CRITICAL
Source
Trivy/CSPM
CSPM ID
insecure-ciphers
ID
AVD-AWS-0047

An outdated SSL policy is in use by a load balancer.

You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.

Impact

The SSL policy is outdated and has known vulnerabilities

Follow the appropriate remediation steps below to resolve the issue.

  1. Log in to the AWS Management Console.

  2. Select the “Services” option and search for EC2. Step

  3. In the “EC2 Dashboard” scroll down and look for “Load Balancing” and click on “Load Balancers” to get into “Load Balancers” dashboard.Step

  4. Select the “Load Balancer” which needs to be verified. Step

  5. Select the “Listeners” tab from the bottom panel and scroll down to the “Cipher” column of HTTPS Listener and click on “Change” option.Step

  6. If you are using a “Predefined Security Policy” select the latest from the dropdown.Step

  7. If you are using “Custom Security Policy” then ensure that only the recommended ciphers are used. Refer to the link for all secure ciphers. https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-ssl-security-policy.html#ssl-ciphers Step

  8. Scroll down and click on “Save” button to make the changes. Step

Use a more recent TLS/SSL policy for the load balancer

1
2
3
4
5
 resource "aws_alb_listener" "good_example" {
 	ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06"
 	protocol = "HTTPS"
 }