Back to Checks
aws

Elastic Load Balancer has only HTTPS or SSL listeners

elb_ssl_listeners
Service: elbSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsElbLoadBalancer

Elastic Load Balancers are assessed for client-facing listener protocols. Only HTTPS or SSL are considered encrypted; any HTTP or TCP listener indicates plaintext between clients and the load balancer.

Prowler logoProwlerprowler-provider-aws

Risk

Plaintext listeners enable network eavesdropping and content injection, compromising confidentiality and integrity. Attackers on public or untrusted paths can harvest credentials and session tokens or alter traffic via MITM, leading to data exposure and unauthorized access.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elb_ssl_listeners

Recommendation

Enforce encryption in transit by using only HTTPS/TLS listeners. Redirect HTTP to HTTPS and retire plaintext listeners. Use trusted certificates (e.g., ACM) and modern TLS policies; align with zero trust and defense in depth. If needed, use end-to-end TLS to targets and monitor certificate health.

Remediation

CLI

aws elb delete-load-balancer-listeners --load-balancer-name <lb_name> --load-balancer-ports 80

Terraform

# Classic ELB with only encrypted (HTTPS) listener
resource "aws_elb" "<example_resource_name>" {
  availability_zones = ["<example_az>"]

  listener {
    lb_port            = 443
    lb_protocol        = "https"   # CRITICAL: enforce encrypted listener
    instance_port      = 80
    instance_protocol  = "http"
    ssl_certificate_id = "<certificate_arn>"  # CRITICAL: required for HTTPS/SSL
  }
}

NativeIaC

# CloudFormation: Classic ELB with only encrypted (HTTPS) listener
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      AvailabilityZones:
        - <example_az>
      Listeners:
        - Protocol: HTTPS           # CRITICAL: enforce encrypted listener
          LoadBalancerPort: 443
          InstanceProtocol: HTTP
          InstancePort: 80
          SSLCertificateId: <certificate_arn>  # CRITICAL: required for HTTPS termination

Other

1In the AWS console, go to EC2 > Load Balancers (Classic)
2Select the load balancer and open the Listeners tab
3Click Edit and remove any listener with Protocol HTTP or TCP
4Add a listener with Protocol HTTPS (port 443) and select an SSL certificate
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elb.elb_client import elb_client


class elb_ssl_listeners(Check):
    def execute(self):
        findings = []
        secure_protocols = ["SSL", "HTTPS"]
        for lb in elb_client.loadbalancers.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
            report.status = "PASS"
            report.status_extended = f"ELB {lb.name} has HTTPS listeners only."
            for listener in lb.listeners:
                if listener.protocol not in secure_protocols:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"ELB {lb.name} has non-encrypted listeners."
                    )

            findings.append(report)

        return findings

References