Question

A financial services company runs a public-facing web application behind an internet-facing Application Load Balancer (ALB) with an HTTPS listener using an ACM certificate. A compliance audit requires that all TLS connections enforce forward secrecy and disallow any TLS versions below 1.2. The security team must ensure that the ALB rejects clients that cannot negotiate a cipher supporting forward secrecy, while minimizing operational overhead. What is the MOST appropriate action?

Accepted Answer

Apply a predefined ELB security policy on the HTTPS listener (for example, ELBSecurityPolicy-FS-1-2-Res-2020-10) that enforces TLS 1.2+ and forward-secrecy ciphers.

Answer

Attach an AWS WAF web ACL to the ALB with a rule that inspects the TLS handshake and blocks weak ciphers.

Answer

Import a stronger ACM certificate that only supports ECDHE cipher suites so weak clients are automatically rejected.

Answer

Place a Network Load Balancer in front of the ALB and terminate TLS on the NLB using a custom OpenSSL cipher configuration.