Elb web tier security policy remediation

Using Console

Using CLI

To remediate this issue for AWS using AWS CLI, follow these steps:

Open the AWS CLI on your local machine.
Run the following command to get the load balancer security policy names:

aws elb describe-load-balancer-policies --load-balancer-name <ELB_NAME>

Replace <ELB_NAME> with the name of your load balancer.

Identify the security policy that is currently in use for the load balancer. The security policy should be named ELBSecurityPolicy-2016-08 or later.
If the load balancer is using an older security policy, run the following command to update it:

aws elb set-load-balancer-policies-for-backend-server --load-balancer-name <ELB_NAME> --policy-names <NEW_POLICY_NAME>

Replace <ELB_NAME> with the name of your load balancer and <NEW_POLICY_NAME> with the name of the latest AWS security policy. The latest security policy name can be found in the AWS documentation.

Verify that the new security policy is in use by running the following command:

aws elb describe-load-balancer-attributes --load-balancer-name <ELB_NAME>

Replace <ELB_NAME> with the name of your load balancer. The command should return a JSON object that includes the new security policy name.

Once you have verified that the new security policy is in use, you have successfully remediated the misconfiguration.

Using Python

To remediate the misconfiguration “Latest AWS Security Policy for SSL Negotiations Should Be Used For Web-Tier ELBs” in AWS using Python, you can follow the below steps:

Import the required libraries:

import boto3

Create a boto3 client for Elastic Load Balancing:

elb_client = boto3.client('elbv2')

Get a list of all the load balancers:

load_balancers = elb_client.describe_load_balancers()

Loop through each load balancer and check if it is a web-tier ELB:

for load_balancer in load_balancers['LoadBalancers']:
    if 'web' in load_balancer['LoadBalancerName']:

If the load balancer is a web-tier ELB, update its SSL policy:

elb_client.modify_load_balancer_attributes(
    LoadBalancerArn=load_balancer['LoadBalancerArn'],
    Attributes=[
        {
            'Key': 'ssl_policy',
            'Value': 'ELBSecurityPolicy-TLS-1-2-Ext-2018-06'
        },
    ]
)

The SSL policy ELBSecurityPolicy-TLS-1-2-Ext-2018-06 is the latest AWS security policy for SSL negotiations. You can modify the code to use a different SSL policy if required.
Finally, you can add this code to a script and run it periodically to ensure that all web-tier ELBs are using the latest AWS security policy for SSL negotiations.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Elb web tier security policy remediation

Triage and Remediation

Remediation