Description

Ensure that every HTTPS listener of a Classic Load Balancer uses the predefined security policy ELBSecurityPolicy-TLS-1-2-2017-01. This policy allows only TLS 1.2 with strong cipher suites, so clients cannot negotiate legacy SSL or TLS versions or weak ciphers with the load balancer.

Rationale

Legacy TLS versions and weak ciphers allow protocol downgrade and man-in-the-middle attacks, in which an attacker can decrypt or modify traffic between clients and the load balancer. This can expose credentials and session data and allow injected responses. Using a security policy that enforces TLS 1.2 with modern ciphers protects the confidentiality and integrity of data in transit.

Impact

  • Prevents clients from negotiating insecure SSL/TLS protocols and weak ciphers

  • Protects data in transit against downgrade and man-in-the-middle attacks

  • Old clients that do not support TLS 1.2 will no longer be able to connect

Default Value

A Classic Load Balancer HTTPS listener uses the security policy selected when the listener was created. ELBSecurityPolicy-TLS-1-2-2017-01 is applied only if it was selected explicitly.

Pre-Requisites

  • IAM permissions: elasticloadbalancing:DescribeLoadBalancers, elasticloadbalancing:DescribeLoadBalancerPolicies, elasticloadbalancing:CreateLoadBalancerPolicy and elasticloadbalancing:SetLoadBalancerPoliciesOfListener

  • Confirmation that all clients of the load balancer support TLS 1.2

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select Load Balancers under Load Balancing.

  3. Select a load balancer of type classic and open the Listeners tab.

  4. For each listener with protocol HTTPS, check that the security policy is ELBSecurityPolicy-TLS-1-2-2017-01.

  5. Repeat for each Classic Load Balancer in each region in use.

  6. If any HTTPS listener uses a different policy, follow the implementation steps.

CLI:

List the Classic Load Balancers in the region:

aws elb describe-load-balancers --region <REGION> --query "LoadBalancerDescriptions[].LoadBalancerName"

Show the protocol, port and policies of each listener of a load balancer:

aws elb describe-load-balancers --region <REGION> --load-balancer-names <LOAD_BALANCER_NAME> --query "LoadBalancerDescriptions[].ListenerDescriptions[].[Listener.Protocol,Listener.LoadBalancerPort,PolicyNames]"

A load balancer fails if any listener with protocol HTTPS does not have ELBSecurityPolicy-TLS-1-2-2017-01 in its PolicyNames. A custom policy with a different name fails even if its settings are similar. Listeners using other protocols are not evaluated.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select Load Balancers under Load Balancing.

  3. Select the Classic Load Balancer and open the Listeners tab.

  4. Choose Manage listeners (or Edit).

  5. The console cannot give the policy the required name: selecting a predefined or custom policy in the console attaches it under a generated name (for example AWSConsole-SSLNegotiationPolicy-<LOAD_BALANCER_NAME>-<TIMESTAMP>), and the listener is evaluated by the name of the policy attached to it, which must be exactly ELBSecurityPolicy-TLS-1-2-2017-01. Use the CLI commands below to create and attach the policy under that exact name.

  6. Choose Save changes.

  7. Repeat for each affected HTTPS listener and load balancer in each region in use.

CLI:

Create the policy on the load balancer from the predefined TLS 1.2 security policy. The policy name must be exactly ELBSecurityPolicy-TLS-1-2-2017-01, because the listener is evaluated by the name of the policy attached to it:

aws elb create-load-balancer-policy --region <REGION> --load-balancer-name <LOAD_BALANCER_NAME> --policy-name ELBSecurityPolicy-TLS-1-2-2017-01 --policy-type-name SSLNegotiationPolicyType --policy-attributes AttributeName=Reference-Security-Policy,AttributeValue=ELBSecurityPolicy-TLS-1-2-2017-01

Apply this policy to the HTTPS listener. This command replaces all policies currently set on that listener port:

aws elb set-load-balancer-policies-of-listener --region <REGION> --load-balancer-name <LOAD_BALANCER_NAME> --load-balancer-port <LISTENER_PORT> --policy-names ELBSecurityPolicy-TLS-1-2-2017-01

Backout Plan

Before making changes, save the current listener configuration:

aws elb describe-load-balancers --region <REGION> --load-balancer-names <LOAD_BALANCER_NAME> > elb-listeners-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select Load Balancers under Load Balancing.

  3. Select the Classic Load Balancer, open the Listeners tab and choose Manage listeners (or Edit).

  4. Select the security policy that the HTTPS listener used before, as recorded in the saved backup.

  5. Choose Save changes.

CLI:

aws elb set-load-balancer-policies-of-listener --region <REGION> --load-balancer-name <LOAD_BALANCER_NAME> --load-balancer-port <LISTENER_PORT> --policy-names <PREVIOUS_POLICY_NAME>

Note: rolling back allows insecure protocols and ciphers again. Use it only as a temporary measure for clients that cannot yet use TLS 1.2.

Reference