AWS Elastic Load Balancer (Classic) SSL negotiation policy configured with insecure ciphers
This policy identifies Elastic Load Balancers (Classic) which are configured with SSL negotiation policy containing insecure ciphers. An SSL cipher is an encryption algorithm that uses encryption keys to create a coded message. SSL protocols use several SSL ciphers to encrypt data over the Internet. As many of the other ciphers are not secure, it is recommended to use only the ciphers recommended in the following AWS link: https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-ssl-security-policy.html.
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Sign in to the AWS console
2. In the console, select the specific region from region drop down on the top right corner, for which the alert is generated
3. Go to the EC2 Dashboard, and select 'Load Balancers'
4. Click on the reported Load Balancer
5. On 'Listeners' tab, Change the cipher for the 'HTTPS/SSL' rule
For a 'Predefined Security Policy', change 'Cipher' to 'ELBSecurityPolicy-TLS‌-1-2-2017-01' or latest
For a 'Custom Security Policy', select from the secure ciphers as recommended in the below AWS link:
https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-ssl-security-policy.html
6. 'Save' your changes.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elb-describe-load-balancers' AND json.rule = "policies[*].policyAttributeDescriptions[?(@.attributeName=='DHE-RSA-AES128-SHA'|| @.attributeName=='DHE-DSS-AES128-SHA' || @.attributeName=='CAMELLIA128-SHA' || @.attributeName=='EDH-RSA-DES-CBC3-SHA' || @.attributeName=='DES-CBC3-SHA' || @.attributeName=='ECDHE-RSA-RC4-SHA' || @.attributeName=='RC4-SHA' || @.attributeName=='ECDHE-ECDSA-RC4-SHA' || @.attributeName=='DHE-DSS-AES256-GCM-SHA384' || @.attributeName=='DHE-RSA-AES256-GCM-SHA384' || @.attributeName=='DHE-RSA-AES256-SHA256' || @.attributeName=='DHE-DSS-AES256-SHA256' || @.attributeName=='DHE-RSA-AES256-SHA' || @.attributeName=='DHE-DSS-AES256-SHA' || @.attributeName=='DHE-RSA-CAMELLIA256-SHA' || @.attributeName=='DHE-DSS-CAMELLIA256-SHA' || @.attributeName=='CAMELLIA256-SHA' || @.attributeName=='EDH-DSS-DES-CBC3-SHA' || @.attributeName=='DHE-DSS-AES128-GCM-SHA256' || @.attributeName=='DHE-RSA-AES128-GCM-SHA256' || @.attributeName=='DHE-RSA-AES128-SHA256' || @.attributeName=='DHE-DSS-AES128-SHA256' || @.attributeName=='DHE-RSA-CAMELLIA128-SHA' || @.attributeName=='DHE-DSS-CAMELLIA128-SHA' || @.attributeName=='ADH-AES128-GCM-SHA256' || @.attributeName=='ADH-AES128-SHA' || @.attributeName=='ADH-AES128-SHA256' || @.attributeName=='ADH-AES256-GCM-SHA384' || @.attributeName=='ADH-AES256-SHA' || @.attributeName=='ADH-AES256-SHA256' || @.attributeName=='ADH-CAMELLIA128-SHA' || @.attributeName=='ADH-CAMELLIA256-SHA' || @.attributeName=='ADH-DES-CBC3-SHA' || @.attributeName=='ADH-DES-CBC-SHA' || @.attributeName=='ADH-RC4-MD5' || @.attributeName=='ADH-SEED-SHA' || @.attributeName=='DES-CBC-SHA' || @.attributeName=='DHE-DSS-SEED-SHA' || @.attributeName=='DHE-RSA-SEED-SHA' || @.attributeName=='EDH-DSS-DES-CBC-SHA' || @.attributeName=='EDH-RSA-DES-CBC-SHA' || @.attributeName=='IDEA-CBC-SHA' || @.attributeName=='RC4-MD5' || @.attributeName=='SEED-SHA' || @.attributeName=='DES-CBC3-MD5' || @.attributeName=='DES-CBC-MD5' || @.attributeName=='RC2-CBC-MD5' || @.attributeName=='PSK-AES256-CBC-SHA' || @.attributeName=='PSK-3DES-EDE-CBC-SHA' || @.attributeName=='KRB5-DES-CBC3-SHA' || @.attributeName=='KRB5-DES-CBC3-MD5' || @.attributeName=='PSK-AES128-CBC-SHA' || @.attributeName=='PSK-RC4-SHA' || @.attributeName=='KRB5-RC4-SHA' || @.attributeName=='KRB5-RC4-MD5' || @.attributeName=='KRB5-DES-CBC-SHA' || @.attributeName=='KRB5-DES-CBC-MD5' || @.attributeName=='EXP-EDH-RSA-DES-CBC-SHA' || @.attributeName=='EXP-EDH-DSS-DES-CBC-SHA' || @.attributeName=='EXP-ADH-DES-CBC-SHA' || @.attributeName=='EXP-DES-CBC-SHA' || @.attributeName=='EXP-RC2-CBC-MD5' || @.attributeName=='EXP-KRB5-RC2-CBC-SHA' || @.attributeName=='EXP-KRB5-DES-CBC-SHA' || @.attributeName=='EXP-KRB5-RC2-CBC-MD5' || @.attributeName=='EXP-KRB5-DES-CBC-MD5' || @.attributeName=='EXP-ADH-RC4-MD5' || @.attributeName=='EXP-RC4-MD5' || @.attributeName=='EXP-KRB5-RC4-SHA' || @.attributeName=='EXP-KRB5-RC4-MD5')].attributeValue equals true"```