Project: KICS (Provisioning / Security & Compliance)
File: 275a3217-ca37-40c1-a6cf-bb57d245ab32.md

title: ALB Listening on HTTP hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 275a3217-ca37-40c1-a6cf-bb57d245ab32 Query name: ALB Listening on HTTP Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: AWS Application Load Balancer (alb) should not listen on HTTP<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="25 13" AWSTemplateFormatVersion: 2010-09-09 Resources: MyLoadBalancer: Type: AWS::ElasticLoadBalancing::LoadBalancer Properties: AvailabilityZones: "us-east-2a" CrossZone: true Listeners: InstancePort: '80' InstanceProtocol: HTTPS LoadBalancerPort: '443' Protocol: HTTP PolicyNames: My-SSLNegotiation-Policy SSLCertificateId: arn:aws:iam::123456789012:server-certificate/my-server-certificate Scheme: internal HTTPlistener: Type: "AWS::ElasticLoadBalancingV2::Listener" Properties: DefaultActions: Type: redirect LoadBalancerArn: !Ref myLoadBalancer Port: 80 Protocol: HTTP ``` ```json title="Positive test num. 2 - json file" hl_lines="9 35" { "Resources": { "MyLoadBalancer": { "Type": "AWS::ElasticLoadBalancing::LoadBalancer", "Properties": { "CrossZone": true, "Listeners": [ { "Protocol": "HTTP", "PolicyNames": [ "My-SSLNegotiation-Policy" ], "SSLCertificateId": "arn:aws:iam::123456789012:server-certificate/my-server-certificate", "InstancePort": "80", "InstanceProtocol": "HTTPS", "LoadBalancerPort": "443" } ], "Scheme": "internal", "AvailabilityZones": [ "us-east-2a" ] } }, "HTTPlistener": { "Type": "AWS::ElasticLoadBalancingV2::Listener", "Properties": { "DefaultActions": [ { "Type": "redirect" } ], "LoadBalancerArn": "myLoadBalancer", "Port": 80, "Protocol": "HTTP" } } }, "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z" } ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="16" Resources: HTTPlistener: Type: "AWS::ElasticLoadBalancingV2::Listener" Properties: DefaultActions: Type: "redirect" RedirectConfig: Protocol: "HTTPS" Port: "443" Host: "#{host}" Path: "/#{path}" Query: "#{query}" StatusCode: "HTTP_301" LoadBalancerArn: !Ref myLoadBalancer Port: 80 Protocol: "HTTP" ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Resources: MyLoadBalancer: Type: AWS::ElasticLoadBalancing::LoadBalancer Properties: AvailabilityZones: "us-east-2a" CrossZone: true Listeners: InstancePort: '80' InstanceProtocol: HTTPS LoadBalancerPort: '443' Protocol: HTTPS PolicyNames: My-SSLNegotiation-Policy SSLCertificateId: arn:aws:iam::123456789012:server-certificate/my-server-certificate Scheme: internal ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Resources": { "MyLoadBalancer": { "Type": "AWS::ElasticLoadBalancing::LoadBalancer", "Properties": { "CrossZone": true, "Listeners": [ { "Protocol": "HTTPS", "PolicyNames": [ "My-SSLNegotiation-Policy" ], "SSLCertificateId": "arn:aws:iam::123456789012:server-certificate/my-server-certificate", "InstancePort": "80", "InstanceProtocol": "HTTPS", "LoadBalancerPort": "443" } ], "Scheme": "internal", "AvailabilityZones": [ "us-east-2a" ] } } } } ```