ELBv2 HTTPS listeners use a secure SSL policy

Check ID: elbv2_insecure_ssl_ciphers
Provider: AWS
Service: elbv2
Severity: MEDIUM
Categories: encryption
Resource type: AwsElbv2LoadBalancer

What this check verifies

ELBv2 HTTPS listeners are assessed for use of strong TLS policies. Listeners whose ssl_policy is not in the approved set (TLS 1.2/1.3-focused policies) may include weak protocols or ciphers.

Risk

Legacy or weak ciphers enable downgrade and man-in-the-middle attacks, allowing decryption of sessions, credential theft, and request tampering. This undermines confidentiality and integrity of data in transit and can expose cookies or tokens for account takeover.

Recommendation

Enforce modern TLS on load balancer listeners:

Use AWS recommended policies like ELBSecurityPolicy-TLS13-1-2-2021-06
Disable TLS 1.0/1.1 and weak ciphers; prefer suites with forward secrecy
Periodically review and update policies

Apply defense in depth with strict client access and least privilege for changes.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elbv2 modify-listener —listener-arn <listener_arn> —ssl-policy ELBSecurityPolicy-TLS13-1-2-2021-06

# Terraform: Ensure HTTPS listener uses a secure SSL policy
resource "aws_lb_listener" "<example_resource_name>" {
  load_balancer_arn = "<example_resource_arn>"
  port              = 443
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06" # FIX: approved secure policy
  certificate_arn   = "<example_certificate_arn>"

  default_action {
    type             = "forward"
    target_group_arn = "<example_resource_arn>"
  }
}

# CloudFormation: Set a secure SSL policy on an HTTPS listener
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: <example_resource_arn>
      Protocol: HTTPS
      Port: 443
      DefaultActions:
        - Type: forward
          TargetGroupArn: <example_resource_arn>
      Certificates:
        - CertificateArn: <example_certificate_arn>
      SslPolicy: ELBSecurityPolicy-TLS13-1-2-2021-06  # FIX: uses an approved secure policy to eliminate insecure ciphers

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elbv2_insecure_ssl_ciphers. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Application Load Balancer mitigates desync attacks Application Load Balancer is not publicly accessible

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires