Network Load Balancer Listener Security

Risk Level: High (not acceptable risk)

Rule ID: ELBv2-010

Ensure that your Amazon Network Load Balancers (NLBs) are configured with a secure listener protocol – TLS or QUIC – in order to encrypt the communication between the load balancer and the associated targets (i.e. server instances). A TLS listener terminates the connection at the load balancer, offloading the encryption and decryption work from the backend servers. A QUIC listener, by contrast, passes QUIC traffic through to the targets unmodified – but the traffic remains encrypted end-to-end regardless, since the QUIC protocol itself mandates TLS 1.3 encryption as part of its handshake.

This rule can help you with the following compliance standards:

PCI
APRA
MAS

For further details on compliance standards supported by TrendAI Vision One™ Cloud Risk Management, see here.

Security

When Transport Layer Security (TLS) termination is enabled, you can offload the encryption and decryption of the TLS traffic from your backend application servers to your Amazon Network Load Balancer, enhancing the performance of your backend servers while keeping the workload secure. Also, by using built-in security policies with optimal TLS versions and ciphers, the application or service behind your Network Load Balancer (NLB) can achieve PCI and FedRAMP compliance.

QUIC listeners are a secure alternative to TLS listeners: the Network Load Balancer passes QUIC traffic through to the targets without decrypting it, similarly to how a plain TCP listener would, but because the QUIC protocol mandates TLS 1.3 encryption as part of its transport handshake, traffic sent over a QUIC listener is guaranteed to be encrypted end-to-end, unlike a plain TCP listener where encryption cannot be verified.

Audit

To determine if your Network Load Balancers (NLBs) are configured with a secure (TLS or QUIC) listener, perform the following actions:

Using AWS Console

Sign in to the AWS Management Console.
Navigate to Amazon EC2 console at https://console.aws.amazon.com/ec2/v2/.
In the main navigation panel, under Load Balancing, choose Load Balancers.
Click inside the Filter by tags and attributes or search by keyword box, select Type and choose network to list the Network Load Balancers deployed in the current AWS region.
Select the Network Load Balancer (NLB) that you want to examine.
Choose the Listeners and rules tab from the console bottom panel to access the listener configuration available for the selected load balancer.
Check the Protocol:Port value listed for the load balancer listener that you want to examine (or select the listener to view its details) to determine the listener protocol. If the protocol is not TLS or QUIC, the listener configuration is not secure.
Repeat step no. 7 for each listener configured for the load balancer. If there are no listeners configured with the TLS or QUIC protocol, the selected Network Load Balancer (NLB) is not using a secure listener protocol.
Repeat steps no. 5 – 8 for each Network Load Balancer provisioned within the current AWS region.
Change the AWS cloud region from the console navigation bar and repeat the Audit process for other regions.

Using AWS CLI

Run describe-load-balancers command (OSX/Linux/UNIX) with custom query filters to list the Amazon Resource Names (ARN) of each Network Load Balancer deployed in the selected AWS region:
```
aws elbv2 describe-load-balancers
  --region us-east-1
  --query 'LoadBalancers[?(Type == `network`)].LoadBalancerArn | []'
```

The command output should return an array with the requested load balancer ARN(s):

[
"arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/net/cc-network-load-balancer/abcdabcdabcdabcd",
"arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/net/cc-project5-load-balancer/aabbccddaabbccdd"
]

Run describe-listeners command (OSX/Linux/UNIX) using the ARN of the load balancer that you want to examine as the identifier parameter and custom query filters to describe the connection protocol of each listener configured for the selected load balancer:
```
aws elbv2 describe-listeners
  --region us-east-1
  --load-balancer-arn arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/net/cc-network-load-balancer/abcdabcdabcdabcd
  --query 'Listeners[*].Protocol'
```
The command output should return an array with the communication protocol(s) used by the load balancer listener(s):
```
[
    "TCP"
]
```
If the array returned by the describe-listeners command output does not contain "TLS" or "QUIC", there are no secure listeners configured for the load balancer, therefore the selected Amazon Network Load Balancer (NLB) is not using a secure (TLS or QUIC) listener protocol.
Repeat steps no. 3 and 4 for each Network Load Balancer provisioned in the selected AWS region.
Change the AWS cloud region by updating the --region command parameter value and repeat the Audit process for other regions.

Remediation / Resolution

To enable a secure listener protocol for your Amazon Network Load Balancers, update their listener configuration to support the TLS or QUIC protocol. A TLS listener requires an X.509 SSL certificate, which the load balancer uses to terminate and decrypt incoming connections. A QUIC listener does not use a certificate, since the Network Load Balancer passes QUIC traffic through to the targets without decrypting it (QUIC connections remain encrypted end-to-end because the protocol mandates TLS 1.3 encryption). To add a TLS or QUIC listener to your Network Load Balancer, perform the following actions:

To create a QUIC listener instead of a TLS listener, using any of the methods below, set the protocol value to QUIC and omit the certificate and security policy configuration (the SslPolicy/Certificates CloudFormation properties, the ssl_policy/certificate_arn Terraform arguments, the Security policy/Default SSL/TLS certificate console fields, or the --ssl-policy/--certificates CLI parameters), since QUIC listeners do not use a certificate. The target group forwarded to by a QUIC listener must also use the QUIC protocol – a listener creation request fails with an IncompatibleProtocols error if it points to a TCP (or other non-QUIC) target group. For Terraform, this requires an AWS provider version recent enough to support the QUIC protocol value – newer than the ~> 4.0 constraint used in the example below – so check the aws_lb_listener resource documentation for your provider version if the QUIC protocol value is rejected. Only one QUIC listener is allowed per Network Load Balancer, and QUIC listeners cannot be added to dualstack load balancers, load balancers with associated security groups, or load balancers that already have a UDP or TCP_UDP listener.

Using AWS CloudFormation

CloudFormation template (JSON):

{
				"AWSTemplateFormatVersion": "2010-09-09",
				"Description": "Add TLS Listener to Network Load Balancer",
				"Resources": {
				"NetworkLoadBalancer": {
				"Type": "AWS::ElasticLoadBalancingV2::LoadBalancer",
				"Properties" : {
					"Name" : "cc-network-load-balancer",
					"Type" : "network",
					"Scheme" : "internet-facing",
					"IpAddressType" : "ipv4",
					"Subnets" : [ "subnet-01234abcd1234abcd", "subnet-0abcd1234abcd1234" ]
				}
				},
				"TLSListener": {
					"Type" : "AWS::ElasticLoadBalancingV2::Listener",
					"Properties" : {
						"Protocol" : "TLS",
						"Port" : 443,
						"LoadBalancerArn": {
							"Ref" : "NetworkLoadBalancer"
						},
						"DefaultActions": [
							{
								"Type" : "forward",
								"TargetGroupArn" : "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/cc-network-target-group/1111222233334444"
							}
						],
						"SslPolicy" : "ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09",
						"Certificates" : [
						{
							"CertificateArn" : "arn:aws:iam::123456789012:server-certificate/example-certificate"
						}
						]
					}
				}
				}
}

CloudFormation template (YAML):

AWSTemplateFormatVersion: '2010-09-09'
Description: Add TLS Listener to Network Load Balancer
Resources:
				NetworkLoadBalancer:
				Type: AWS::ElasticLoadBalancingV2::LoadBalancer
				Properties:
				Name: cc-network-load-balancer
				Type: network
				Scheme: internet-facing
				IpAddressType: ipv4
				Subnets:
					- subnet-01234abcd1234abcd
					- subnet-0abcd1234abcd1234
				TLSListener:
				Type: AWS::ElasticLoadBalancingV2::Listener
				Properties:
				Protocol: TLS
				Port: 443
				LoadBalancerArn: !Ref 'NetworkLoadBalancer'
				DefaultActions:
					- Type: forward
					TargetGroupArn: arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/cc-network-target-group/1111222233334444
				SslPolicy: ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09
				Certificates:
					- CertificateArn: arn:aws:iam::123456789012:server-certificate/example-certificate

Using Terraform (AWS Provider)

Terraform configuration file (.tf):

terraform {
				required_providers {
				aws = {
				source  = "hashicorp/aws"
				version = "~> 4.0"
				}
				}

				required_version = ">= 0.14.9"
}

provider "aws" {
				region  = "us-east-1"
}

resource "aws_lb" "network-load-balancer" {
				name               = "cc-network-load-balancer"
				load_balancer_type = "network"
				internal           = false
				ip_address_type    = "ipv4"
				subnets            = ["subnet-01234abcd1234abcd","subnet-0abcd1234abcd1234"]
}

# Add TLS Listener to Network Load Balancer
resource "aws_lb_listener" "tls-listener" {
				load_balancer_arn = aws_lb.network-load-balancer.arn
				protocol          = "TLS"
				port              = "443"
				ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09"
				certificate_arn   = "arn:aws:iam::123456789012:server-certificate/example-certificate"

				default_action {
				type             = "forward"
				target_group_arn = "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/cc-network-target-group/1111222233334444"
				}
}

Using AWS Console

Sign in to the AWS Management Console.
Navigate to Amazon EC2 console at https://console.aws.amazon.com/ec2/v2/.
In the main navigation panel, under Load Balancing, choose Load Balancers.
Click inside the Filter by tags and attributes or search by keyword box, select Type and choose network to list all the Network Load Balancers deployed within the current AWS region.
Select the Network Load Balancer (NLB) that you want to reconfigure.
Select the Listeners and rules tab from the console bottom panel and choose Add listener.
On the Add listener setup page, perform the following operations:
1. From the Protocol dropdown list, select TLS or QUIC. Sub-steps 4–6 below (Security policy, Default SSL/TLS certificate, ALPN policy) apply only if you selected TLS; skip them for a QUIC listener, since QUIC listeners do not use a certificate or security policy.
2. (Optional) You can use the default port (i.e. 443) or provide a custom port in the Port box.
3. For Default actions, select an existing target group or choose Create target group to create a new one. For a Network Load Balancer, the default action is a Forward action that routes requests to the target group that you select at this step.
4. Choose the following policy from the Security policy dropdown list: ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09 (recommended), to meet security, compliance, and regulatory requirements. This security policy includes TLS 1.3, which is optimized for security and performance, and is backward compatible with TLS 1.2.
5. For Default SSL/TLS certificate, choose one of the following options:
  - Choose From ACM and select an existing SSL/TLS certificate purchased via Amazon Certificate Manager (ACM). If you haven’t purchased one yet, choose Request new ACM certificate and the AWS Management Console will redirect your request to the ACM service console where you can buy the required SSL/TLS certificate.
  - Choose From IAM and select an existing SSL/TLS certificate uploaded previously to Amazon IAM.
  - Choose Import and select To ACM to deploy an existing SSL/TLS certificate by pasting the required information (in PEM-encoded format) to the Certificate private key, Certificate body and Certificate chain – optional boxes, information granted by the SSL/TLS provider from which you bought the certificate.
  - Choose Import and select To IAM to deploy an existing SSL/TLS certificate by pasting the required information (in PEM-encoded format) to the Certificate private key, Certificate body and Certificate chain – optional boxes, information granted by the SSL/TLS provider from which you bought the certificate. Once the necessary keys are validated, enter a name for the new certificate in the Certificate name box.
6. Choose the ALPN policy that you want to use for your new listener from the ALPN policy dropdown list. The Application-Layer Protocol Negotiation (ALPN) is a TLS extension that includes the protocol negotiation within the exchange of hello messages. If you choose an HTTP2Only ALPN policy, make sure your application supports HTTP/2 for TLS target groups.
7. Choose Add to create the secure listener, then select View listeners to return to the Amazon EC2 console.
Repeat steps no. 5 – 7 for each Network Load Balancer that you want to reconfigure, deployed within the current AWS region.
Change the AWS cloud region from the console navigation bar and repeat the Remediation process for other regions.

Using AWS CLI

If you are creating a TLS listener, get the Amazon Resource Name (ARN) available for your SSL certificate purchased via Amazon ACM or uploaded to Amazon IAM (skip this step for a QUIC listener, since QUIC listeners do not use a certificate):
1. Run list-certificates command (OSX/Linux/UNIX) to list the ARNs of the SSL/TLS certificates purchased using Amazon ACM service:
```
	aws acm list-certificates
	  --region us-east-1
	  --query 'CertificateSummaryList[*].CertificateArn'
	
```
2. The command output should return the requested Amazon Resource Names (ARNs):
```
	[
	   "arn:aws:acm:us-east-1:123456789012:certificate/aaaabbbb-cccc-dddd-eeee-123456789012"
	]
	
```
3. Run list-server-certificates command (OSX/Linux/UNIX) to list the ARNs of the SSL/TLS certificates managed by Amazon IAM service:
```
	aws iam list-server-certificates
	  --region us-east-1
	  --query 'ServerCertificateMetadataList[*].Arn'
	
```
4. The command output should return the requested SSL certificate ARN(s):
```
	[
	   "arn:aws:iam::123456789012:server-certificate/example-certificate"
	]
	
```

Run create-listener command (OSX/Linux/UNIX) using the Amazon Resource Name (ARN) of the SSL/TLS certificate that you want to use as the identifier parameter to create a TLS listener for the selected Network Load Balancer (NLB):

aws elbv2 create-listener
  --region us-east-1
  --load-balancer-arn arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/net/cc-network-load-balancer/abcdabcdabcdabcd
  --protocol TLS
  --port 443
  --ssl-policy ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09
  --certificates CertificateArn="arn:aws:iam::123456789012:server-certificate/example-certificate"
  --default-actions Type=forward,TargetGroupArn=arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/cc-network-target-group/1111222233334444

The command output should return the configuration information available for the new TLS listener:

{
    "Listeners": [
        {
            "Protocol": "TLS",
            "DefaultActions": [
                {
                    "TargetGroupArn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/cc-network-target-group/1111222233334444",
                    "Type": "forward"
                }
            ],
            "SslPolicy": "ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09",
            "Certificates": [
                {
                    "CertificateArn": "arn:aws:iam::123456789012:server-certificate/example-certificate"
                }
            ],
            "LoadBalancerArn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/net/cc-network-load-balancer/abcdabcdabcdabcd",
            "Port": 443,
            "ListenerArn": "arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/net/cc-network-load-balancer/abcdabcdabcdabcd/1122334411223344"
        }
    ]
}

Repeat steps no. 1 – 3 for each Network Load Balancer that you want to reconfigure, available in the selected AWS region.
Change the AWS cloud region by updating the --region command parameter value and repeat the Remediation process for other regions.

References

AWS Command Line Interface (CLI) Documentation
elbv2
describe-load-balancers
describe-listeners
create-listener
list-certificates
list-server-certificates

CloudFormation Documentation
Elastic Load Balancing V2 resource type reference

Terraform Documentation
AWS Provider

Publication date Feb 10, 2019

Audit

Using AWS Console

Using AWS CLI

Remediation / Resolution

Using AWS CloudFormation

Using Terraform (AWS Provider)

Using AWS Console

Using AWS CLI

References

Related ELBv2 rules