Project: KICS (Provisioning / Security & Compliance)
File: 730a5951-2760-407a-b032-dd629b55c23a.md

title: ELB Using Insecure Protocols hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 730a5951-2760-407a-b032-dd629b55c23a Query name: ELB Using Insecure Protocols Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: ELB Predefined or Custom Security Policies must not use insecure protocols, to reduce the risk of the SSL connection between the client and the load balancer being exploited. That means the 'SslPolicy' of 'listeners' must not coincide with any of a predefined list of insecure protocols.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="3 70 40 52 21 89" name: elb1 community.aws.elbapplicationlb: name: myelb1 security_groups: sg-12345678 my-sec-group subnets: subnet-012345678 subnet-abcdef000 state: present name: elb2 community.aws.elbapplicationlb: name: myelb2 security_groups: sg-12345678 my-sec-group subnets: subnet-012345678 subnet-abcdef000 listeners: Protocol: HTTP # Required. The protocol for connections from clients to the load balancer (HTTP or HTTPS) (case-sensitive). Port: 80 # Required. The port on which the load balancer is listening. Certificates: # The ARN of the certificate (only one certficate ARN should be provided) CertificateArn: arn:aws:iam::12345678987:server-certificate/test.domain.com DefaultActions: Type: forward # Required. TargetGroupName: # Required. The name of the target group state: present name: elb3 community.aws.elbapplicationlb: name: myelb3 security_groups: sg-12345678 my-sec-group subnets: subnet-012345678 subnet-abcdef000 listeners: Protocol: HTTP # Required. The protocol for connections from clients to the load balancer (HTTP or HTTPS) (case-sensitive). Port: 80 # Required. The port on which the load balancer is listening. SslPolicy: Protocol-SSLv2 Certificates: # The ARN of the certificate (only one certficate ARN should be provided) CertificateArn: arn:aws:iam::12345678987:server-certificate/test.domain.com DefaultActions: Type: forward # Required. TargetGroupName: # Required. The name of the target group state: present name: elb4 community.aws.elbnetworklb: name: myelb4 security_groups: sg-12345678 my-sec-group subnets: subnet-012345678 subnet-abcdef000 state: present name: elb5 community.aws.elbnetworklb: name: myelb5 security_groups: sg-12345678 my-sec-group subnets: subnet-012345678 subnet-abcdef000 listeners: Protocol: HTTP # Required. The protocol for connections from clients to the load balancer (HTTP or HTTPS) (case-sensitive). Port: 80 # Required. The port on which the load balancer is listening. Certificates: # The ARN of the certificate (only one certficate ARN should be provided) CertificateArn: arn:aws:iam::12345678987:server-certificate/test.domain.com DefaultActions: Type: forward # Required. TargetGroupName: # Required. The name of the target group state: present name: elb6 community.aws.elbnetworklb: name: myelb6 security_groups: sg-12345678 my-sec-group subnets: subnet-012345678 subnet-abcdef000 listeners: Protocol: HTTP # Required. The protocol for connections from clients to the load balancer (HTTP or HTTPS) (case-sensitive). Port: 80 # Required. The port on which the load balancer is listening. SslPolicy: Protocol-TLSv1.1 Certificates: # The ARN of the certificate (only one certficate ARN should be provided) CertificateArn: arn:aws:iam::12345678987:server-certificate/test.domain.com DefaultActions: Type: forward # Required. TargetGroupName: # Required. The name of the target group state: present ``` ```yaml title="Negative test num. 1 - yaml file" name: elb1 community.aws.elbapplicationlb: name: myelb1 security_groups: sg-12345678 my-sec-group subnets: subnet-012345678 subnet-abcdef000 listeners: Protocol: HTTP # Required. The protocol for connections from clients to the load balancer (HTTP or HTTPS) (case-sensitive). Port: 80 # Required. The port on which the load balancer is listening. SslPolicy: ELBSecurityPolicy-2015-05 Certificates: # The ARN of the certificate (only one certficate ARN should be provided) CertificateArn: arn:aws:iam::12345678987:server-certificate/test.domain.com DefaultActions: Type: forward # Required. TargetGroupName: # Required. The name of the target group state: present name: elb2 community.aws.elbnetworklb: name: myelb2 security_groups: sg-12345678 my-sec-group subnets: subnet-012345678 subnet-abcdef000 listeners: Protocol: HTTP # Required. The protocol for connections from clients to the load balancer (HTTP or HTTPS) (case-sensitive). Port: 80 # Required. The port on which the load balancer is listening. SslPolicy: ELBSecurityPolicy-2015-05 Certificates: # The ARN of the certificate (only one certficate ARN should be provided) CertificateArn: arn:aws:iam::12345678987:server-certificate/test.domain.com DefaultActions: Type: forward # Required. TargetGroupName: # Required. The name of the target group state: present ```