Elastic Load Balancer has only HTTPS or SSL listeners

Check ID: elb_ssl_listeners
Provider: AWS
Service: elb
Severity: MEDIUM
Categories: encryption
Resource type: AwsElbLoadBalancer

What this check verifies

Elastic Load Balancers are assessed for client-facing listener protocols. Only HTTPS or SSL are considered encrypted; any HTTP or TCP listener indicates plaintext between clients and the load balancer.

Risk

Plaintext listeners enable network eavesdropping and content injection, compromising confidentiality and integrity. Attackers on public or untrusted paths can harvest credentials and session tokens or alter traffic via MITM, leading to data exposure and unauthorized access.

Recommendation

Enforce encryption in transit by using only HTTPS/TLS listeners. Redirect HTTP to HTTPS and retire plaintext listeners. Use trusted certificates (e.g., ACM) and modern TLS policies; align with zero trust and defense in depth. If needed, use end-to-end TLS to targets and monitor certificate health.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elb delete-load-balancer-listeners —load-balancer-name <lb_name> —load-balancer-ports 80

# Classic ELB with only encrypted (HTTPS) listener
resource "aws_elb" "<example_resource_name>" {
  availability_zones = ["<example_az>"]

  listener {
    lb_port            = 443
    lb_protocol        = "https"   # CRITICAL: enforce encrypted listener
    instance_port      = 80
    instance_protocol  = "http"
    ssl_certificate_id = "<certificate_arn>"  # CRITICAL: required for HTTPS/SSL
  }
}

# CloudFormation: Classic ELB with only encrypted (HTTPS) listener
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      AvailabilityZones:
        - <example_az>
      Listeners:
        - Protocol: HTTPS           # CRITICAL: enforce encrypted listener
          LoadBalancerPort: 443
          InstanceProtocol: HTTP
          InstancePort: 80
          SSLCertificateId: <certificate_arn>  # CRITICAL: required for HTTPS termination

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elb_ssl_listeners. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Elastic Load Balancer has access logs to S3 configured Classic Load Balancer SSL listeners use ACM certificates

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires