Quick Info
| Plugin Title | ELB HTTPS Only |
| Cloud | AWS |
| Category | ELB |
| Description | Ensures ELBs are configured to only accept connections on HTTPS ports. |
| More Info | For maximum security, ELBs can be configured to only accept HTTPS connections. Standard HTTP connections will be blocked. This should only be done if the client application is configured to query HTTPS directly and not rely on a redirect from HTTP. |
| AWS Link | http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-security-policy-options.html |
| Recommended Action | Remove non-HTTPS listeners from load balancer. |
Detailed Remediation Steps
- Log into the AWS Management Console.
- Select the “Services” option and search for EC2.
- In the “EC2 Dashboard” scroll down and look for “Load Balancers” and click on “Load Balancers” to get into “Load Balancers” dashboard.
- Select the “Load Balancer” which needs to be verified.
- Select the “Listeners” tab from the bottom panel and scroll down to the “Load Balancer Protocol” column. Check for “HTTP” under “Instance Protocol”.
- On the “Listeners” tab scroll down and click on the “Edit” button to remove non-HTTPS listeners.
- On “Edit listers” tab remove non-HTTPS listeners by clicking on cross icon at the extreme right and click on the “Save” button to make the necessary changes.
- ELBs are now configured to only accept the connection on HTTPS ports.