Project: KICS (Provisioning / Security & Compliance)
File: 809f77f8-d10e-4842-a84f-3be7b6ff1190.md

title: ELB Using Weak Ciphers hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 809f77f8-d10e-4842-a84f-3be7b6ff1190 Query name: ELB Using Weak Ciphers Platform: CloudFormation Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: ELB Predefined or Custom Security Policies must not use weak ciphers, to reduce the risk of the SSL connection between the client and the load balancer being exploited. That means the ELB Listeners must not have Policies that posses Ciphers that coincide with any of a predefined list of weak ciphers.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="34 27 29" Resources: MyLoadBalancer: Type: AWS::ElasticLoadBalancing::LoadBalancer Properties: AvailabilityZones: "us-east-2a" CrossZone: true Listeners: InstancePort: '80' InstanceProtocol: HTTP LoadBalancerPort: '443' Protocol: HTTPS PolicyNames: My-SSLNegotiation-Policy SSLCertificateId: arn:aws:iam::123456789012:server-certificate/my-server-certificate HealthCheck: Target: HTTP:80/ HealthyThreshold: '2' UnhealthyThreshold: '3' Interval: '10' Timeout: '5' Policies: PolicyName: My-SSLNegotiation-Policy PolicyType: SSLNegotiationPolicyType Attributes: Name: TLSRSANULL_SHA1 Value: ELBSecurityPolicy-TLS-1-2-2017-01 Name: DHE-DSS-DES-CBC3-SHA Value: ELBSecurityPolicy-TLS-1-2-2017-01 PolicyName: My-SSLNegotiation-Policy2 PolicyType: SSLNegotiationPolicyType Attributes: Name: TLSDHEPSKWITHNULL_SHA256 Value: ELBSecurityPolicy-TLS-1-2-2017-01 ``` ```json title="Positive test num. 2 - json file" hl_lines="40 49 35" { "Resources": { "MyLoadBalancer": { "Type": "AWS::ElasticLoadBalancing::LoadBalancer", "Properties": { "AvailabilityZones": [ "us-east-2a" ], "CrossZone": true, "Listeners": [ { "InstancePort": "80", "InstanceProtocol": "HTTP", "LoadBalancerPort": "443", "Protocol": "HTTPS", "PolicyNames": [ "My-SSLNegotiation-Policy" ], "SSLCertificateId": "arn:aws:iam::123456789012:server-certificate/my-server-certificate" } ], "HealthCheck": { "Target": "HTTP:80/", "HealthyThreshold": "2", "UnhealthyThreshold": "3", "Interval": "10", "Timeout": "5" }, "Policies": [ { "PolicyName": "My-SSLNegotiation-Policy", "PolicyType": "SSLNegotiationPolicyType", "Attributes": [ { "Name": "TLSRSANULL_SHA1", "Value": "ELBSecurityPolicy-TLS-1-2-2017-01" }, { "Value": "ELBSecurityPolicy-TLS-1-2-2017-01", "Name": "DHE-DSS-DES-CBC3-SHA" } ] }, { "PolicyName": "My-SSLNegotiation-Policy2", "PolicyType": "SSLNegotiationPolicyType", "Attributes": [ { "Name": "TLSDHEPSKWITHNULL_SHA256", "Value": "ELBSecurityPolicy-TLS-1-2-2017-01" } ] } ] } } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: MyLoadBalancer: Type: AWS::ElasticLoadBalancing::LoadBalancer Properties: AvailabilityZones: "us-east-2a" CrossZone: true Listeners: InstancePort: '80' InstanceProtocol: HTTP LoadBalancerPort: '443' Protocol: HTTPS PolicyNames: My-SSLNegotiation-Policy SSLCertificateId: arn:aws:iam::123456789012:server-certificate/my-server-certificate HealthCheck: Target: HTTP:80/ HealthyThreshold: '2' UnhealthyThreshold: '3' Interval: '10' Timeout: '5' Policies: PolicyName: My-SSLNegotiation-Policy PolicyType: SSLNegotiationPolicyType Attributes: Name: Reference-Security-Policy Value: ELBSecurityPolicy-TLS-1-2-2017-01 ``` ```json title="Negative test num. 2 - json file" { "Resources": { "MyLoadBalancer": { "Type": "AWS::ElasticLoadBalancing::LoadBalancer", "Properties": { "AvailabilityZones": [ "us-east-2a" ], "CrossZone": true, "Listeners": [ { "SSLCertificateId": "arn:aws:iam::123456789012:server-certificate/my-server-certificate", "InstancePort": "80", "InstanceProtocol": "HTTP", "LoadBalancerPort": "443", "Protocol": "HTTPS", "PolicyNames": [ "My-SSLNegotiation-Policy" ] } ], "HealthCheck": { "HealthyThreshold": "2", "UnhealthyThreshold": "3", "Interval": "10", "Timeout": "5", "Target": "HTTP:80/" }, "Policies": [ { "PolicyType": "SSLNegotiationPolicyType", "Attributes": [ { "Name": "Reference-Security-Policy", "Value": "ELBSecurityPolicy-TLS-1-2-2017-01" } ], "PolicyName": "My-SSLNegotiation-Policy" } ] } } } } ```