Project: KICS (Provisioning / Security & Compliance)
File: 80908a75-586b-4c61-ab04-490f4f4525b8.md

title: ELB Without Secure Protocol hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 80908a75-586b-4c61-ab04-490f4f4525b8 Query name: ELB Without Secure Protocol Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: Check if the ELB is setup with SSL or HTTPS for secure communication<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11 13" Resources: MyLoadBalancer: Type: AWS::ElasticLoadBalancing::LoadBalancer Properties: AvailabilityZones: "us-east-2a" CrossZone: true Listeners: InstancePort: '80' InstanceProtocol: HTTP LoadBalancerPort: '443' Protocol: HTTP PolicyNames: My-SSLNegotiation-Policy SSLCertificateId: arn:aws:iam::123456789012:server-certificate/my-server-certificate HealthCheck: Target: HTTP:80/ HealthyThreshold: '2' UnhealthyThreshold: '3' Interval: '10' Timeout: '5' Policies: PolicyName: My-SSLNegotiation-Policy PolicyType: SSLNegotiationPolicyType Attributes: Name: Reference-Security-Policy Value: ELBSecurityPolicy-TLS-1-2-2017-01 ``` ```json title="Positive test num. 2 - json file" hl_lines="9 11" { "Resources": { "MyLoadBalancer": { "Type": "AWS::ElasticLoadBalancing::LoadBalancer", "Properties": { "Listeners": [ { "InstancePort": "80", "InstanceProtocol": "HTTP", "LoadBalancerPort": "443", "Protocol": "HTTP", "PolicyNames": [ "My-SSLNegotiation-Policy" ], "SSLCertificateId": "arn:aws:iam::123456789012:server-certificate/my-server-certificate" } ], "HealthCheck": { "Target": "HTTP:80/", "HealthyThreshold": "2", "UnhealthyThreshold": "3", "Interval": "10", "Timeout": "5" }, "Policies": [ { "PolicyName": "My-SSLNegotiation-Policy", "PolicyType": "SSLNegotiationPolicyType", "Attributes": [ { "Name": "Reference-Security-Policy", "Value": "ELBSecurityPolicy-TLS-1-2-2017-01" } ] } ], "AvailabilityZones": [ "us-east-2a" ], "CrossZone": true } } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: MyLoadBalancer1: Type: AWS::ElasticLoadBalancing::LoadBalancer Properties: AvailabilityZones: "us-east-2a" CrossZone: true Listeners: InstancePort: '80' InstanceProtocol: HTTPS LoadBalancerPort: '443' Protocol: HTTPS PolicyNames: My-SSLNegotiation-Policy SSLCertificateId: arn:aws:iam::123456789012:server-certificate/my-server-certificate HealthCheck: Target: HTTP:80/ HealthyThreshold: '2' UnhealthyThreshold: '3' Interval: '10' Timeout: '5' Policies: PolicyName: My-SSLNegotiation-Policy PolicyType: SSLNegotiationPolicyType Attributes: Name: Reference-Security-Policy Value: ELBSecurityPolicy-TLS-1-2-2017-01 ``` ```json title="Negative test num. 2 - json file" { "Resources": { "MyLoadBalancer1": { "Type": "AWS::ElasticLoadBalancing::LoadBalancer", "Properties": { "CrossZone": true, "Listeners": [ { "InstancePort": "80", "InstanceProtocol": "HTTPS", "LoadBalancerPort": "443", "Protocol": "HTTPS", "PolicyNames": [ "My-SSLNegotiation-Policy" ], "SSLCertificateId": "arn:aws:iam::123456789012:server-certificate/my-server-certificate" } ], "HealthCheck": { "Interval": "10", "Timeout": "5", "Target": "HTTP:80/", "HealthyThreshold": "2", "UnhealthyThreshold": "3" }, "Policies": [ { "PolicyName": "My-SSLNegotiation-Policy", "PolicyType": "SSLNegotiationPolicyType", "Attributes": [ { "Name": "Reference-Security-Policy", "Value": "ELBSecurityPolicy-TLS-1-2-2017-01" } ] } ], "AvailabilityZones": [ "us-east-2a" ] } } } } ``` ```yaml title="Negative test num. 3 - yaml file" Resources: MyLoadBalancer2: Type: AWS::ElasticLoadBalancing::LoadBalancer Properties: AvailabilityZones: "us-east-2a" CrossZone: true Listeners: InstancePort: '9443' InstanceProtocol: SSL LoadBalancerPort: '443' Protocol: SSL PolicyNames: My-SSLNegotiation-Policy SSLCertificateId: arn:aws:iam::123456789012:server-certificate/my-server-certificate Policies: PolicyName: My-SSLNegotiation-Policy PolicyType: SSLNegotiationPolicyType Attributes: Name: Reference-Security-Policy Value: ELBSecurityPolicy-TLS-1-2-2017-01 ``` <details><summary>Negative test num. 4 - json file</summary> ```json { "Resources": { "MyLoadBalancer2": { "Properties": { "AvailabilityZones": [ "us-east-2a" ], "CrossZone": true, "Listeners": [ { "InstancePort": "9443", "InstanceProtocol": "SSL", "LoadBalancerPort": "443", "PolicyNames": [ "My-SSLNegotiation-Policy" ], "Protocol": "SSL", "SSLCertificateId": "arn:aws:iam::123456789012:server-certificate/my-server-certificate" } ], "Policies": [ { "Attributes": [ { "Name": "Reference-Security-Policy", "Value": "ELBSecurityPolicy-TLS-1-2-2017-01" } ], "PolicyName": "My-SSLNegotiation-Policy", "PolicyType": "SSLNegotiationPolicyType" } ] }, "Type": "AWS::ElasticLoadBalancing::LoadBalancer" } } } ``` </details>