Back to Checks
aws

ELBv2 Application Load Balancer listeners use HTTPS or redirect HTTP to HTTPS

elbv2_ssl_listeners
Service: elbv2Severity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsElbv2LoadBalancer

Application Load Balancer listeners are assessed for encrypted ingress: either only HTTPS listeners are present, or any HTTP listener redirects to HTTPS.

Prowler logoProwlerprowler-provider-aws

Risk

Exposed HTTP paths allow traffic to travel in plaintext, enabling interception, credential theft, session hijacking, and response tampering. This weakens confidentiality and integrity and makes MITM on public or shared networks feasible.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elbv2_ssl_listeners

Recommendation

Enforce TLS everywhere: use HTTPS listeners and make all HTTP listeners redirect to HTTPS only. Do not forward plaintext. Apply defense in depth with strong TLS policies and managed certificates, and consider HSTS to prevent users from reaching http.

Remediation

CLI

aws elbv2 modify-listener --listener-arn <listener_arn> --default-actions '[{"Type":"redirect","RedirectConfig":{"Protocol":"HTTPS","Port":"443","StatusCode":"HTTP_301"}}]'

Terraform

# Terraform: Redirect HTTP listener to HTTPS
resource "aws_lb_listener" "<example_resource_name>" {
  load_balancer_arn = "<example_resource_id>"
  protocol          = "HTTP"
  port              = 80

  default_action {
    type = "redirect"
    redirect {
      protocol   = "HTTPS"   # Critical: redirect to HTTPS
      port       = "443"     # Critical: target HTTPS port
      status_code = "HTTP_301" # Critical: enforce redirect
    }
  }
}

NativeIaC

# CloudFormation: Redirect HTTP listener to HTTPS
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: <example_resource_id>
      Protocol: HTTP
      Port: 80
      DefaultActions:
        - Type: redirect
          RedirectConfig:
            Protocol: HTTPS  # Critical: redirect HTTP to HTTPS
            Port: '443'      # Critical: target HTTPS port
            StatusCode: HTTP_301  # Critical: enforce redirect

Other

1Open the EC2 console and go to Load Balancers
2Select the Application Load Balancer and open the Listeners tab
3Select the HTTP:80 listener and choose Edit (or View/edit rules)
4Set the default action to Redirect to, Protocol: HTTPS, Port: 443, Status code: HTTP_301
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client


class elbv2_ssl_listeners(Check):
    def execute(self):
        findings = []
        for lb in elbv2_client.loadbalancersv2.values():
            if lb.type == "application":
                report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
                report.status = "PASS"
                report.status_extended = (
                    f"ELBv2 ALB {lb.name} has HTTPS listeners only."
                )
                for listener in lb.listeners.values():
                    if listener.protocol == "HTTP":
                        report.status = "FAIL"
                        report.status_extended = (
                            f"ELBv2 ALB {lb.name} has non-encrypted listeners."
                        )
                        # Check if it redirects HTTP to HTTPS
                        for rule in listener.rules:
                            for action in rule.actions:
                                if (
                                    action["Type"] == "redirect"
                                    and action["RedirectConfig"]["Protocol"] == "HTTPS"
                                ):
                                    report.status = "PASS"
                                    report.status_extended = f"ELBv2 ALB {lb.name} has HTTP listener but it redirects to HTTPS."

                findings.append(report)

        return findings

References