Load Balancer HTTPS listeners use a secure SSL policy

# Create and attach TLS 1.2-only policy to a Classic ELB HTTPS listener
resource "aws_load_balancer_policy" "<example_resource_name>" {
  load_balancer_name = "<example_resource_name>"
  policy_name        = "ELBSecurityPolicy-TLS-1-2-2017-01"  # Critical: policy named as required by the check
  policy_type_name   = "SSLNegotiationPolicyType"

  policy_attributes {
    name  = "Reference-Security-Policy"
    value = "ELBSecurityPolicy-TLS-1-2-2017-01"  # Critical: reference the predefined TLS 1.2 policy
  }
}

resource "aws_load_balancer_listener_policy" "<example_resource_name>" {
  load_balancer_name = "<example_resource_name>"
  load_balancer_port = 443
  policy_names       = [aws_load_balancer_policy.<example_resource_name>.policy_name]  # Critical: attach policy to HTTPS listener
}

# CloudFormation: Classic ELB with TLS 1.2-only security policy on HTTPS listener
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      AvailabilityZones:
        - <example_az>
      Listeners:
        - LoadBalancerPort: 443
          InstancePort: 443
          Protocol: HTTPS
          InstanceProtocol: HTTPS
          SSLCertificateId: <example_certificate_arn>
          PolicyNames:
            - ELBSecurityPolicy-TLS-1-2-2017-01  # Critical: attach TLS 1.2-only policy to the HTTPS listener
      Policies:
        - PolicyName: ELBSecurityPolicy-TLS-1-2-2017-01  # Critical: create policy referencing the predefined TLS 1.2 policy
          PolicyType: SSLNegotiationPolicyType
          Attributes:
            - Name: Reference-Security-Policy
              Value: ELBSecurityPolicy-TLS-1-2-2017-01  # Critical: enforce TLS 1.2-only