Project: KICS (Provisioning / Security & Compliance)
File: 126c1788-23c2-4a10-906c-ef179f4f96ec.md

title: ELB Using Insecure Protocols hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 126c1788-23c2-4a10-906c-ef179f4f96ec Query name: ELB Using Insecure Protocols Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: ELB Predefined or Custom Security Policies must not use insecure protocols, to reduce the risk of the SSL connection between the client and the load balancer being exploited. That means the 'name' of 'policy_attributes' must not coincide with any of a predefined list of insecure protocols.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="41 30" resource "aws_elb" "positive1" { name = "wu-tang" availability_zones = ["us-east-1a"] listener { instance_port = 443 instance_protocol = "http" lb_port = 443 lb_protocol = "https" sslcertificateid = "arn:aws:iam::000000000000:server-certificate/wu-tang.net" } tags = { Name = "wu-tang" } } resource "awsloadbalancer_policy" "positive4" { loadbalancername = aws_elb.wu-tang.name policy_name = "wu-tang-ssl" policytypename = "SSLNegotiationPolicyType" policy_attribute { name = "Protocol-TLSv1.2" value = "true" } policy_attribute { name = "Protocol-TLSv1" value = "true" } } resource "awsloadbalancer_policy" "positive5" { loadbalancername = aws_elb.wu-tang.name policy_name = "wu-tang-ssl" policytypename = "SSLNegotiationPolicyType" policy_attribute { name = "Protocol-SSLv3" value = "true" } } ``` ```tf title="Negative test num. 1 - tf file" resource "aws_elb" "negative1" { name = "wu-tang" availability_zones = ["us-east-1a"] listener { instance_port = 443 instance_protocol = "http" lb_port = 443 lb_protocol = "https" sslcertificateid = "arn:aws:iam::000000000000:server-certificate/wu-tang.net" } tags = { Name = "wu-tang" } } resource "awsloadbalancer_policy" "negative2" { loadbalancername = aws_elb.wu-tang.name policy_name = "wu-tang-ca-pubkey-policy" policytypename = "PublicKeyPolicyType" policy_attribute { name = "PublicKey" value = file("wu-tang-pubkey") } } resource "awsloadbalancer_policy" "negative3" { loadbalancername = aws_elb.wu-tang.name policy_name = "wu-tang-root-ca-backend-auth-policy" policytypename = "BackendServerAuthenticationPolicyType" policy_attribute { name = "PublicKeyPolicyName" value = awsloadbalancerpolicy.wu-tang-root-ca-pubkey-policy.policyname } } resource "awsloadbalancer_policy" "negative4" { loadbalancername = aws_elb.wu-tang.name policy_name = "wu-tang-ssl" policytypename = "SSLNegotiationPolicyType" policy_attribute { name = "ECDHE-ECDSA-AES128-GCM-SHA256" value = "true" } policy_attribute { name = "Protocol-TLSv1.2" value = "true" } } resource "awsloadbalancer_policy" "negative5" { loadbalancername = aws_elb.wu-tang.name policy_name = "wu-tang-ssl" policytypename = "SSLNegotiationPolicyType" policy_attribute { name = "Reference-Security-Policy" value = "ELBSecurityPolicy-TLS-1-1-2017-01" } } resource "awsloadbalancerbackendserver_policy" "negative6" { loadbalancername = aws_elb.wu-tang.name instance_port = 443 policy_names = [ awsloadbalancerpolicy.wu-tang-root-ca-backend-auth-policy.policyname, ] } resource "awsloadbalancerlistenerpolicy" "negative7" { loadbalancername = aws_elb.wu-tang.name loadbalancerport = 443 policy_names = [ awsloadbalancerpolicy.wu-tang-ssl.policyname, ] } ```