More Info:
Your app-tier Elastic Load Balancers (ELBs) listeners should be using the latest AWS security policy for their SSL negotiation configuration.Risk Level
MediumAddress
SecurityCompliance Standards
AWSWAFTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Latest AWS Security Policy for SSL Negotiations Should Be Used For App-Tier ELBs” in AWS using the AWS console, follow these steps:
- Log in to the AWS Management Console.
- Navigate to the EC2 dashboard.
- Click on the “Load Balancers” link in the left-hand navigation menu.
- Select the App-Tier ELB that needs remediation.
- Click on the “Listeners” tab.
- Select the HTTPS listener that needs remediation.
- Click on the “Edit” button.
- In the “Edit Listener” dialog box, select the latest AWS Security Policy from the “Security policy” drop-down menu.
- Click the “Save” button to save the changes.
Using CLI
Using CLI
To remediate the misconfiguration of using the latest AWS Security Policy for SSL negotiations for App-Tier ELBs in AWS using AWS CLI, follow these steps:
- Open your AWS CLI on your local machine or EC2 instance.
-
Run the following command to get the current SSL policy for your App-Tier ELB:
Replace
<your-ELB-name>with the name of your App-Tier ELB. -
If the output includes any SSL policies other than the latest AWS Security Policy, you need to update the SSL policy. Run the following command to update the SSL policy for your App-Tier ELB:
Replace
<your-ELB-name>with the name of your App-Tier ELB. - Verify that the SSL policy has been updated by running the command in step 2 again.
- Repeat steps 2-4 for all App-Tier ELBs in your AWS environment.
Using Python
Using Python
To remediate the misconfiguration “Latest AWS Security Policy for SSL Negotiations Should Be Used For App-Tier ELBs” in AWS using Python, follow the steps below:
- Import the necessary AWS libraries and modules:
- Create an ELB client object:
- Get a list of all the existing load balancers:
- Loop through the list of load balancers and check if they are application tier ELBs:
- Once you have identified the application tier ELBs, update their SSL policy to use the latest AWS security policy:
-
Replace
'security_group_id'with the ID of the security group that you want to associate with the ELB. - Finally, run the Python script to remediate the misconfiguration.