More Info:
ELB should be configured to block HTTP connection and allow only HTTPS connections.Risk Level
HighAddress
SecurityCompliance Standards
HIPAA, GDPR, NIST, SOC2, PCIDSS, AWSWAF, HITRUST, NISTCSF, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “ELB Should Accept HTTPS Connections Only” in AWS using AWS console, follow these steps:
- Open the AWS Management Console and navigate to the EC2 Dashboard.
- Click on Load Balancers from the left-hand menu.
- Select the load balancer that you want to configure to accept HTTPS connections only.
- Click on the Listeners tab.
- Click on Edit in the Actions column for the HTTPS listener.
- In the Edit Listener dialog box, select HTTPS as the Protocol.
- In the SSL Certificate drop-down menu, select the SSL certificate that you want to use for the HTTPS listener.
- In the Default Actions section, click on the X icon next to the existing action to remove it.
- Click on Add Action and select Forward to from the drop-down menu.
- In the Forward to drop-down menu, select the target group that you want to forward traffic to.
- Click on Save.
Using CLI
Using CLI
To remediate the ELB accepting only HTTPS connections in AWS using AWS CLI, follow these steps:Replace Replace The output should show that the listener is now configured to accept HTTPS connections only.Note: Make sure to replace
- Open the AWS CLI on your local machine.
- Run the following command to describe the current configuration of the ELB:
<ELB_NAME> with the name of your ELB.- Check if the ELB is currently accepting both HTTP and HTTPS connections. If it is, you need to modify the listener to accept HTTPS connections only.
- Run the following command to modify the listener to accept HTTPS connections only:
<ELB_NAME> with the name of your ELB and <SECURITY_GROUP_ID> with the ID of the security group that the ELB should use.- Verify that the ELB is now accepting HTTPS connections only by running the following command:
<ELB_NAME> and <SECURITY_GROUP_ID> with the appropriate values for your ELB.Using Python
Using Python
To remediate the misconfiguration “ELB Should Accept HTTPS Connections Only” for AWS using python, you can follow the below steps:By following the above steps, the misconfiguration “ELB Should Accept HTTPS Connections Only” can be remediated for AWS using python.
- Import the necessary libraries:
- Create an AWS ELB client:
- Get the list of all the load balancers:
- Iterate through the list of load balancers and update the listener protocol to HTTPS:
- Verify that the listener protocol has been updated to HTTPS: