Homepage
About Snyk

ELB does not enforce latest TLS/SSL policy Affecting ELB service in AWS

0.0
medium
0
10
    Severity Framework Snyk CCSS
    Rule category Data / Encryption Protocols

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
    Frameworks
  • Snyk ID SNYK-CC-00466
  • credit Snyk Research Team
Report a new misconfiguration Found a mistake?

Description

The TLS (Transport Layer Security) protocol secures transmission of data over the internet using standard encryption technology. Versions prior to TLS 1.2 are deprecated and usage may pose security risks.

How to fix?

Set the appropriate SSL policy attribute for your load balancer to the latest AWS predefined security policy.

  • For aws_lb_listener, set the ssl_policy attribute to a valid security policy.

List of invalid policies:

  • ELBSecurityPolicy-2015-05
  • ELBSecurityPolicy-2016-08
  • ELBSecurityPolicy-TLS-1-0-2015-04
  • ELBSecurityPolicy-TLS-1-1-2017-01
  • ELBSecurityPolicy-FS-2018-06
  • ELBSecurityPolicy-FS-1-1-2019-08

Example Configuration

# aws_lb example
resource "aws_lb_listener" "lb_listener" {
  load_balancer_arn = "${aws_lb.lb.arn}"
  port = 443

  protocol = "HTTPS"
  ssl_policy = "ELBSecurityPolicy-TLS-1-2-Ext-2018-06"

  certificate_arn = "arn:aws:acm:us-east-1:123456789012:certificate/abcd1234-abcd-1234-abcd-abcd1234abcd"

  default_action {
    type = "fixed-response"
    fixed_response {
      content_type = "text/plain"
      message_body = ""
      status_code = "200"
    }
  }
}