aws elb describe-load-balancers --load-balancer-name <ELB_NAME>

aws elb modify-load-balancer-attributes --load-balancer-name <ELB_NAME> --load-balancer-attributes "{\"LoadBalancerAttributes\":{\"ConnectionSettings\":{\"IdleTimeout\":3600},\"AccessLog\":{\"Enabled\":false},\"ConnectionDraining\":{\"Enabled\":false},\"CrossZoneLoadBalancing\":{\"Enabled\":false},\"SecurityGroups\":[\"<SECURITY_GROUP_ID>\"],\"AdditionalAttributes\":[{\"Key\":\"listener.sslPolicy\",\"Value\":\"ELBSecurityPolicy-2016-08\"}],\"Listeners\":[{\"Protocol\":\"HTTPS\",\"LoadBalancerPort\":443,\"InstanceProtocol\":\"HTTP\",\"InstancePort\":80}]}}"

aws elb describe-load-balancers --load-balancer-name <ELB_NAME>

import boto3

elb_client = boto3.client('elbv2')

lb_list = elb_client.describe_load_balancers()

for lb in lb_list['LoadBalancers']:
    lb_arn = lb['LoadBalancerArn']
    listener_list = elb_client.describe_listeners(LoadBalancerArn=lb_arn)
    for listener in listener_list['Listeners']:
        if listener['Protocol'] != 'HTTPS':
            elb_client.modify_listener(
                ListenerArn=listener['ListenerArn'],
                Protocol='HTTPS'
            )

listener_list = elb_client.describe_listeners(LoadBalancerArn=lb_arn)
for listener in listener_list['Listeners']:
    if listener['Protocol'] != 'HTTPS':
        print('Listener protocol not updated to HTTPS')
    else:
        print('Listener protocol updated to HTTPS')

############################
# 1) Application Load Balancer: HTTP → HTTPS redirect (modify listener)
############################

resource "aws_lb" "APP_ALB" {
  name               = "APP_ALB_NAME"        # replace with your ALB name
  internal           = false
  load_balancer_type = "application"
  subnets            = [SUBNET_ID_1, SUBNET_ID_2] # replace with subnet IDs
  security_groups    = [SG_ID]                    # replace with SG ID
}

# HTTPS listener on 443 must already exist (as assumed by the CLI remediation)
resource "aws_lb_listener" "https_443" {
  load_balancer_arn = aws_lb.APP_ALB.arn
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-2016-08"
  certificate_arn   = ACM_CERT_ARN   # replace with ACM certificate ARN

  default_action {
    type = "forward"

    target_group_arn = AWS_LB_TARGET_GROUP_HTTPS_ARN  # replace with your target group ARN or use a target group resource
  }
}

# Fix: change HTTP listener default action to a redirect to HTTPS:443 with HTTP_301
resource "aws_lb_listener" "http_80" {
  load_balancer_arn = aws_lb.APP_ALB.arn
  port              = 80
  protocol          = "HTTP"

  default_action {
    type = "redirect"

    redirect {
      protocol   = "HTTPS"
      port       = "443"
      status_code = "HTTP_301"
    }
  }
}

# This change is in‑place on the listener (no load balancer replacement), but traffic behavior on port 80 will change to a redirect.


############################
# 2) Network Load Balancer: delete insecure TCP:80 listener
############################

resource "aws_lb" "NETWORK_NLB" {
  name               = "NETWORK_NLB_NAME"    # replace with your NLB name
  internal           = false
  load_balancer_type = "network"
  subnets            = [SUBNET_ID_1, SUBNET_ID_2] # replace with subnet IDs
}

# TLS listener that will continue to serve encrypted traffic (e.g., 443)
resource "aws_lb_listener" "tls_443" {
  load_balancer_arn = aws_lb.NETWORK_NLB.arn
  port              = 443
  protocol          = "TLS"

  default_action {
    type = "forward"

    target_group_arn = AWS_LB_TARGET_GROUP_TLS_ARN   # replace with your target group ARN
  }
}

# INSECURE LISTENER TO DELETE:
# The CLI remediation calls aws elbv2 delete-listener on the TCP:80 listener.
# In Terraform, REMOVE this resource entirely so it is destroyed.
# Example of what should be removed:
#
# resource "aws_lb_listener" "tcp_80" {
#   load_balancer_arn = aws_lb.NETWORK_NLB.arn
#   port              = 80
#   protocol          = "TCP"
#
#   default_action {
#     type            = "forward"
#     target_group_arn = AWS_LB_TARGET_GROUP_TCP_ARN
#   }
# }
#
# Deleting this resource forces replacement of the listener only; traffic on port 80 will permanently stop.


############################
# 3) Classic Load Balancer: delete insecure HTTP listener
############################

resource "aws_elb" "CLASSIC_ELB" {
  name = "CLASSIC_ELB_NAME"   # replace with your ELB name

  subnets         = [SUBNET_ID_1, SUBNET_ID_2] # replace with subnet IDs
  security_groups = [SG_ID]                    # replace with SG ID

  # SECURE LISTENER that must remain (HTTPS/SSL)
  listener {
    instance_port     = 443
    instance_protocol = "HTTPS"
    lb_port           = 443
    lb_protocol       = "HTTPS"
    ssl_certificate_id = ACM_OR_IAM_CERT_ARN  # replace with your certificate ARN
  }

  # INSECURE HTTP LISTENER TO DELETE:
  # The CLI remediation calls aws elb delete-load-balancer-listeners on the HTTP port (e.g., 80).
  # In Terraform, REMOVE this listener block entirely so it is destroyed.
  #
  # listener {
  #   instance_port     = 80
  #   instance_protocol = "HTTP"
  #   lb_port           = 80
  #   lb_protocol       = "HTTP"
  # }
  #
  # Removing this listener block forces replacement of the listener on that port; traffic on that port will permanently stop.
}

############################
# Verification
############################
# After updating Terraform:
# - terraform plan for the ALB should show an in-place update to the HTTP listener's default_action to a redirect with protocol HTTPS, port 443, and status_code HTTP_301.
# - terraform plan for the NLB should show the aws_lb_listener on TCP:80 being destroyed (no new TCP:80 listener created).
# - terraform plan for the Classic ELB should show the HTTP listener (e.g., port 80) being removed from the aws_elb listener set.