Application Load Balancer should be configured to redirect all HTTP requests to HTTPS

How to fix it

• Can break clients: The listener stops forwarding and answers every request with a redirect, so an HTTPS listener must already serve port 443 or those clients reach nothing.
• Affects another check: The redirecting HTTP listener still fails ELB.18, which wants no HTTP listener; deleting it instead, if no client needs the redirect, passes both.

In the console

EC2 → Load balancers → the load balancer → Listeners and rules → the HTTP listener → Rules → Default → Actions → Edit rule

Default action

Redirect to URL

URI parts → Protocol

HTTPS

URI parts → Port

443

Status code

Permanent (HTTP 301)

With the AWS CLI

aws elbv2 modify-listener --listener-arn <listener-arn> --default-actions Type=redirect,RedirectConfig='{Protocol=HTTPS,Port=443,StatusCode=HTTP_301}' --region <region>

With Terraform

resource "aws_lb_listener" "http_redirect" {
  load_balancer_arn = var.load_balancer_arn
  port              = 80
  protocol          = "HTTP"

  default_action {
    type = "redirect"

    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}