with your ALB name internal = false load_balancer_type = "application" subnets = [SUBNET_ID_1, SUBNET_ID_2] # replace with subnet IDs security_groups = [SG_ID] # replace with SG ID } # HTTPS listener on 443 must already exist (as assumed by the CLI remediation) resource "aws_lb_listener" "https_443" { load_balancer_arn = aws_lb.APP_ALB.arn port = 443 protocol = "HTTPS" ssl_policy = "ELBSecurityPolicy-2016-08" certificate_arn = ACM_CERT_ARN # replace with ACM certificate ARN default_action { type = "forward" target_group_arn = AWS_LB_TARGET_GROUP_HTTPS_ARN # replace with your target group ARN or use a target group resource } } # Fix: change HTTP listener default action to a redirect to HTTPS:443 with HTTP_301 resource "aws_lb_listener" "http_80" { load_balancer_arn = aws_lb.APP_ALB.arn port = 80 protocol = "HTTP" default_action { type = "redirect" redirect { protocol = "HTTPS" port = "443" status_code = "HTTP_301" } } } # This change is in‑place on the listener (no load balancer replacement), but traffic behavior on port 80 will change to a redirect. ############################ # 2) Network Load Balancer: delete insecure TCP:80 listener ############################ resource "aws_lb" "NETWORK_NLB" { name = "NETWORK_NLB_NAME" # replace with your NLB name internal = false load_balancer_type = "network" subnets = [SUBNET_ID_1, SUBNET_ID_2] # replace with subnet IDs } # TLS listener that will continue to serve encrypted traffic (e.g., 443) resource "aws_lb_listener" "tls_443" { load_balancer_arn = aws_lb.NETWORK_NLB.arn port = 443 protocol = "TLS" default_action { type = "forward" target_group_arn = AWS_LB_TARGET_GROUP_TLS_ARN # replace with your target group ARN } } # INSECURE LISTENER TO DELETE: # The CLI remediation calls aws elbv2 delete-listener on the TCP:80 listener. # In Terraform, REMOVE this resource entirely so it is destroyed. # Example of what should be removed: # # resource "aws_lb_listener" "tcp_80" { # load_balancer_arn = aws_lb.NETWORK_NLB.arn # port = 80 # protocol = "TCP" # # default_action { # type = "forward" # target_group_arn = AWS_LB_TARGET_GROUP_TCP_ARN # } # } # # Deleting this resource forces replacement of the listener only; traffic on port 80 will permanently stop. ############################ # 3) Classic Load Balancer: delete insecure HTTP listener ############################ resource "aws_elb" "CLASSIC_ELB" { name = "CLASSIC_ELB_NAME" # replace with your ELB name subnets = [SUBNET_ID_1, SUBNET_ID_2] # replace with subnet IDs security_groups = [SG_ID] # replace with SG ID # SECURE LISTENER that must remain (HTTPS/SSL) listener { instance_port = 443 instance_protocol = "HTTPS" lb_port = 443 lb_protocol = "HTTPS" ssl_certificate_id = ACM_OR_IAM_CERT_ARN # replace with your certificate ARN } # INSECURE HTTP LISTENER TO DELETE: # The CLI remediation calls aws elb delete-load-balancer-listeners on the HTTP port (e.g., 80). # In Terraform, REMOVE this listener block entirely so it is destroyed. # # listener { # instance_port = 80 # instance_protocol = "HTTP" # lb_port = 80 # lb_protocol = "HTTP" # } # # Removing this listener block forces replacement of the listener on that port; traffic on that port will permanently stop. } ############################ # Verification ############################ # After updating Terraform: # - terraform plan for the ALB should show an in-place update to the HTTP listener's default_action to a redirect with protocol HTTPS, port 443, and status_code HTTP_301. # - terraform plan for the NLB should show the aws_lb_listener on TCP:80 being destroyed (no new TCP:80 listener created). # - terraform plan for the Classic ELB should show the HTTP listener (e.g., port 80) being removed from the aws_elb listener set. ```