ELBv2 Network Load Balancer has TLS termination enabled

Check ID: elbv2_nlb_tls_termination_enabled
Provider: AWS
Service: elbv2
Severity: MEDIUM
Categories: encryption
Resource type: AwsElbv2LoadBalancer

What this check verifies

Network Load Balancers with listeners using the TLS protocol indicate TLS termination at the load balancer. The evaluation identifies NLBs that have at least one TLS listener versus those using plain TCP/UDP or deferring encryption to targets.

Risk

Lack of NLB-level TLS termination can leave transit data unencrypted or managed inconsistently on instances, undermining confidentiality and integrity. It also shifts handshake CPU cost to targets, reducing availability and making them more susceptible to connection floods and downgrade or weak-cipher exposures.

Recommendation

Enable TLS listeners to terminate client encryption at the NLB and enforce centralized, modern cipher policies and certificate rotation. Apply defense in depth by re-encrypting to targets when needed, limit backend access to the NLB, and automate certificate lifecycle with secure storage and monitoring for deprecated protocols.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elbv2 create-listener --load-balancer-arn <nlb_arn> --protocol TLS --port 443 --ssl-policy ELBSecurityPolicy-TLS13-1-2-2021-06 --certificates CertificateArn=<certificate_arn> --default-actions Type=forward,TargetGroupArn=<target_group_arn>

# Terraform: Add a TLS listener to enable TLS termination on the NLB
resource "aws_lb_listener" "<example_resource_name>" {
  load_balancer_arn = "<example_resource_arn>"
  port              = 443
  protocol          = "TLS"  # critical: enables TLS termination
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"  # critical: required for TLS
  certificate_arn   = "<example_resource_arn>"  # critical: server certificate for TLS termination

  default_action {
    type             = "forward"
    target_group_arn = "<example_resource_arn>"
  }
}

# CloudFormation: Add a TLS listener to enable TLS termination on the NLB
Resources:
  "<example_resource_name>":
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: "<example_resource_arn>"
      Protocol: TLS  # critical: enables TLS termination on the NLB
      Port: 443
      SslPolicy: ELBSecurityPolicy-TLS13-1-2-2021-06  # critical: required when Protocol is TLS
      Certificates:
        - CertificateArn: "<example_resource_arn>"  # critical: server certificate for TLS termination
      DefaultActions:
        - Type: forward
          TargetGroupArn: "<example_resource_arn>"

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elbv2_nlb_tls_termination_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Application Load Balancer has S3 access logs enabled Application Load Balancer listeners use HTTPS

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires