1. Open the AWS Management Console and navigate to the EC2 dashboard.
2. Click on “Load Balancers” in the left-hand menu.
3. Select the ELB for which you want to remediate this misconfiguration.
4. Click on the “Listeners” tab in the bottom pane.
5. Identify the listener that is using an invalid HTTP header and click on the “Edit” button for that listener.
6. Scroll down to the “HTTP Headers” section and click on the “Add” button.
7. In the “Name” field, enter the name of the invalid HTTP header that you want to drop.
8. In the “Value” field, enter the value of the invalid HTTP header that you want to drop.
9. Click on the “Save” button to save the changes.
10. Repeat steps 5-9 for any other listeners that are using invalid HTTP headers.
11. Once you have remediated all the invalid HTTP headers, click on the “Save” button to save the changes to the ELB.

​

1. Open the AWS CLI and run the following command to list all the load balancers in your AWS account:
   aws elbv2 describe-load-balancers
   
2. Identify the ARN (Amazon Resource Name) of the load balancer that you want to remediate.
3. Run the following command to update the load balancer attributes and drop invalid HTTP headers:
   aws elbv2 modify-load-balancer-attributes --load-balancer-arn <load_balancer_arn> --attributes Key=http2.dropped_headers,Value=HTTP_X_FORWARDED_FOR
   
   Note: Replace <load_balancer_arn> with the ARN of the load balancer identified in step 2.
4. Verify that the invalid HTTP headers are dropped by running the following command:
   aws elbv2 describe-load-balancer-attributes --load-balancer-arn <load_balancer_arn>
   
   Note: Replace <load_balancer_arn> with the ARN of the load balancer identified in step 2. This command will return the load balancer attributes, including the dropped HTTP headers.

1. Import the boto3 library to interact with AWS services using python.
   import boto3
   
2. Create a boto3 client for the Elastic Load Balancing service.
   elb_client = boto3.client('elbv2')
   
3. Get a list of all the load balancers in your AWS account.
   response = elb_client.describe_load_balancers()
   load_balancers = response['LoadBalancers']
   
4. For each load balancer, check if the “http.headers” attribute is set to “drop.invalid.header.fields”. If it is not, update the attribute to “drop.invalid.header.fields”.
   for lb in load_balancers:
       lb_arn = lb['LoadBalancerArn']
       lb_attributes = elb_client.describe_load_balancer_attributes(LoadBalancerArn=lb_arn)
       lb_http_headers = lb_attributes['Attributes'][0]
       if lb_http_headers['Key'] == 'http.headers':
           if lb_http_headers['Value'] != 'drop.invalid.header.fields':
               elb_client.modify_load_balancer_attributes(
                   LoadBalancerArn=lb_arn,
                   Attributes=[
                       {
                           'Key': 'http.headers',
                           'Value': 'drop.invalid.header.fields'
                       }
                   ]
               )
   
5. Once the “http.headers” attribute is updated for all the load balancers, the misconfiguration “ELBs Should Drop Invalid HTTP Header” will be remediated.
   print("Misconfiguration remediated successfully!")
   

resource "aws_lb" "APP_OR_NETWORK_LB" {
  name               = "YOUR_LB_NAME"
  internal           = false
  load_balancer_type = "application" # or "network"

  subnets         = [AWS_SUBNET_ID_1, AWS_SUBNET_ID_2] # replace with real subnet IDs
  security_groups = [AWS_SECURITY_GROUP_ID]            # for ALB; omit for NLB if not used

  # Remediation: ensure invalid HTTP headers are dropped
  drop_invalid_header_fields = true

  # ...any other existing configuration...
}

• Replace APP_OR_NETWORK_LB with your Terraform resource name, YOUR_LB_NAME with the desired LB name, and the subnet / security group placeholders with real IDs or references.
• This change is an in-place update for existing Application or Network Load Balancers (no forced replacement), but it is not supported for Classic LBs (aws_elb).