Project: KICS (Provisioning / Security & Compliance)
File: 2034fb37-bc23-4ca0-8d95-2b9f15829ab5.md

title: ELB Using Weak Ciphers hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 2034fb37-bc23-4ca0-8d95-2b9f15829ab5 Query name: ELB Using Weak Ciphers Platform: Ansible Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: ELB Predefined or Custom Security Policies must not use weak ciphers, to reduce the risk of the SSL connection between the client and the load balancer being exploited. That means the 'SslPolicy' of 'listeners' must not coincide with any of a predefined list of weak ciphers.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="3 70 40 52 21 89" name: elb1 community.aws.elbapplicationlb: name: myelb1 security_groups: sg-12345678 my-sec-group subnets: subnet-012345678 subnet-abcdef000 state: present name: elb2 community.aws.elbapplicationlb: name: myelb2 security_groups: sg-12345678 my-sec-group subnets: subnet-012345678 subnet-abcdef000 listeners: Protocol: HTTP # Required. The protocol for connections from clients to the load balancer (HTTP or HTTPS) (case-sensitive). Port: 80 # Required. The port on which the load balancer is listening. Certificates: # The ARN of the certificate (only one certficate ARN should be provided) CertificateArn: arn:aws:iam::12345678987:server-certificate/test.domain.com DefaultActions: Type: forward # Required. TargetGroupName: # Required. The name of the target group state: present name: elb3 community.aws.elbapplicationlb: name: myelb3 security_groups: sg-12345678 my-sec-group subnets: subnet-012345678 subnet-abcdef000 listeners: Protocol: HTTP # Required. The protocol for connections from clients to the load balancer (HTTP or HTTPS) (case-sensitive). Port: 80 # Required. The port on which the load balancer is listening. SslPolicy: DHE-DSS-DES-CBC3-SHA Certificates: # The ARN of the certificate (only one certficate ARN should be provided) CertificateArn: arn:aws:iam::12345678987:server-certificate/test.domain.com DefaultActions: Type: forward # Required. TargetGroupName: # Required. The name of the target group state: present name: elb4 community.aws.elbnetworklb: name: myelb4 security_groups: sg-12345678 my-sec-group subnets: subnet-012345678 subnet-abcdef000 state: present name: elb5 community.aws.elbnetworklb: name: myelb5 security_groups: sg-12345678 my-sec-group subnets: subnet-012345678 subnet-abcdef000 listeners: Protocol: HTTP Port: 80 Certificates: CertificateArn: arn:aws:iam::12345678987:server-certificate/test.domain.com DefaultActions: Type: forward TargetGroupName: target state: present name: elb6 community.aws.elbnetworklb: name: myelb6 security_groups: sg-12345678 my-sec-group subnets: subnet-012345678 subnet-abcdef000 listeners: Protocol: HTTP Port: 80 SslPolicy: TLSRSANULL_MD5 Certificates: CertificateArn: arn:aws:iam::12345678987:server-certificate/test.domain.com DefaultActions: Type: forward TargetGroupName: target state: present ``` ```yaml title="Negative test num. 1 - yaml file" name: elb1 community.aws.elbapplicationlb: name: myelb1 security_groups: sg-12345678 my-sec-group subnets: subnet-012345678 subnet-abcdef000 listeners: Protocol: HTTP # Required. The protocol for connections from clients to the load balancer (HTTP or HTTPS) (case-sensitive). Port: 80 # Required. The port on which the load balancer is listening. SslPolicy: ELBSecurityPolicy-2015-05 Certificates: # The ARN of the certificate (only one certficate ARN should be provided) CertificateArn: arn:aws:iam::12345678987:server-certificate/test.domain.com DefaultActions: Type: forward # Required. TargetGroupName: # Required. The name of the target group state: present name: elb2 community.aws.elbnetworklb: name: myelb2 security_groups: sg-12345678 my-sec-group subnets: subnet-012345678 subnet-abcdef000 listeners: Protocol: HTTP # Required. The protocol for connections from clients to the load balancer (HTTP or HTTPS) (case-sensitive). Port: 80 # Required. The port on which the load balancer is listening. SslPolicy: ELBSecurityPolicy-2015-05 Certificates: # The ARN of the certificate (only one certficate ARN should be provided) CertificateArn: arn:aws:iam::12345678987:server-certificate/test.domain.com DefaultActions: Type: forward # Required. TargetGroupName: # Required. The name of the target group state: present ```