Back to Checks
aws

ELBv2 Network Load Balancer has TLS termination enabled

elbv2_nlb_tls_termination_enabled
Service: elbv2Severity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsElbv2LoadBalancer

Network Load Balancers with listeners using the TLS protocol indicate TLS termination at the load balancer. The evaluation identifies NLBs that have at least one TLS listener versus those using plain TCP/UDP or deferring encryption to targets.

Prowler logoProwlerprowler-provider-aws

Risk

Lack of NLB-level TLS termination can leave transit data unencrypted or managed inconsistently on instances, undermining confidentiality and integrity. It also shifts handshake CPU cost to targets, reducing availability and making them more susceptible to connection floods and downgrade or weak-cipher exposures.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elbv2_nlb_tls_termination_enabled

Recommendation

Enable TLS listeners to terminate client encryption at the NLB and enforce centralized, modern cipher policies and certificate rotation. Apply defense in depth by re-encrypting to targets when needed, limit backend access to the NLB, and automate certificate lifecycle with secure storage and monitoring for deprecated protocols.

Remediation

CLI

aws elbv2 create-listener --load-balancer-arn <nlb_arn> --protocol TLS --port 443 --ssl-policy ELBSecurityPolicy-TLS13-1-2-2021-06 --certificates CertificateArn=<certificate_arn> --default-actions Type=forward,TargetGroupArn=<target_group_arn>

Terraform

# Terraform: Add a TLS listener to enable TLS termination on the NLB
resource "aws_lb_listener" "<example_resource_name>" {
  load_balancer_arn = "<example_resource_arn>"
  port              = 443
  protocol          = "TLS"  # critical: enables TLS termination
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"  # critical: required for TLS
  certificate_arn   = "<example_resource_arn>"  # critical: server certificate for TLS termination

  default_action {
    type             = "forward"
    target_group_arn = "<example_resource_arn>"
  }
}

NativeIaC

# CloudFormation: Add a TLS listener to enable TLS termination on the NLB
Resources:
  "<example_resource_name>":
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: "<example_resource_arn>"
      Protocol: TLS  # critical: enables TLS termination on the NLB
      Port: 443
      SslPolicy: ELBSecurityPolicy-TLS13-1-2-2021-06  # critical: required when Protocol is TLS
      Certificates:
        - CertificateArn: "<example_resource_arn>"  # critical: server certificate for TLS termination
      DefaultActions:
        - Type: forward
          TargetGroupArn: "<example_resource_arn>"

Other

1In the AWS Console, go to EC2 > Load Balancers and select your Network Load Balancer
2Open the Listeners tab and click Add listener
3Set Protocol to TLS and Port to 443
4Select an ACM certificate and a security policy
5Set Default action to Forward to your target group
6Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client


class elbv2_nlb_tls_termination_enabled(Check):
    def execute(self):
        findings = []
        for lb in elbv2_client.loadbalancersv2.values():
            if lb.type == "network":
                report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
                report.status = "FAIL"
                report.status_extended = f"ELBv2 NLB {lb.name} is not configured to terminate TLS connections."
                for listener in lb.listeners.values():
                    if listener.protocol == "TLS":
                        report.status = "PASS"
                        report.status_extended = f"ELBv2 NLB {lb.name} is configured to terminate TLS connections."

                findings.append(report)

        return findings

References