Back to Checks
aws

ELBv2 load balancer uses a secure SSL policy on HTTPS listeners

elbv2_insecure_ssl_ciphers
Service: elbv2Severity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsElbv2LoadBalancer

ELBv2 HTTPS listeners are assessed for use of strong TLS policies. Listeners whose ssl_policy is not in the approved set (TLS 1.2/1.3-focused policies) may include weak protocols or ciphers.

Prowler logoProwlerprowler-provider-aws

Risk

Legacy or weak ciphers enable downgrade and man-in-the-middle attacks, allowing decryption of sessions, credential theft, and request tampering. This undermines confidentiality and integrity of data in transit and can expose cookies or tokens for account takeover.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elbv2_insecure_ssl_ciphers

Recommendation

Enforce modern TLS on load balancer listeners:

  • Use AWS recommended policies like ELBSecurityPolicy-TLS13-1-2-2021-06
  • Disable TLS 1.0/1.1 and weak ciphers; prefer suites with forward secrecy
  • Periodically review and update policies

Apply defense in depth with strict client access and least privilege for changes.

Remediation

CLI

aws elbv2 modify-listener --listener-arn <listener_arn> --ssl-policy ELBSecurityPolicy-TLS13-1-2-2021-06

Terraform

# Terraform: Ensure HTTPS listener uses a secure SSL policy
resource "aws_lb_listener" "<example_resource_name>" {
  load_balancer_arn = "<example_resource_arn>"
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06" # FIX: approved secure policy
  certificate_arn   = "<example_certificate_arn>"

  default_action {
    type             = "forward"
    target_group_arn = "<example_resource_arn>"
  }
}

NativeIaC

# CloudFormation: Set a secure SSL policy on an HTTPS listener
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: <example_resource_arn>
      Protocol: HTTPS
      Port: 443
      DefaultActions:
        - Type: forward
          TargetGroupArn: <example_resource_arn>
      Certificates:
        - CertificateArn: <example_certificate_arn>
      SslPolicy: ELBSecurityPolicy-TLS13-1-2-2021-06  # FIX: uses an approved secure policy to eliminate insecure ciphers

Other

1In the AWS Console, go to EC2 > Load Balancers
2Select the load balancer and open the Listeners tab
3Select the HTTPS listener and choose Edit
4Set Security policy to ELBSecurityPolicy-TLS13-1-2-2021-06 (or any approved policy)
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client


class elbv2_insecure_ssl_ciphers(Check):
    def execute(self):
        findings = []
        secure_ssl_policies = [
            "ELBSecurityPolicy-TLS-1-2-2017-01",
            "ELBSecurityPolicy-TLS-1-2-Ext-2018-06",
            "ELBSecurityPolicy-FS-1-2-2019-08",
            "ELBSecurityPolicy-FS-1-2-Res-2019-08",
            "ELBSecurityPolicy-FS-1-2-Res-2020-10",
            "ELBSecurityPolicy-TLS13-1-2-2021-06",
            "ELBSecurityPolicy-TLS13-1-3-2021-06",
            "ELBSecurityPolicy-TLS13-1-2-Res-2021-06",
            "ELBSecurityPolicy-TLS13-1-2-Ext1-2021-06",
            "ELBSecurityPolicy-TLS13-1-2-Ext2-2021-06",
            # AWS post-quantum (PQ) TLS policies (TLS 1.2+ minimum)
            "ELBSecurityPolicy-TLS13-1-2-Ext1-PQ-2025-09",
            "ELBSecurityPolicy-TLS13-1-2-Ext2-PQ-2025-09",
            "ELBSecurityPolicy-TLS13-1-2-PQ-2025-09",
            "ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09",
            "ELBSecurityPolicy-TLS13-1-3-PQ-2025-09",
            # AWS FIPS post-quantum (PQ) TLS policies (TLS 1.2+ minimum)
            "ELBSecurityPolicy-TLS13-1-2-Ext0-FIPS-PQ-2025-09",
            "ELBSecurityPolicy-TLS13-1-2-Ext1-FIPS-PQ-2025-09",
            "ELBSecurityPolicy-TLS13-1-2-Ext2-FIPS-PQ-2025-09",
            "ELBSecurityPolicy-TLS13-1-2-FIPS-PQ-2025-09",
            "ELBSecurityPolicy-TLS13-1-2-Res-FIPS-PQ-2025-09",
            "ELBSecurityPolicy-TLS13-1-3-FIPS-PQ-2025-09",
        ]
        for lb in elbv2_client.loadbalancersv2.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
            report.status = "PASS"
            report.status_extended = (
                f"ELBv2 {lb.name} does not have insecure SSL protocols or ciphers."
            )
            for listener in lb.listeners.values():
                if (
                    listener.protocol == "HTTPS"
                    and listener.ssl_policy not in secure_ssl_policies
                ):
                    report.status = "FAIL"
                    report.status_extended = f"ELBv2 {lb.name} has listeners with insecure SSL protocols or ciphers ({listener.ssl_policy})."

            findings.append(report)

        return findings

References