ALBs Should Have Latest SSL/TLS Configurations

Using Console

Sure, here are the step-by-step instructions to remediate the misconfiguration of ALBs not having latest SSL/TLS configurations in AWS:

Login to your AWS Management Console.
Navigate to the EC2 dashboard.
Click on the “Load Balancers” option under the “LOAD BALANCING” section in the left-hand menu.
Select the ALB that you want to remediate and click on its name to open its configuration page.
Click on the “Listeners” tab in the ALB configuration page.
Click on the “Edit” button next to the listener that you want to update the SSL/TLS configuration for.
In the “Edit Listener” dialog box, select the “HTTPS” protocol.
Under the “SSL/TLS certificates” section, select the certificate that you want to use for the listener.
Under the “Security policy” section, select the latest SSL/TLS policy that is available in the drop-down list.
Click on the “Save” button to save the changes.

After following these steps, your ALB will have the latest SSL/TLS configurations.

Using CLI

To remediate this misconfiguration for AWS using AWS CLI, you can follow the below steps:

Check the current SSL/TLS configuration of your Application Load Balancer (ALB) using the following AWS CLI command:

aws elbv2 describe-load-balancers --load-balancer-arns <your-alb-arn> --query "LoadBalancers[].{Name:LoadBalancerName, Scheme:Scheme, SecurityGroups:SecurityGroups, SSLPolicy:SSLPolicy}"

Note: Replace <your-alb-arn> with the ARN of your ALB.

Identify the latest SSL/TLS configuration that you want to apply to your ALB. You can refer to the AWS documentation to find the latest SSL/TLS configurations supported by ALBs.
Update the SSL/TLS configuration of your ALB using the following AWS CLI command:

aws elbv2 modify-listener --listener-arn <your-listener-arn> --ssl-policy <your-ssl-policy>

Note: Replace <your-listener-arn> with the ARN of your listener and <your-ssl-policy> with the name of the SSL/TLS policy that you want to apply.

Verify the SSL/TLS configuration of your ALB using the following AWS CLI command:

aws elbv2 describe-listeners --listener-arns <your-listener-arn> --query "Listeners[].{Protocol:Protocol, Port:Port, SSLPolicy:SSLPolicy}"

Note: Replace <your-listener-arn> with the ARN of your listener.

Repeat steps 1-4 for all your ALBs to ensure that they have the latest SSL/TLS configurations.

Note: Make sure to test your application after updating the SSL/TLS configuration of your ALB to ensure that it is working as expected.

Using Python

To remediate the misconfiguration of ALBs not having the latest SSL/TLS configurations in AWS using Python, you can follow the below steps:

Install the required Python libraries: boto3 and botocore. You can install them using the following command:

pip install boto3 botocore

Create a boto3 client for AWS Application Load Balancer (ALB) using the following code:

import boto3

elbv2 = boto3.client('elbv2')

Get the list of all the existing ALBs using the following code:

response = elbv2.describe_load_balancers()
load_balancers = response['LoadBalancers']

Loop through all the ALBs and check if they are using the latest SSL/TLS configurations. You can use the following code to check if the ALB is using the latest SSL/TLS configurations:

for lb in load_balancers:
    arn = lb['LoadBalancerArn']
    response = elbv2.describe_listeners(LoadBalancerArn=arn)
    listeners = response['Listeners']
    for listener in listeners:
        if listener['Protocol'] == 'HTTPS':
            ssl_policy = listener.get('SslPolicy')
            if ssl_policy != 'ELBSecurityPolicy-TLS-1-2-2017-01':
                # Update the SSL/TLS configuration
                elbv2.modify_listener(
                    ListenerArn=listener['ListenerArn'],
                    SslPolicy='ELBSecurityPolicy-TLS-1-2-2017-01'
                )

The above code will update the SSL/TLS configuration of the ALB to the latest one if it is not already using it.
You can schedule this Python script to run periodically to ensure that all the ALBs are using the latest SSL/TLS configurations.

Using Terraform

resource "aws_lb" "APPLICATION_LOAD_BALANCER" {
  name               = "ALB_NAME"            # replace with your ALB name
  internal           = false
  load_balancer_type = "application"
  subnets            = [SUBNET_ID_1, SUBNET_ID_2] # replace with your subnet IDs

  security_groups = [SECURITY_GROUP_ID]           # replace with your SG ID
}

resource "aws_lb_target_group" "ALB_TARGET_GROUP" {
  name     = "ALB_TG_NAME"     # replace with your target group name
  port     = 80                # adjust as needed
  protocol = "HTTP"
  vpc_id   = VPC_ID            # replace with your VPC ID
}

resource "aws_lb_listener" "ALB_HTTPS_LISTENER" {
  load_balancer_arn = aws_lb.APPLICATION_LOAD_BALANCER.arn
  port              = 443
  protocol          = "HTTPS"

  # This is the key setting: use the recommended modern TLS policy
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"

  certificate_arn   = ACM_CERTIFICATE_ARN   # replace with your ACM certificate ARN

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.ALB_TARGET_GROUP.arn
  }
}

This sets each HTTPS/TLS aws_lb_listener on your ALB to use ELBSecurityPolicy-TLS13-1-2-2021-06, matching the aws elbv2 modify-listener --ssl-policy ELBSecurityPolicy-TLS13-1-2-2021-06 CLI remediation. This change is in-place (no load balancer replacement), but it can break clients that do not support the newer TLS versions/ciphers, so validate compatibility first.For existing listeners, terraform plan should show an in-place update like:

~ resource "aws_lb_listener" "ALB_HTTPS_LISTENER"
- ssl_policy: "OLD_POLICY_NAME" -> "ELBSecurityPolicy-TLS13-1-2-2021-06"

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

ALBs Should Have Latest SSL/TLS Configurations

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: