Use of plain HTTP.
Plain HTTP is unencrypted and human-readable. This means that if a malicious actor was to eavesdrop on your connection, they would be able to see all of your data flowing back and forth. You should use HTTPS, which is HTTP over an encrypted (TLS) connection, meaning eavesdroppers cannot read your traffic.
Impact
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
-
Log in to the AWS Management Console.
-
Select the “Services” option and search for EC2.
-
In the “EC2 Dashboard” scroll down and look for “Load Balancing” and click on “Load Balancers” to get into “Load Balancers” dashboard.
-
Select the “Load Balancer” which needs to be verified.
-
Select the “Listeners” tab from the bottom panel and scroll down to the “Load Balancer Protocol” column. Check for “HTTP” under “Instance Protocol”.
-
On the “Listeners” tab scroll down and click on the “Edit” button to remove non-HTTPS listeners.
-
On “Edit listers” tab remove non-HTTPS listeners by clicking on cross icon at the extreme right and click on the “Save” button to make the necessary changes.
-
ELBs are now configured to only accept the connection on HTTPS ports.