Application Load Balancer listeners use HTTPS

Check ID: elbv2_ssl_listeners
Provider: AWS
Service: elbv2
Severity: MEDIUM
Categories: encryption
Resource type: AwsElbv2LoadBalancer

What this check verifies

Application Load Balancer listeners are assessed for encrypted ingress: either only HTTPS listeners are present, or any HTTP listener redirects to HTTPS.

Risk

Exposed HTTP paths allow traffic to travel in plaintext, enabling interception, credential theft, session hijacking, and response tampering. This weakens confidentiality and integrity and makes MITM on public or shared networks feasible.

Recommendation

Enforce TLS everywhere: use HTTPS listeners and make all HTTP listeners redirect to HTTPS only. Do not forward plaintext. Apply defense in depth with strong TLS policies and managed certificates, and consider HSTS to prevent users from reaching http.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elbv2 modify-listener --listener-arn <listener_arn> --default-actions '[{"Type":"redirect","RedirectConfig":{"Protocol":"HTTPS","Port":"443","StatusCode":"HTTP_301"}}]'

# Terraform: Redirect HTTP listener to HTTPS
resource "aws_lb_listener" "<example_resource_name>" {
  load_balancer_arn = "<example_resource_id>"
  protocol          = "HTTP"
  port              = 80

  default_action {
    type = "redirect"
    redirect {
      protocol   = "HTTPS"   # Critical: redirect to HTTPS
      port       = "443"     # Critical: target HTTPS port
      status_code = "HTTP_301" # Critical: enforce redirect
    }
  }
}

# CloudFormation: Redirect HTTP listener to HTTPS
Resources:
  <example_resource_name>:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: <example_resource_id>
      Protocol: HTTP
      Port: 80
      DefaultActions:
        - Type: redirect
          RedirectConfig:
            Protocol: HTTPS  # Critical: redirect HTTP to HTTPS
            Port: '443'      # Critical: target HTTPS port
            StatusCode: HTTP_301  # Critical: enforce redirect

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elbv2_ssl_listeners. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ELBv2 Network Load Balancer has TLS termination enabled Application Load Balancer has a WAF Web ACL attached

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires