Back to Checks
aws

Elastic Load Balancer HTTPS listeners, if present, use the ELBSecurityPolicy-TLS-1-2-2017-01 policy

elb_insecure_ssl_ciphers
Service: elbSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsElbLoadBalancer

Elastic Load Balancer HTTPS listeners are assessed for use of a strong TLS policy. Listeners associated with ELBSecurityPolicy-TLS-1-2-2017-01 are considered to negotiate only modern protocols and ciphers, avoiding legacy SSL/TLS and weak suites.

Prowler logoProwlerprowler-provider-aws

Risk

Legacy TLS or weak ciphers allow downgrades and man-in-the-middle decryption or tampering. Attackers can capture credentials, inject responses, and pivot, undermining data-in-transit confidentiality and integrity, and risking availability through failed handshakes.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elb_insecure_ssl_ciphers

Recommendation

Standardize on ELB policies enforcing TLS 1.2+ with modern AEAD ciphers; disable legacy protocols and weak suites. Enable server cipher order, retire outdated policies, and review regularly for crypto agility. Validate client compatibility, use strong certificates, and monitor negotiation results.

Remediation

CLI

aws elb set-load-balancer-policies-of-listener --load-balancer-name <lb_name> --load-balancer-port 443 --policy-names ELBSecurityPolicy-TLS-1-2-2017-01

Terraform

# Create and attach TLS 1.2-only policy to a Classic ELB HTTPS listener
resource "aws_load_balancer_policy" "<example_resource_name>" {
  load_balancer_name = "<example_resource_name>"
  policy_name        = "ELBSecurityPolicy-TLS-1-2-2017-01"  # Critical: policy named as required by the check
  policy_type_name   = "SSLNegotiationPolicyType"

  policy_attributes {
    name  = "Reference-Security-Policy"
    value = "ELBSecurityPolicy-TLS-1-2-2017-01"  # Critical: reference the predefined TLS 1.2 policy
  }
}

resource "aws_load_balancer_listener_policy" "<example_resource_name>" {
  load_balancer_name = "<example_resource_name>"
  load_balancer_port = 443
  policy_names       = [aws_load_balancer_policy.<example_resource_name>.policy_name]  # Critical: attach policy to HTTPS listener
}

NativeIaC

# CloudFormation: Classic ELB with TLS 1.2-only security policy on HTTPS listener
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      AvailabilityZones:
        - <example_az>
      Listeners:
        - LoadBalancerPort: 443
          InstancePort: 443
          Protocol: HTTPS
          InstanceProtocol: HTTPS
          SSLCertificateId: <example_certificate_arn>
          PolicyNames:
            - ELBSecurityPolicy-TLS-1-2-2017-01  # Critical: attach TLS 1.2-only policy to the HTTPS listener
      Policies:
        - PolicyName: ELBSecurityPolicy-TLS-1-2-2017-01  # Critical: create policy referencing the predefined TLS 1.2 policy
          PolicyType: SSLNegotiationPolicyType
          Attributes:
            - Name: Reference-Security-Policy
              Value: ELBSecurityPolicy-TLS-1-2-2017-01  # Critical: enforce TLS 1.2-only

Other

1Open the AWS Management Console and go to EC2
2In the left menu, under Load Balancing, click Load Balancers
3Select your Classic Load Balancer
4On the Listeners tab, click Manage listeners (or Edit)
5Select the HTTPS (port 443) listener and under Security policy choose ELBSecurityPolicy-TLS-1-2-2017-01
6Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elb.elb_client import elb_client


class elb_insecure_ssl_ciphers(Check):
    def execute(self):
        findings = []
        secure_ssl_policies = [
            "ELBSecurityPolicy-TLS-1-2-2017-01",
        ]
        for lb in elb_client.loadbalancers.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
            report.status = "PASS"
            report.status_extended = (
                f"ELB {lb.name} does not have insecure SSL protocols or ciphers."
            )
            for listener in lb.listeners:
                if listener.protocol == "HTTPS" and not any(
                    check in listener.policies for check in secure_ssl_policies
                ):
                    report.status = "FAIL"
                    report.status_extended = f"ELB {lb.name} has listeners with insecure SSL protocols or ciphers."

            findings.append(report)

        return findings

References