Project: KICS (Provisioning / Security & Compliance)
File: 4a800e14-c94a-442d-9067-5a2e9f6c0a4c.md

title: ELB Using Weak Ciphers hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 4a800e14-c94a-442d-9067-5a2e9f6c0a4c Query name: ELB Using Weak Ciphers Platform: Terraform Severity: <span style="color:#bb2124">High</span> Category: Encryption URL: ELB Predefined or Custom Security Policies must not use weak ciphers, to reduce the risk of the SSL connection between the client and the load balancer being exploited. That means the 'name' of 'policy_attributes' must not coincide with any of a predefined list of weak ciphers.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="41 74 63" resource "aws_elb" "positive1" { name = "wu-tang" availability_zones = ["us-east-1a"] listener { instance_port = 443 instance_protocol = "http" lb_port = 443 lb_protocol = "https" sslcertificateid = "arn:aws:iam::000000000000:server-certificate/wu-tang.net" } tags = { Name = "wu-tang" } } resource "awsloadbalancer_policy" "positive2" { loadbalancername = aws_elb.wu-tang.name policy_name = "wu-tang-ca-pubkey-policy" policytypename = "PublicKeyPolicyType" policy_attribute { name = "PublicKey" value = file("wu-tang-pubkey") } } resource "awsloadbalancer_policy" "positive3" { loadbalancername = aws_elb.wu-tang.name policy_name = "wu-tang-root-ca-backend-auth-policy" policytypename = "BackendServerAuthenticationPolicyType" policy_attribute { name = "PublicKeyPolicyName" value = awsloadbalancerpolicy.wu-tang-root-ca-pubkey-policy.policyname } } resource "awsloadbalancer_policy" "positive4" { loadbalancername = aws_elb.wu-tang.name policy_name = "wu-tang-ssl" policytypename = "SSLNegotiationPolicyType" policy_attribute { name = "Protocol-TLSv1.2" value = "true" } policy_attribute { name = "TLSRSAARCFOUR128SHA1" value = "true" } } resource "awsloadbalancer_policy" "positive5" { loadbalancername = aws_elb.wu-tang.name policy_name = "wu-tang-ssl" policytypename = "SSLNegotiationPolicyType" policy_attribute { name = "DES-CBC3-SHA" value = "true" } } resource "awsloadbalancer_policy" "positive6" { loadbalancername = aws_elb.wu-tang.name policy_name = "wu-tang-ssl" policytypename = "SSLNegotiationPolicyType" policy_attribute { name = "TLSECDHEECDSAWITHARIA256GCM_SHA384" value = "true" } } resource "awsloadbalancer_policy" "positive7" { loadbalancername = aws_elb.wu-tang.name policy_name = "wu-tang-ssl" policytypename = "SSLNegotiationPolicyType" policy_attribute { name = "Reference-Security-Policy" value = "ELBSecurityPolicy-TLS-1-1-2017-01" } } resource "awsloadbalancerbackendserver_policy" "positive8" { loadbalancername = aws_elb.wu-tang.name instance_port = 443 policy_names = [ awsloadbalancerpolicy.wu-tang-root-ca-backend-auth-policy.policyname, ] } resource "awsloadbalancerlistenerpolicy" "positive9" { loadbalancername = aws_elb.wu-tang.name loadbalancerport = 443 policy_names = [ awsloadbalancerpolicy.wu-tang-ssl.policyname, ] } ``` ```tf title="Negative test num. 1 - tf file" resource "aws_elb" "negative1" { name = "wu-tang" availability_zones = ["us-east-1a"] listener { instance_port = 443 instance_protocol = "http" lb_port = 443 lb_protocol = "https" sslcertificateid = "arn:aws:iam::000000000000:server-certificate/wu-tang.net" } tags = { Name = "wu-tang" } } resource "awsloadbalancer_policy" "negative2" { loadbalancername = aws_elb.wu-tang.name policy_name = "wu-tang-ca-pubkey-policy" policytypename = "PublicKeyPolicyType" policy_attribute { name = "PublicKey" value = file("wu-tang-pubkey") } } resource "awsloadbalancer_policy" "negative3" { loadbalancername = aws_elb.wu-tang.name policy_name = "wu-tang-root-ca-backend-auth-policy" policytypename = "BackendServerAuthenticationPolicyType" policy_attribute { name = "PublicKeyPolicyName" value = awsloadbalancerpolicy.wu-tang-root-ca-pubkey-policy.policyname } } resource "awsloadbalancer_policy" "negative4" { loadbalancername = aws_elb.wu-tang.name policy_name = "wu-tang-ssl" policytypename = "SSLNegotiationPolicyType" policy_attribute { name = "ECDHE-ECDSA-AES128-GCM-SHA256" value = "true" } policy_attribute { name = "Protocol-TLSv1.2" value = "true" } } resource "awsloadbalancer_policy" "negative5" { loadbalancername = aws_elb.wu-tang.name policy_name = "wu-tang-ssl" policytypename = "SSLNegotiationPolicyType" policy_attribute { name = "Reference-Security-Policy" value = "ELBSecurityPolicy-TLS-1-1-2017-01" } } resource "awsloadbalancerbackendserver_policy" "negative6" { loadbalancername = aws_elb.wu-tang.name instance_port = 443 policy_names = [ awsloadbalancerpolicy.wu-tang-root-ca-backend-auth-policy.policyname, ] } resource "awsloadbalancerlistenerpolicy" "negative7" { loadbalancername = aws_elb.wu-tang.name loadbalancerport = 443 policy_names = [ awsloadbalancerpolicy.wu-tang-ssl.policyname, ] } ```