bug(misconf): AWS-0047 misses ELB security policies that allow TLS 1.0 and 1.1
Description
checks/cloud/aws/elb/use_secure_tls_policy.rego reports a listener only when its policy name is one of the following hard-coded values:
outdated_ssl_policies := {
"ELBSecurityPolicy-2015-05",
"ELBSecurityPolicy-2016-08",
"ELBSecurityPolicy-FS-2018-06",
"ELBSecurityPolicy-FS-1-1-2019-08",
"ELBSecurityPolicy-TLS-1-0-2015-04",
"ELBSecurityPolicy-TLS-1-1-2017-01",
"ELBSecurityPolicy-TLS13-1-0-2021-06",
"ELBSecurityPolicy-TLS13-1-1-2021-06",
"ELBSecurityPolicy-TLS13-1-2-Ext1-2021-06",
"ELBSecurityPolicy-TLS13-1-2-Ext2-2021-06",
}Eleven predefined policies permit TLS 1.0 or TLS 1.1. Four of them are not in the set:
- ELBSecurityPolicy-TLS13-1-0-FIPS-2023-04
- ELBSecurityPolicy-TLS13-1-0-FIPS-PQ-2025-09
- ELBSecurityPolicy-TLS13-1-0-PQ-2025-09
- ELBSecurityPolicy-TLS13-1-1-FIPS-2023-04
Their protocol range is the same as that of ELBSecurityPolicy-TLS13-1-0-2021-06 and ELBSecurityPolicy-TLS13-1-1-2021-06, which the check does report. The four sit in the FIPS and post-quantum sections of the documentation, apart from the section holding the policies already covered.
Reproduction
resource "aws_lb" "example" {
load_balancer_type = "application"
}
resource "aws_lb_listener" "example" {
load_balancer_arn = aws_lb.example.arn
port = 443
protocol = "HTTPS"
ssl_policy = "ELBSecurityPolicy-TLS13-1-0-FIPS-2023-04"
}No finding, although the listener accepts TLS 1.0.
A listener with no policy is not checked
When ssl_policy is omitted, the adapter yields an empty string, which matches nothing in the set. AWS and the Terraform provider both document the default as ELBSecurityPolicy-2016-08, which permits TLS 1.0.
ssl_policy- (Optional) Name of the SSL Policy for the listener. Required ifprotocolisHTTPSorTLS. Default isELBSecurityPolicy-2016-08.
Supplying that default belongs in the Trivy adapter, and it applies only to listeners that terminate TLS. Telling those apart needs the protocol, which the adapter fills only for load balancers of type application: a network load balancer listener written with protocol = "TLS" arrives here with an empty protocol.
Entry that cannot match
ELBSecurityPolicy-TLS-1-0-2015-04 is in neither the Application nor the Network Load Balancer policy list, so ssl_policy never holds it. It looks like a Classic Load Balancer name, and Classic listeners are not adapted, so an aws_elb produces no findings and no sign that it was skipped.
The description should say that the check covers Application and Network Load Balancer listeners.
What counts as outdated
The metadata gives the criterion as a protocol version: "You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+". Two entries do not follow from it. ELBSecurityPolicy-TLS13-1-2-Ext1-2021-06 and -Ext2-2021-06 have a minimum of TLS 1.2. What sets them apart from ELBSecurityPolicy-TLS13-1-2-2021-06 is a cipher list that includes suites without ECDHE, so a session can be negotiated without forward secrecy.
If the criterion is the version alone, Ext1 and Ext2 do not belong in the set.
If it covers forward secrecy as well, these have the same property and are missing:
- ELBSecurityPolicy-TLS-1-2-2017-01
- ELBSecurityPolicy-TLS-1-2-Ext-2018-06
- ELBSecurityPolicy-TLS13-1-2-Ext1-PQ-2025-09
- ELBSecurityPolicy-TLS13-1-2-Ext1-FIPS-2023-04
- ELBSecurityPolicy-TLS13-1-2-Ext1-FIPS-PQ-2025-09
- ELBSecurityPolicy-TLS13-1-2-Ext2-PQ-2025-09
- ELBSecurityPolicy-TLS13-1-2-Ext2-FIPS-2023-04
- ELBSecurityPolicy-TLS13-1-2-Ext2-FIPS-PQ-2025-09
- ELBSecurityPolicy-TLS13-1-2-Ext0-RFC9151-FIPS-2023-07
- ELBSecurityPolicy-TLS13-1-2-RFC9151-INTEROP4-FIPS-2023-07
ELBSecurityPolicy-TLS13-1-2-Ext0-FIPS-2023-04 stays out of that list. It carries the Ext prefix, yet every suite in it uses ECDHE, so the prefix alone does not answer the question.
References
Source: aquasecurity/trivy