More Info:
Elastic Load Balancers should be using the latest AWS predefined security policies.Risk Level
MediumAddress
SecurityCompliance Standards
AWSWAF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “ELBs Must Use Latest AWS Security Policies” for AWS, you can follow the below steps using the AWS Console:
- Log in to the AWS Management Console.
- Navigate to the EC2 service and select “Load Balancers” from the left-hand menu.
- Select the ELB that needs to be remediated.
- Click on the “Listeners” tab.
- Check if the “HTTPS” protocol is being used. If it is, then click on the “Edit” button next to the listener.
- Under “Security Policy”, select the latest security policy from the drop-down list.
- Click on the “Save” button to apply the changes.
Using CLI
Using CLI
To remediate the misconfiguration “ELBs Must Use Latest AWS Security Policies” for AWS using AWS CLI, follow the below steps:After following these steps, the ELB will be using the latest AWS security policies.
- Check the current security policy of the ELB using the following command:
- Check the latest security policy available using the following command:
- Create a new policy using the latest security policy available using the following command:
- Apply the newly created policy to the ELB using the following command:
- Verify that the new policy is applied to the ELB using the following command:
Using Python
Using Python
To remediate the ELBs Must Use Latest AWS Security Policies misconfiguration for AWS using Python, you can follow these steps:Note: This code only updates the ELBs that are not using the latest AWS security policies. If all your ELBs are already using the latest security policy, then this code will not make any changes.
- First, make sure you have the AWS SDK for Python (Boto3) installed and configured on your local machine.
-
Next, you need to identify the ELBs that are not using the latest AWS security policies. You can do this by using the
describe_load_balancersmethod of theboto3.client('elbv2')object. This method returns a list of all the load balancers in your account. -
For each load balancer, you need to check if it is using the latest AWS security policy. You can do this by using the
describe_load_balancer_attributesmethod of theboto3.client('elbv2')object. This method returns a dictionary of the load balancer attributes. -
Check if the load balancer is using the latest security policy by looking for the
ssl_policyattribute in the dictionary. If the value of this attribute is notELBSecurityPolicy-2016-08, then the load balancer is not using the latest security policy. -
To update the load balancer to use the latest security policy, you can use the
modify_load_balancer_attributesmethod of theboto3.client('elbv2')object. You need to set thessl_policyattribute toELBSecurityPolicy-2016-08.