Application and Network Load Balancers with listeners should use recommended security policies

How to fix it

• Can break clients: Clients limited to TLS 1.1 or older, or to ciphers the new policy drops, can no longer connect, so check the access logs for the versions in use first.
• Interrupts service: AWS warns that changing the policy can disrupt a load balancer under high traffic, so apply it at a quiet time or after an LCU reservation.

In the console

EC2 → Load balancers → the load balancer → Listeners and rules → the listener → Secure listener settings

Security policy

ELBSecurityPolicy-TLS13-1-2-Res-2021-06, or ELBSecurityPolicy-TLS13-1-3-2021-06 if every client has TLS 1.3

With the AWS CLI

aws elbv2 modify-listener --listener-arn <listener-arn> --ssl-policy ELBSecurityPolicy-TLS13-1-2-Res-2021-06 --region <region>

With Terraform

resource "aws_lb_listener" "https" {
  load_balancer_arn = var.load_balancer_arn
  port              = 443
  protocol          = "HTTPS"
  certificate_arn   = var.acm_certificate_arn
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-Res-2021-06"

  default_action {
    type             = "forward"
    target_group_arn = var.target_group_arn
  }
}