Check provider logo

ELBv2 load balancer uses a secure SSL policy on HTTPS listeners

elbv2_insecure_ssl_ciphers

Severitymedium
Serviceelbv2
by Prowler
encryption

ELBv2 HTTPS listeners are assessed for use of strong TLS policies. Listeners whose ssl_policy is not in the approved set (TLS 1.2/1.3-focused policies) may include weak protocols or ciphers.

Risk

Legacy or weak ciphers enable downgrade and man-in-the-middle attacks, allowing decryption of sessions, credential theft, and request tampering. This undermines confidentiality and integrity of data in transit and can expose cookies or tokens for account takeover.

Run this check with Prowler CLI

prowler aws --checks elbv2_insecure_ssl_ciphers

Run in Prowler Cloud

Recommendation

Enforce modern TLS on load balancer listeners:

  • Use AWS recommended policies like ELBSecurityPolicy-TLS13-1-2-2021-06
  • Disable TLS 1.0/1.1 and weak ciphers; prefer suites with forward secrecy
  • Periodically review and update policies

Apply defense in depth with strict client access and least privilege for changes.

Remediation

CLI

aws elbv2 modify-listener --listener-arn <listener_arn> --ssl-policy ELBSecurityPolicy-TLS13-1-2-2021-06

Native IaC
Terraform
Other
  1. In the AWS Console, go to EC2 > Load Balancers
  2. Select the load balancer and open the Listeners tab
  3. Select the HTTPS listener and choose Edit
  4. Set Security policy to ELBSecurityPolicy-TLS13-1-2-2021-06 (or any approved policy)
  5. Save changes

Source Code

Resource Type

AwsElbv2LoadBalancer

References