Homepage

ELBv1 listener protocol is set to http Affecting ELB service in AWS

Severity

0.0
critical
0
10
Severity Framework
Snyk CCSS
Rule category
Data/ Encryption in Transit

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
AWS-Well-ArchitectedCIS-ControlsCSA-CCMGDPRHIPAAISO-27001NIST-800-53PCI-DSSSOC-2
  • Snyk IDSNYK-CC-00150
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

Communication with an Elastic Load Balancing (ELB) should be encrypted to help prevent unauthorized access to data. To protect data in transit, ELB listener protocol should not be set to HTTP.

How to fix?

Set the listener.lb_protocol attribute to https.

Example Configuration

resource "aws_elb" "web" {
  name            = "tf-test-elb"
  subnets         = ["${aws_subnet.tf_test_subnet.id}"]
  security_groups = ["${aws_security_group.elb.id}"]

  listener {
    instance_port      = 8000
    instance_protocol  = "http"
    lb_port            = 443
    lb_protocol        = "https"
    ssl_certificate_id = "${aws_iam_server_certificate.test_cert.arn}"
  }

  health_check {
    healthy_threshold   = 2
    unhealthy_threshold = 2
    timeout             = 3
    target              = "HTTP:80/"
    interval            = 30
  }


  cross_zone_load_balancing   = true
  idle_timeout                = 400
  connection_draining         = true
  connection_draining_timeout = 400
}