> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Elb web tier security policy remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Latest AWS Security Policy for SSL Negotiations Should Be Used For Web-Tier ELBs" for AWS using the AWS console, follow the below steps:

        1. Log in to your AWS console and navigate to the EC2 dashboard.
        2. Click on the "Load Balancers" option from the left-hand menu.
        3. Select the web-tier ELB that you want to remediate and click on it.
        4. Click on the "Listeners" tab and select the listener that is using SSL.
        5. In the "SSL Certificate" section, select "Change" and choose the "AWS Managed Certificate" option.
        6. Choose the latest AWS security policy for SSL negotiations from the dropdown menu and click on "Save".

        After following these steps, your web-tier ELB will be configured to use the latest AWS security policy for SSL negotiations. This will ensure that your SSL connections are secure and protected against potential threats.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate this issue for AWS using AWS CLI, follow these steps:

        1. Open the AWS CLI on your local machine.

        2. Run the following command to get the load balancer security policy names:

        ```
        aws elb describe-load-balancer-policies --load-balancer-name <ELB_NAME>
        ```

        Replace `<ELB_NAME>` with the name of your load balancer.

        3. Identify the security policy that is currently in use for the load balancer. The security policy should be named `ELBSecurityPolicy-2016-08` or later.

        4. If the load balancer is using an older security policy, run the following command to update it:

        ```
        aws elb set-load-balancer-policies-for-backend-server --load-balancer-name <ELB_NAME> --policy-names <NEW_POLICY_NAME>
        ```

        Replace `<ELB_NAME>` with the name of your load balancer and `<NEW_POLICY_NAME>` with the name of the latest AWS security policy. The latest security policy name can be found in the AWS documentation.

        5. Verify that the new security policy is in use by running the following command:

        ```
        aws elb describe-load-balancer-attributes --load-balancer-name <ELB_NAME>
        ```

        Replace `<ELB_NAME>` with the name of your load balancer. The command should return a JSON object that includes the new security policy name.

        6. Once you have verified that the new security policy is in use, you have successfully remediated the misconfiguration.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Latest AWS Security Policy for SSL Negotiations Should Be Used For Web-Tier ELBs" in AWS using Python, you can follow the below steps:

        1. Import the required libraries:

        ```
        import boto3
        ```

        2. Create a boto3 client for Elastic Load Balancing:

        ```
        elb_client = boto3.client('elbv2')
        ```

        3. Get a list of all the load balancers:

        ```
        load_balancers = elb_client.describe_load_balancers()
        ```

        4. Loop through each load balancer and check if it is a web-tier ELB:

        ```
        for load_balancer in load_balancers['LoadBalancers']:
            if 'web' in load_balancer['LoadBalancerName']:
        ```

        5. If the load balancer is a web-tier ELB, update its SSL policy:

        ```
        elb_client.modify_load_balancer_attributes(
            LoadBalancerArn=load_balancer['LoadBalancerArn'],
            Attributes=[
                {
                    'Key': 'ssl_policy',
                    'Value': 'ELBSecurityPolicy-TLS-1-2-Ext-2018-06'
                },
            ]
        )
        ```

        6. The SSL policy `ELBSecurityPolicy-TLS-1-2-Ext-2018-06` is the latest AWS security policy for SSL negotiations. You can modify the code to use a different SSL policy if required.

        7. Finally, you can add this code to a script and run it periodically to ensure that all web-tier ELBs are using the latest AWS security policy for SSL negotiations.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_elb" "web" {
          name               = "ELB_NAME" # replace with your Classic ELB name
          subnets            = [SUBNET_IDS] # replace with list of subnet IDs
          security_groups    = [SECURITY_GROUP_IDS] # replace with list of SG IDs
          cross_zone_load_balancing = true

          listener {
            instance_port      = 80
            instance_protocol  = "http"
            lb_port            = 443 # update if your HTTPS listener uses a different port
            lb_protocol        = "https"
            ssl_certificate_id = "SSL_CERTIFICATE_ARN" # replace with your ACM/SSL cert ARN
          }

          # ... other listeners as needed
        }

        # Defines the SSL negotiation policy equivalent to
        # ELBSecurityPolicy-TLS13-1-2-2021-06 on the ELB.
        resource "aws_load_balancer_policy" "web_tls_policy" {
          load_balancer_name = aws_elb.web.name
          policy_name        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
          policy_type_name   = "SSLNegotiationPolicyType"
        }

        # Attach the policy to the HTTPS listener on port 443.
        # WARNING: This REPLACES all policies on this listener; if you have
        # other policies that must be preserved (e.g., Proxy Protocol on a
        # different port), add their names to the `policy_names` list.
        resource "aws_load_balancer_listener_policy" "web_tls_listener_policy" {
          load_balancer_name = aws_elb.web.name
          load_balancer_port = 443 # change if your HTTPS listener uses a different port

          policy_names = [
            aws_load_balancer_policy.web_tls_policy.policy_name,
            # "OTHER_POLICY_NAME_TO_PRESERVE", # add any existing policy names that must remain
          ]
        }
        ```

        This change updates the Classic ELB HTTPS listener to use the `ELBSecurityPolicy-TLS13-1-2-2021-06` negotiation policy without replacing the ELB itself. `terraform plan` should show creation (or update) of `aws_load_balancer_policy.web_tls_policy` and `aws_load_balancer_listener_policy.web_tls_listener_policy`, with the listener’s `policy_names` set to that policy (plus any others you list).
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>