Findings
AWS ALB listeners should use HTTPS or TLS termination
Updated: June 19, 2025
Description
The Application Load Balancer (ALB) has one or more listeners that are not configured to use TLS or HTTPS protocols for front-end connections.
This configuration exposes sensitive data to potential interception, as connections are transmitted in plaintext without encryption. Such a setup increases the risk of data breaches and non-compliance with modern security and privacy standards.
Example Attack
An attacker intercepts traffic between a client and an Application Load Balancer that is not configured to use HTTPS or TLS. Because the connection is unencrypted, the attacker can easily capture sensitive data, such as login credentials or session tokens, by performing a man-in-the-middle attack. This can lead to data breaches, unauthorized access, or even identity theft.
Remediation
Update the Application Load Balancer's listeners to use TLS or HTTPS protocols for secure communication. Apply a strong, predefined security policy that enforces modern encryption standards.
Security Frameworks
Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.
Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [Assignment: organization-defined information flow control policies].
For password-based authentication:
(a) Maintain a list of commonly-used, expected, or compromised passwords and update the list [Assignment: organization-defined frequency] and when organizational passwords are suspected to have been compromised directly or indirectly;
(b) Verify, when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5(1)(a);
(c) Transmit passwords only over cryptographically-protected channels;
(d) Store passwords using an approved salted key derivation function, preferably using a keyed hash;
(e) Require immediate selection of a new password upon account recovery;
(f) Allow user selection of long passwords and passphrases, including spaces and all printable characters;
(g) Employ automated tools to assist the user in selecting strong password authenticators; and
(h) Enforce the following composition and complexity rules: [Assignment: organization-defined composition and complexity rules].
Produce, control, and distribute asymmetric cryptographic keys using [Selection: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user's private key; certificates issued in accordance with organization-defined requirements].
- Determine the [Assignment: organization-defined cryptographic uses]; and
- Implement the following types of cryptography required for each specified cryptographic use: [Assignment: organization-defined types of cryptography for each specified cryptographic use].
Protect the authenticity of communications sessions.
Generate a unique session identifier for each session with [Assignment: organization-defined randomness requirements] and recognize only session identifiers that are system-generated.
(a) Implement a managed interface for each external telecommunication service;
(b) Establish a traffic flow policy for each managed interface;
(c) Protect the confidentiality and integrity of the information being transmitted across each interface;
(d) Document each exception to the traffic flow policy with a supporting mission or business need and duration of that need;
(e) Review exceptions to the traffic flow policy [Assignment: organization-defined frequency] and remove exceptions that are no longer supported by an explicit mission or business need;
(f) Prevent unauthorized exchange of control plane traffic with external networks;
(g) Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks; and
(h) Filter unauthorized control plane traffic from external networks.
Protect the [Selection (one or more): confidentiality; integrity] of transmitted information.
Implement cryptographic mechanisms to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission.
Maintain the [Selection (one or more): confidentiality; integrity] of information during preparation for transmission and during reception.
Implement cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.