Elb web tier security policy remediation

Using Console

To remediate the misconfiguration “Latest AWS Security Policy for SSL Negotiations Should Be Used For Web-Tier ELBs” for AWS using the AWS console, follow the below steps:

Log in to your AWS console and navigate to the EC2 dashboard.
Click on the “Load Balancers” option from the left-hand menu.
Select the web-tier ELB that you want to remediate and click on it.
Click on the “Listeners” tab and select the listener that is using SSL.
In the “SSL Certificate” section, select “Change” and choose the “AWS Managed Certificate” option.
Choose the latest AWS security policy for SSL negotiations from the dropdown menu and click on “Save”.

After following these steps, your web-tier ELB will be configured to use the latest AWS security policy for SSL negotiations. This will ensure that your SSL connections are secure and protected against potential threats.

Using CLI

To remediate this issue for AWS using AWS CLI, follow these steps:

Open the AWS CLI on your local machine.
Run the following command to get the load balancer security policy names:

aws elb describe-load-balancer-policies --load-balancer-name <ELB_NAME>

Replace <ELB_NAME> with the name of your load balancer.

Identify the security policy that is currently in use for the load balancer. The security policy should be named ELBSecurityPolicy-2016-08 or later.
If the load balancer is using an older security policy, run the following command to update it:

aws elb set-load-balancer-policies-for-backend-server --load-balancer-name <ELB_NAME> --policy-names <NEW_POLICY_NAME>

Replace <ELB_NAME> with the name of your load balancer and <NEW_POLICY_NAME> with the name of the latest AWS security policy. The latest security policy name can be found in the AWS documentation.

Verify that the new security policy is in use by running the following command:

aws elb describe-load-balancer-attributes --load-balancer-name <ELB_NAME>

Replace <ELB_NAME> with the name of your load balancer. The command should return a JSON object that includes the new security policy name.

Once you have verified that the new security policy is in use, you have successfully remediated the misconfiguration.

Using Python

To remediate the misconfiguration “Latest AWS Security Policy for SSL Negotiations Should Be Used For Web-Tier ELBs” in AWS using Python, you can follow the below steps:

Import the required libraries:

import boto3

Create a boto3 client for Elastic Load Balancing:

elb_client = boto3.client('elbv2')

Get a list of all the load balancers:

load_balancers = elb_client.describe_load_balancers()

Loop through each load balancer and check if it is a web-tier ELB:

for load_balancer in load_balancers['LoadBalancers']:
    if 'web' in load_balancer['LoadBalancerName']:

If the load balancer is a web-tier ELB, update its SSL policy:

elb_client.modify_load_balancer_attributes(
    LoadBalancerArn=load_balancer['LoadBalancerArn'],
    Attributes=[
        {
            'Key': 'ssl_policy',
            'Value': 'ELBSecurityPolicy-TLS-1-2-Ext-2018-06'
        },
    ]
)

The SSL policy ELBSecurityPolicy-TLS-1-2-Ext-2018-06 is the latest AWS security policy for SSL negotiations. You can modify the code to use a different SSL policy if required.
Finally, you can add this code to a script and run it periodically to ensure that all web-tier ELBs are using the latest AWS security policy for SSL negotiations.

Using Terraform

resource "aws_elb" "web" {
  name               = "ELB_NAME" # replace with your Classic ELB name
  subnets            = [SUBNET_IDS] # replace with list of subnet IDs
  security_groups    = [SECURITY_GROUP_IDS] # replace with list of SG IDs
  cross_zone_load_balancing = true

  listener {
    instance_port      = 80
    instance_protocol  = "http"
    lb_port            = 443 # update if your HTTPS listener uses a different port
    lb_protocol        = "https"
    ssl_certificate_id = "SSL_CERTIFICATE_ARN" # replace with your ACM/SSL cert ARN
  }

  # ... other listeners as needed
}

# Defines the SSL negotiation policy equivalent to
# ELBSecurityPolicy-TLS13-1-2-2021-06 on the ELB.
resource "aws_load_balancer_policy" "web_tls_policy" {
  load_balancer_name = aws_elb.web.name
  policy_name        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  policy_type_name   = "SSLNegotiationPolicyType"
}

# Attach the policy to the HTTPS listener on port 443.
# WARNING: This REPLACES all policies on this listener; if you have
# other policies that must be preserved (e.g., Proxy Protocol on a
# different port), add their names to the `policy_names` list.
resource "aws_load_balancer_listener_policy" "web_tls_listener_policy" {
  load_balancer_name = aws_elb.web.name
  load_balancer_port = 443 # change if your HTTPS listener uses a different port

  policy_names = [
    aws_load_balancer_policy.web_tls_policy.policy_name,
    # "OTHER_POLICY_NAME_TO_PRESERVE", # add any existing policy names that must remain
  ]
}

This change updates the Classic ELB HTTPS listener to use the ELBSecurityPolicy-TLS13-1-2-2021-06 negotiation policy without replacing the ELB itself. terraform plan should show creation (or update) of aws_load_balancer_policy.web_tls_policy and aws_load_balancer_listener_policy.web_tls_listener_policy, with the listener’s policy_names set to that policy (plus any others you list).

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Elb web tier security policy remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation