7.4 Enforcing Encryption in Transit: ELB Security Policies, TLS & HTTPS-Only Access

7.4 Enforcing Encryption in Transit: ELB Security Policies, TLS & HTTPS-Only Access

Skill 5.1.1 asks you to design mechanisms that require encryption when clients connect to resources, for example by configuring Elastic Load Balancing security policies and enforcing TLS. The exam cares less about TLS internals (general TLS concepts were removed from the outline) and more about where each AWS service lets you reject plaintext or weak connections.

---

Elastic Load Balancing

Application Load Balancer (ALB)

• HTTPS listener with a certificate from ACM (or imported into ACM or IAM), plus an HTTP listener whose only action redirects to HTTPS (HTTP 301). The AWS Config managed rule alb-http-to-https-redirection-check detects ALBs that don't redirect.
• Security policy: selects the TLS protocol versions and ciphers the listener accepts. When you create an HTTPS listener in the console, the default policy is ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09, which allows TLS 1.3 and TLS 1.2 with restricted ciphers and hybrid post-quantum key exchange. When you create a listener with the API or CLI without naming a policy, the default is the older ELBSecurityPolicy-2016-08, so infrastructure-as-code templates should always set the policy explicitly.
• Policy families: TLS 1.3-only policies, FIPS policies (for workloads that must use FIPS 140 validated cryptography), and post-quantum (PQ) policies. Choose the strictest policy your clients support.
• Mutual TLS (mTLS): In verify mode, the ALB authenticates client certificates against a trust store (CA bundle in S3, optional revocation lists). In passthrough mode, the ALB forwards the client certificate chain to targets in HTTP headers for the application to verify.
• Re-encryption to targets: Use HTTPS target groups so traffic stays encrypted from the ALB to the targets. The ALB doesn't validate the target's certificate, so self-signed certificates on targets work, but the ALB can't detect an impersonating target.

Network Load Balancer (NLB)

• A TLS listener terminates TLS on the NLB with an ACM certificate and a security policy, then re-encrypts to TLS targets or forwards in plaintext.
• A TCP listener passes TLS through untouched when targets must terminate TLS themselves (for example, for end-to-end encryption or client-certificate authentication at the target).

---

Amazon CloudFront

The viewer certificate for a custom domain must be in ACM in us-east-1.

---

Requiring TLS in Resource Policies

Many services accept both HTTP and HTTPS endpoints, or accept TLS 1.2 by default. Resource policies close the gap:

{
  "Sid": "DenyInsecureTransport",
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:*",
  "Resource": [
    "arn:aws:s3:::payments-data",
    "arn:aws:s3:::payments-data/*"
  ],
  "Condition": { "Bool": { "aws:SecureTransport": "false" } }
}

• aws:SecureTransport works in S3 bucket policies, SQS queue policies, SNS topic policies, and other resource policies. The Config rule s3-bucket-ssl-requests-only checks S3 buckets for it.
• s3:TlsVersion is a numeric condition key; "NumericLessThan": { "s3:TlsVersion": "1.3" } in a deny statement requires TLS 1.3. AWS service endpoints already require at least TLS 1.2.
• EFS file system policies can deny aws:SecureTransport false so that clients must mount with TLS (mount -t efs -o tls).

---

Enforcing TLS on Data Services

---

Detecting Gaps at Scale

• AWS Config managed rules such as alb-http-to-https-redirection-check and s3-bucket-ssl-requests-only, deployed through a conformance pack, find non-compliant resources across accounts.
• Security Hub CSPM controls report load balancers with HTTP listeners or outdated TLS policies.
• AWS Firewall Manager can apply consistent AWS WAF and security group policies, and SCPs can deny CreateListener and ModifyListener calls unless the elasticloadbalancing:ListenerProtocol is HTTPS or TLS and the elasticloadbalancing:SecurityPolicy is an approved TLS 1.2 or 1.3 policy.

---

Specialty Exam Pitfalls

1. Relying on the API default policy: A listener created by script without a policy gets ELBSecurityPolicy-2016-08; specify a TLS 1.2 or 1.3 policy explicitly.
2. Assuming HTTPS to the ALB means HTTPS to targets: Configure HTTPS target groups when data must stay encrypted inside the VPC.
3. Terminating TLS where end-to-end encryption is required: Use an NLB TCP listener (TLS passthrough) if only the target may decrypt.
4. Forgetting non-HTTP services: Databases and caches need their own TLS settings; a secure load balancer doesn't protect database connections.