Skip to main content

ELBs Should Use Secure Listeners Only

More Info:​

ELBv2 load balancers should use only the secure listeners. A listener is a process that checks for connection requests, using the protocol and port that you configure.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • Reserve Bank of India (RBI) Cyber Security Framework
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Sure, here are the step-by-step instructions to remediate the misconfiguration "ELBs Should Use Secure Listeners Only" for AWS using the AWS console:

  1. Login to the AWS Management Console and navigate to the EC2 Dashboard.
  2. Click on the "Load Balancers" option from the left-hand menu.
  3. Select the ELB for which you want to enable secure listeners.
  4. Click on the "Listeners" tab.
  5. Remove any HTTP listeners by clicking on the "X" button next to the listener.
  6. Click on the "Add listener" button.
  7. Select "HTTPS" from the "Load Balancer Protocol" dropdown menu.
  8. Enter the appropriate values for "Load Balancer Port" and "Instance Protocol" based on your application requirements.
  9. Select the SSL certificate from the "SSL Certificate" dropdown menu.
  10. Click on the "Add" button to add the secure listener.
  11. Click on the "Save" button to save the changes.

Once these steps are completed, your ELB will only use secure listeners and the misconfiguration "ELBs Should Use Secure Listeners Only" will be remediated.

Using CLI

To remediate the ELBs Should Use Secure Listeners Only misconfiguration for AWS using AWS CLI, you can follow the below steps:

Step 1: Open the AWS CLI and run the following command to describe the load balancer:

aws elb describe-load-balancers --load-balancer-name <load_balancer_name>

Note: Replace <load_balancer_name> with the name of your load balancer.

Step 2: Check the listener configuration of the load balancer and ensure that it is using secure listeners only. You can do this by checking if the protocol is set to HTTPS and the SSL certificate is properly configured.

Step 3: If the load balancer is not using secure listeners only, run the following command to update the listener configuration:

aws elb create-load-balancer-listeners --load-balancer-name <load_balancer_name> --listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80,SSLCertificateId=<ssl_certificate_id>

Note: Replace <load_balancer_name> with the name of your load balancer and <ssl_certificate_id> with the ID of your SSL certificate.

Step 4: After updating the listener configuration, run the following command to verify the updated configuration:

aws elb describe-load-balancers --load-balancer-name <load_balancer_name>

Note: Replace <load_balancer_name> with the name of your load balancer.

Step 5: Repeat the above steps for all the load balancers in your AWS account.

By following the above steps, you can remediate the ELBs Should Use Secure Listeners Only misconfiguration for AWS using AWS CLI.

Using Python

To remediate the misconfiguration of ELBs using insecure listeners in AWS, you can use the following Python script:

import boto3

# Create a boto3 client for ELB
elb_client = boto3.client('elbv2')

# Get a list of all the load balancers
load_balancers = elb_client.describe_load_balancers()

# Iterate through each load balancer and update its listeners
for lb in load_balancers['LoadBalancers']:
    # Get the current listeners of the load balancer
    current_listeners = elb_client.describe_listeners(LoadBalancerArn=lb['LoadBalancerArn'])
    
    # Iterate through each listener and check if it is secure
    for listener in current_listeners['Listeners']:
        if listener['Protocol'] == 'HTTP':
            # Remove the insecure listener
            elb_client.delete_listener(ListenerArn=listener['ListenerArn'])
        elif listener['Protocol'] == 'HTTPS':
            # Update the secure listener to use a secure SSL policy
            elb_client.modify_listener(ListenerArn=listener['ListenerArn'], SslPolicy='ELBSecurityPolicy-TLS-1-2-2017-01')

This script will iterate through all the load balancers in your AWS account and check if any of them have insecure listeners. If it finds an insecure listener that uses HTTP, it will remove it. If it finds a secure listener that uses HTTPS, it will update the SSL policy to use a secure one.

Using Terraform
resource "aws_lb" "THIS_LOAD_BALANCER" {
  name               = "REPLACE_WITH_LB_NAME"
  internal           = false
  load_balancer_type = "application"

  subnets = [
    aws_subnet.SUBNET_1.id,
    aws_subnet.SUBNET_2.id,
  ]

  security_groups = [aws_security_group.LB_SG.id]
}

resource "aws_lb_target_group" "THIS_TG" {
  name     = "REPLACE_WITH_TG_NAME"
  port     = 80
  protocol = "HTTP"
  vpc_id   = aws_vpc.THIS_VPC.id
}

# Listener updated to use a modern secure TLS policy
resource "aws_lb_listener" "THIS_SECURE_LISTENER" {
  load_balancer_arn = aws_lb.THIS_LOAD_BALANCER.arn
  port              = 443
  protocol          = "HTTPS"

  ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06" # matches the CLI remediation

  certificate_arn = "REPLACE_WITH_ACM_CERT_ARN"

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.THIS_TG.arn
  }
}

This change updates the existing HTTPS/TLS listener to use the ELBSecurityPolicy-TLS13-1-2-2021-06 policy, disabling older protocols like TLS 1.0 and 1.1; this may impact older clients, so test in non‑production first and choose a different predefined policy if your compliance requirements demand it. The listener is updated in place (no Terraform resource replacement, but there may be a brief in-flight connection impact during policy change).

To verify, terraform plan should show an in-place update (~) on the aws_lb_listener resource with ssl_policy changing from its current value to ELBSecurityPolicy-TLS13-1-2-2021-06 and no other changes.

Additional Reading:​