AWS Security Hub · ELB
ELB.21: Health-check probes ride unencrypted HTTP
Written and reviewed by Emnode · Last reviewed
What does AWS Security Hub ELB.21 check?
ELB.21 fails when a target group's health-check protocol is HTTP rather than HTTPS. The control looks specifically at the probe the load balancer uses to test target health, not the data-plane traffic.
Why does ELB.21 matter?
Even when client traffic is fully encrypted, an HTTP health check sends a cleartext probe to every target on a fixed interval, revealing path names and confirming which hosts are live to anyone watching the internal network. Flipping the probe to HTTPS removes that signal. AWS does not validate the target's certificate chain on the probe, so a self-signed cert is enough: there is no cert-management cost to switching.
How do I fix ELB.21?
- List target groups and check HealthCheckProtocol with describe-target-groups.
- Confirm the target is actually serving TLS on the health-check port before changing anything.
- Set HealthCheckProtocol to HTTPS with modify-target-group; targets do not flap if TLS is already terminating.
- Add a Config rule or SCP to keep new target groups on HTTPS health checks.
Remediation script · bash
# 1. Bulk-enable free SSE-SQS on every unencrypted queue in the region.
for q in $(aws sqs list-queues --query 'QueueUrls[]' --output text); do
state=$(aws sqs get-queue-attributes --queue-url $q \
--attribute-names KmsMasterKeyId SqsManagedSseEnabled --query 'Attributes' --output text)
[ -z "$state" ] && aws sqs set-queue-attributes --queue-url $q \
--attributes '{"SqsManagedSseEnabled":"true"}' && echo "encrypted $q"
done
# 2. High-throughput stream: SSE-KMS with a 5-minute data-key reuse window to keep KMS cost flat.
aws kinesis start-stream-encryption --stream-name payment-events \
--encryption-type KMS \
--key-id arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
# 3. Find unencrypted recovery points (Backup.1 reads IsEncrypted per recovery point, not per vault).
aws backup list-recovery-points-by-backup-vault --backup-vault-name prod-backups \
--query 'RecoveryPoints[?IsEncrypted==`false`].[RecoveryPointArn,ResourceType]' --output table
# 4. Confirm an at-rest Config rule is evaluating so regressions are caught automatically.
aws configservice describe-compliance-by-config-rule --config-rule-names sqs-queue-encrypted \
--query 'ComplianceByConfigRules[].Compliance.ComplianceType'Full walkthrough (console steps, edge cases and verification) in the lesson Encrypt other services at rest (queues, streams, logs, ML).
Is ELB.21 a false positive?
ELB.21 fails any non-Lambda target group whose health-check protocol isn't HTTPS, but a plain TCP health check is sometimes the only correct probe, for example a Network Load Balancer fronting a service that terminates TLS on the target with a protocol the ALB/NLB health checker can't speak, or a target that exposes a dedicated TCP liveness port carrying no sensitive path or payload. In those cases an HTTPS probe would either fail to handshake or add nothing, so forcing it would break health checking, not improve security. If a TCP (or otherwise non-HTTPS) health check is the deliberate design, suppress the finding with a note explaining what the probe reaches and why no cleartext application data is exposed, rather than switching the protocol.
More ELB controls
- ELB.1 ALB serves HTTP without redirecting to HTTPS
- ELB.2 CLB SSL/HTTPS listeners should use ACM certs
- ELB.3 CLB listeners should use HTTPS/TLS termination
- ELB.4 ALB accepts malformed HTTP headers
- ELB.5 Load balancers are not writing access logs
- ELB.6 Load balancers can be deleted by accident
- ELB.7 CLBs should have connection draining
- ELB.8 CLB SSL listeners should use strong policy
- ELB.9 CLBs should have cross-zone balancing
- ELB.10 CLBs should span multiple AZs
- ELB.12 ALB desync mitigation mode
- ELB.13 A single-AZ load balancer is a data-plane single point of failure