ALB Listening on HTTP
- Query id: f81d63d2-c5d7-43a4-a5b5-66717a41c895
- Query name: ALB Listening on HTTP
- Platform: Ansible
- Severity: High
- Category: Networking and Firewall
- URL: Github
Description¶
AWS Application Load Balancer (alb) should not listen on HTTP
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Postitive test num. 1 - yaml file
- name: my_elb_application
community.aws.elb_application_lb:
name: myelb
security_groups:
- sg-12345678
- my-sec-group
subnets:
- subnet-012345678
- subnet-abcdef000
listeners:
- Protocol: HTTP
Port: 80
SslPolicy: ELBSecurityPolicy-2015-05
Certificates:
- CertificateArn: arn:aws:iam::12345678987:server-certificate/test.domain.com
DefaultActions:
- Type: forward
TargetGroupName: targetname
state: present
- name: my_elb_application2
community.aws.elb_application_lb:
name: myelb2
security_groups:
- sg-12345678
- my-sec-group
subnets:
- subnet-012345678
- subnet-abcdef000
listeners:
Port: 80
SslPolicy: ELBSecurityPolicy-2015-05
Certificates:
- CertificateArn: arn:aws:iam::12345678987:server-certificate/test.domain.com
DefaultActions:
- Type: forward
TargetGroupName: targetname
state: present
Code samples without security vulnerabilities¶
Negative test num. 1 - yaml file
- name: my_elb_application
community.aws.elb_application_lb:
name: myelb
security_groups:
- sg-12345678
- my-sec-group
subnets:
- subnet-012345678
- subnet-abcdef000
listeners:
- Protocol: HTTPS
Port: 80
SslPolicy: ELBSecurityPolicy-2015-05
Certificates:
- CertificateArn: arn:aws:iam::12345678987:server-certificate/test.domain.com
DefaultActions:
- Type: forward
TargetGroupName: targetname
state: present
# trigger validation