ELB use weak ciphers

aws_elb_weak_ciphers

Severity

high

Remediation Complexity

trivial

Remediation Risk

medium

Remediation Effort

low

Vendor

AWS

Resource

Encryption

Description

The listener terminates TLS with a security policy that still accepts an obsolete protocol version, and therefore the weak cipher suites that come with it — CBC-mode suites and RSA key transport, which the TLS 1.2 policies dropped. That leaves the connection between the client and the load balancer open to downgrade and padding-oracle attacks.

A listener names a policy, not a suite list: AWS owns the suites, and the policy name is what states the lowest protocol version the listener will negotiate. ELBSecurityPolicy-2015-05 and the other policies that predate the versioned naming accept TLS 1.0.

To fix it, configure listeners.SslPolicy with a policy whose name states TLS 1.2 or later, such as ELBSecurityPolicy-TLS-1-2-2017-01 or ELBSecurityPolicy-TLS13-1-2-2021-06.

A policy name that AWS does not publish is reported too, with its own explanation: nothing maintains it, so neither the protocol floor nor the cipher suites the listener accepts can be verified. That finding carries no crypto asset link, because attributing a protocol version to an unknown policy would be a guess.

Learn more about this topic at AWS ELB SSL Policy.

Examples

---
- name: Example playbook
  hosts: localhost
  tasks:
    - amazon.aws.elb_application_lb:
        access_logs_enabled: true
        access_logs_s3_bucket: mybucket
        access_logs_s3_prefix: "logs"
        name: myalb
        security_groups:
          - sg-12345678
          - my-sec-group
        subnets:
          - subnet-012345678
          - subnet-abcdef000
        listeners:
          - Protocol: HTTPS # Required. The protocol for connections from clients to the load balancer (HTTP or HTTPS) (case-sensitive).
            Port: 443 # Required. The port on which the load balancer is listening.
            # The security policy that defines which ciphers and protocols are supported. The default is the current predefined security policy.
            SslPolicy: ELBSecurityPolicy-2015-05
            Certificates: # The ARN of the certificate (only one certficate ARN should be provided)
              - CertificateArn: arn:aws:iam::123456789012:server-certificate/test.domain.com
            DefaultActions:
              - Type: forward # Required.
                TargetGroupName: # Required. The name of the target group
        state: present

Mitigation / Fix

---
- name: Example playbook
  hosts: localhost
  tasks:
    - amazon.aws.elb_application_lb:
        access_logs_enabled: true
        access_logs_s3_bucket: mybucket
        access_logs_s3_prefix: "logs"
        name: myalb
        security_groups:
          - sg-12345678
          - my-sec-group
        subnets:
          - subnet-012345678
          - subnet-abcdef000
        listeners:
          - Protocol: HTTPS # Required. The protocol for connections from clients to the load balancer (HTTP or HTTPS) (case-sensitive).
            Port: 443 # Required. The port on which the load balancer is listening.
            # The security policy that defines which ciphers and protocols are supported. The default is the current predefined security policy.
            SslPolicy: ELBSecurityPolicy-TLS-1-2-2017-01
            Certificates: # The ARN of the certificate (only one certficate ARN should be provided)
              - CertificateArn: arn:aws:iam::123456789012:server-certificate/test.domain.com
            DefaultActions:
              - Type: forward # Required.
                TargetGroupName: # Required. The name of the target group
        state: present