Homepage

ELB does not enforce latest TLS/SSL policy Affecting ELB service in AWS

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
Data/ Encryption Protocols

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
  • Snyk IDSNYK-CC-00466
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

The TLS (Transport Layer Security) protocol secures transmission of data over the internet using standard encryption technology. Versions prior to TLS 1.2 are deprecated and usage may pose security risks.

How to fix?

Set the appropriate SSL policy attribute for your load balancer to the latest AWS predefined security policy.

  • For aws_lb_listener, set the ssl_policy attribute to a valid security policy.

List of invalid policies:

  • ELBSecurityPolicy-2015-05
  • ELBSecurityPolicy-2016-08
  • ELBSecurityPolicy-TLS-1-0-2015-04
  • ELBSecurityPolicy-TLS-1-1-2017-01
  • ELBSecurityPolicy-FS-2018-06
  • ELBSecurityPolicy-FS-1-1-2019-08

Example Configuration

# aws_lb example
resource "aws_lb_listener" "lb_listener" {
  load_balancer_arn = "${aws_lb.lb.arn}"
  port = 443

  protocol = "HTTPS"
  ssl_policy = "ELBSecurityPolicy-TLS-1-2-Ext-2018-06"

  certificate_arn = "arn:aws:acm:us-east-1:123456789012:certificate/abcd1234-abcd-1234-abcd-abcd1234abcd"

  default_action {
    type = "fixed-response"
    fixed_response {
      content_type = "text/plain"
      message_body = ""
      status_code = "200"
    }
  }
}