CRITICAL
Source
Trivy/CSPM
CSPM ID
insecure-ciphers
ID
AVD-AWS-0047

An outdated SSL policy is in use by a load balancer.

You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.

Impact

The SSL policy is outdated and has known vulnerabilities

Follow the appropriate remediation steps below to resolve the issue.

  1. Log into the AWS Management Console.
  2. Select the “Services” option and search for EC2. Step
  3. In the “EC2 Dashboard” scroll down and look for “Load Balancers” and click on “Load Balancers” to get into “Load Balancers” dashboard.Step
  4. Select the “Load Balancer” which needs to be verified. Step
  5. Select the “Listeners” tab from the bottom panel and scroll down to the “Cipher” column of HTTPS Listener and click on “Change” option.Step
  6. From “Select a Cipher” panel select either of “Predefined Security Policy” and “Custom Security Policy”.Step
  7. Scan the “SSL Cipher Section” from selected “Security Policy” for any insecure ciphers. Refer to the link for all secure ciphers. https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-ssl-security-policy.html#ssl-ciphers Step
  8. Scroll down and click on “Save” button to make the changes. Step

Use a more recent TLS/SSL policy for the load balancer

1
2
3
4
resource "aws_alb_listener" "good_example" {
  ssl_policy = "ELBSecurityPolicy-TLS-1-2-2017-01"
  protocol = "HTTPS"
}