Web-Tier ELB Listener Security

Cloud Conformity allows you to automate the auditing process of this resolution page. Register for a 14 day evaluation and check your compliance level for free!

Start a Free Trial Product features

Knowledge Base Amazon Web Services Elastic Load Balancing Web-Tier ELB Listener Security

Risk level: High (not acceptable risk)

Rule ID: ELB-017

Ensure that your web-tier Elastic Load Balancer (ELB) listeners are using a secure protocol such as HTTPS/SSL to encrypt the communication between the web application clients and the load balancer. This conformity rule assumes that all AWS resources (including ELBs) provisioned in your web tier are tagged with <web_tier_tag>:<web_tier_tag_value>, where <web_tier_tag> represents the tag name and <web_tier_tag_value> the tag value. Prior to running this rule by the Cloud Conformity engine, the web-tier tags must be configured within the rule settings, on your account dashboard.

This rule can help you with the following compliance standards:

Payment Card Industry Data Security Standard (PCI DSS)
APRA
MAS

This rule resolution is part of the Cloud Conformity Security & Compliance tool for AWS

Security

When a web-tier AWS ELB has no HTTPS/SSL listeners, the front-end connection between the clients and the load balancer is vulnerable to eavesdropping and Man-In-The-Middle (MITM) attacks. The risk becomes even higher when the application is working with sensitive data such as health and personal records, credentials and credit card numbers. Using an HTTPS/SSL listener for the ELBs within your web tier will ensure that the front-end traffic is encrypted over the SSL\TLS channel and the web client data is secured.

Note: Make sure that you replace all <web_tier_tag>:<web_tier_tag_value> tag placeholders found in the conformity rule content with your own tag name and value created for the web tier.

Audit

To check your web-tier AWS ELB listeners for secure (HTTPS/SSL) configurations, perform the following actions:

Using AWS Console

01 Sign in to your Cloud Conformity console, access Web-Tier ELB Listener Security conformity rule settings and copy the tag set defined for AWS resources available in your web tier (e.g. <web_tier_tag>:<web_tier_tag_value>).

02 Sign in to the AWS Management Console.

03 Navigate to EC2 dashboard at https://console.aws.amazon.com/ec2/.

04 In the navigation panel, under LOAD BALANCING, click Load Balancers.

05 Paste the tag set copied at step no. 1 in the Filter by tags and attributes or search by keyword box, then add a space before and after the separation colon (i.e. <web_tier_tag> : <web_tier_tag_value>) and press Enter. This filtering procedure will return only the ELBs tagged for the web tier. If no results are returned, there are no ELBs tagged within your web tier and the audit process ends here. If the EC2 dashboard lists one or more load balancers, continue the audit process with the next step.

06 Select the web-tier ELB that you want to examine.

07 Select the Listeners tab from the bottom panel.

08 Under Load Balancer Protocol column, check the protocol for each listener available. If there is no listener using either the HTTPS (Secure HTTP) or the SSL (Secure TCP) protocol, the listeners configuration for the selected web-tier ELB is not secure and the front-end connection between the web clients and the load balancer is not encrypted.

09 Repeat steps no. 6 – 8 to verify other ELBs created for your web tier in the selected AWS region, for secure configurations.

10 Change the AWS region from the navigation bar and repeat steps no. 5 – 9 for other regions.

Using AWS CLI

01 Sign in to your Cloud Conformity console, access Web-Tier ELB Listener Security conformity rule settings and copy the tag set defined for AWS resources available in your web tier (e.g. <web_tier_tag>:<web_tier_tag_value>).

02 Run describe-load-balancers command (OSX/Linux/UNIX) to list the names of all AWS ELBs provisioned in the selected AWS region:

aws elb describe-load-balancers
	--region us-east-1
	--output table
	--query 'LoadBalancerDescriptions[*].LoadBalancerName'

03 The command output should return a table with the requested ELB names:

--------------------------
|  DescribeLoadBalancers |
+------------------------+
|  cc-web-load-balancer  |
|  cc-internal-app-elb   |
+------------------------+

04 Run describe-tags command (OSX/Linux/UNIX) using the name of the load balancer that you want to examine as identifier and custom query filters to describe the tags defined for the ELB selected resource (if any):

aws elb describe-tags
	--region us-east-1
	--load-balancer-name cc-web-load-balancer
	--query 'TagDescriptions[*].Tags[]'

05 The command request should return one of the following outputs:

If the describe-tags command output returns an empty array (i.e. []), as shown in the example below, the verified ELB is not tagged, therefore the audit process for the selected resource ends here:
```
[]
```
If the command output returns a set of tags that is different than the one copied at step no. 1, as shown in the example below, the verified ELB does not belong to your web tier, therefore the audit process for the selected resource ends here:
```
[
    {
        "Value": "Name",
        "Key": "CC Prod ELB"
    }
]
```
If the describe-tags command output returns a set of tags that match the one copied at step no. 1 (e.g. <web_tier_tag>:<web_tier_tag_value>), as shown in the example below, the verified AWS ELB is tagged as a web-tier resource, therefore the audit process continues with the next step.
```
[
    {
        "Value": "<web_tier_tag_value>",
        "Key": "<web_tier_tag>"
    }
]
```

06 Run describe-load-balancers command (OSX/Linux/UNIX) using the name of the web-tier ELB identified at the previous step to describe the resource listeners configuration and determine if the selected web-tier ELB is using secure listeners (HTTPS or SSL):

aws elb describe-load-balancers
	--region us-east-1
	--load-balancer-name cc-web-load-balancer
	--query "LoadBalancerDescriptions[*].{ListenerDescriptions:ListenerDescriptions[?Listener.Protocol == 'HTTPS' || Listener.Protocol == 'SSL']}"

07 The command output should list the HTTPS/SSL listeners configuration details for the selected ELB:

[
    {
        "ListenerDescriptions": []
    }
]

If value of the "ListenerDescriptions" object is an empty array, as shown in the example above, the current configuration is not using the HTTPS (Secure HTTP) protocol or the SSL (Secure TCP) protocol, therefore the listeners configuration for the selected web-tier ELB is not secure and the front-end traffic is not encrypted.

08 Repeat step no. 6 and 7 to verify other web-tier ELBs, provisioned within the selected AWS region, for secure configurations.

09 Change the AWS region by updating the --region command parameter value and repeat steps no. 2 – 8 to perform the audit process for other regions.

Remediation / Resolution

To secure the connection between the web clients and your web-tier load balancer by using SSL encryption, update your ELB configuration to use listeners with HTTPS or SSL protocols (an X.509 SSL certificate is required). To implement HTTPS/SSL protocol for your web-tier ELB listeners, perform the following actions:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to EC2 dashboard at https://console.aws.amazon.com/ec2/.

03 In the navigation panel, under LOAD BALANCING, click Load Balancers.

04 Select the web-tier ELB that you want to reconfigure (see Audit section part I to identify the right resource).

05 Select the Listeners tab from the bottom panel and click the Edit button under the available listener(s).

06 Inside the Edit listeners dialog box, click Add to add a new entry.

07 In the Load Balancer Protocol dropdown list, select HTTPS (Secure HTTP) or SSL (Secure TCP).

08 In the Cipher column, click Change and make sure the latest Predefined Security Policy selected is ELBSecurityPolicy-2016-08 (recommended). If you want to use a custom policy, select Custom Security Policy and configure your own policy. If you need to apply any changes click Save, otherwise click Cancel to return to the Edit listeners dialog box.

09 In the SSL Certificate column, click Change and select one of the following options:

Choose a certificate from ACM (recommended) - to use an existing SSL certificate purchased via Amazon Certificate Manager (ACM). If you haven’t purchased yet any SSL certificates you can request one by clicking Request a new ACM certificate link and AWS will redirect your request to the ACM dashboard where you can buy the required certificate. Click Save to apply the selected certificate.
Choose a certificate from IAM - to use an existing SSL certificate uploaded previously to AWS IAM service using the AWS console. Select the name of the SSL certificate that you want install from the Certificate dropdown list. Click Save to apply the changes.
Upload a certificate to IAM - deploy an SSL certificate purchased from a third-party provider by entering the required information (pem encoded) within the Private Key, Certificate body and Certificate chain boxes, information granted by the SSL provider from which you bought the certificate. Make sure you type a unique name for the uploaded SSL certificate in the Certificate name box. Click Save to apply the installed SSL certificate.

10 Back to the Edit listeners dialog box, review the secure listeners configuration, then click Save. If successful, the following message will be displayed: “Finished updating listeners. Your listeners have been successfully updated.”. Click Close to return to the EC2 dashboard.

11 Repeat steps no. 4 – 10 for each web-tier ELB that needs to secure its front-end traffic, provisioned in the selected region.

12 Change the AWS region from the navigation bar and repeat steps no. 4 – 11 for other regions.

Using AWS CLI

01 Depending on the AWS service used to manage your SSL certificates, perform one of the following actions

Get the Amazon Resource Name (ARN) of the SSL certificate(s) purchased via AWS ACM. The certificate ARN will be required later when HTTPS/SSL listeners will be created:
- Run list-certificates command (OSX/Linux/UNIX) to describe the ARN(s) and domain name(s) of the SSL certificate(s) purchased with AWS ACM:
```
aws acm list-certificates
	--region us-east-1
```
- The command output should return the requested certificate(s) information:
```
{
   "CertificateSummaryList": [
      {
       "CertificateArn": "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012",
       "DomainName": "www.cloudconformity.com"
      }
   ]
}
```

Get the ARN of your SSL certificate(s) uploaded to AWS IAM:

Run list-server-certificates command (OSX/Linux/UNIX) to describe the metadata (certificate ARN(s), name(s), etc), available for the SSL certificate(s) uploaded to AWS IAM:
```
aws iam list-server-certificates
```

The command output should return the requested metadata:

{
    "ServerCertificateMetadataList": [
        {
            "ServerCertificateName": "cc-frontend-certificate",
            "Expiration": "2018-05-08T23:59:59Z",
            "Path": "/",
            "Arn": "arn:aws:iam::123456789012:server-certificate/cc- frontend-certificate",
            "UploadDate": "2017-02-09T10:51:08Z"
        }
    ]
}

02 Run create-load-balancer-listeners command (OSX/Linux/UNIX) to create a new HTTPS listener for the selected web-tier ELB using the SSL certificate identified at the previous step. The following command example will create a front-end HTTPS listener for a web-tier ELB named "cc-web-load-balancer" using an SSL certificate identified by the ARN "arn:aws:iam::123456789012:server-certificate/cc-frontend-certificate" (the command does not produce an output):

aws elb create-load-balancer-listeners
	--region us-east-1
	--load-balancer-name cc-web-load-balancer
	--listeners Protocol=HTTPS,LoadBalancerPort=443,InstanceProtocol=HTTP,InstancePort=80,SSLCertificateId=arn:aws:iam::123456789012:server-certificate/cc-frontend-certificate

03 Repeat step no. 2 for each web-tier ELB that needs to secure its front-end traffic, available in the selected region.

04 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 – 3 for other regions.

References

AWS Command Line Interface (CLI) Documentation
elb
describe-load-balancers
describe-tags
create-load-balancer-listeners
acm
list-certificates
iam
list-server-certificates

Publication date May 8, 2018

Web-Tier ELB Listener Security

Audit

Using AWS Console

Using AWS CLI

Remediation / Resolution

Using AWS Console

Using AWS CLI

References

Related ELB rules