OpenParable
Skip to content
← Back to skills

Cis AWS Compute 10.4

DevOps & Security
cis-aws-compute-10.4

Cis AWS Compute 10.4 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure that HTTPS is enabled on load balancer

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-10.4/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-aws-compute-10-4, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

10.4 Ensure that HTTPS is enabled on load balancer (Manual)

Description

The simplest way to use HTTPS with an Elastic Beanstalk environment is to assign a server certificate to your environment's load balancer.

Rationale

When you configure your load balancer to terminate HTTPS, the connection between the client and the load balancer is secure.

Impact

N/A

Audit Procedure

Using AWS Console

  1. Login to AWS Console using https://console.aws.amazon.com/elasticbeanstalk
  2. On the left hand side click Environments
  3. Click on the Environment name that you want to review
  4. Under the "environment_name-env" click Configuration
  5. Scroll down under Configurations
  6. Under category look for Load balancer
  7. Click Edit
  8. Under the Listeners section
  9. Check the Listeners section for any enabled listeners and make sure the Protocol is set to HTTPS and Enabled.
  10. If the Listener is required for HTTP and is not set to HTTPS refer to the remediation below.
  11. Repeat steps 3-10 for each environment within the current region.
  12. Then repeat the Audit process for all other regions.

Using AWS CLI

N/A - This control is manual and console-based.

Expected Result

All enabled Listeners under the Load balancer configuration have their Protocol set to HTTPS and are Enabled.

Remediation

Using AWS Console

  1. Login to AWS Console using https://console.aws.amazon.com/elasticbeanstalk
  2. On the left hand side click Environments
  3. Click on the Environment name that you want to review
  4. Under the "environment_name-env" click Configuration
  5. Scroll down under Configurations
  6. Under category look for Load balancer
  7. Click Edit
  8. Under the Listeners section
  9. Click Add listener
Set listener port
Set Listener protocol to HTTPS
Set Instance Port
Sent Instance protocol to HTTPS
Select your SSL certificate
  1. Click Add
  2. Make sure it is listed as enabled. If you have other listeners not using HTTPS make sure to turn off enabled
  3. Click Apply to save the configuration changes.
  4. Repeat steps 3-12 for each environment within the current region.
  5. Then repeat the remediation for all other regions.

Using AWS CLI

N/A - This control is manual and console-based.

Default Value

HTTPS is not configured on Elastic Beanstalk load balancers by default.

References

  1. https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https.html

CIS Controls

Controls VersionControlIG 1IG 2IG 3
v83.10 Encrypt Sensitive Data in TransitXX
v714.4 Encrypt All Sensitive Information in TransitXX

Profile

Level 1 | Manual