Ensure that ELB v2 drops invalid headers

Risk Level: Low
Cloud Entity: AWS ElasticLoadBalancingV2 LoadBalancer
CloudGuard Rule ID: D9.CFT.NET.15
Covered by Spectral: Yes
Category: Compute

GSL LOGIC

AWS_ElasticLoadBalancingV2_LoadBalancer should have LoadBalancerAttributes contain [ Key='routing.http.drop_invalid_header_fields.enabled' and Value='true' ]

REMEDIATION

From CFT
Set AWS::ElasticLoadBalancingV2::LoadBalancer LoadBalancerAttribute property to Key=routing.http.drop_invalid_header_fields.enabled and Value=true

References

1. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-elasticloadbalancingv2-loadbalancer-loadbalancerattributes.html
2. https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html#load-balancer-attributes

AWS ElasticLoadBalancingV2 LoadBalancer

Elastic Load Balancing automatically distributes your incoming traffic across multiple targets, such as EC2 instances, containers, and IP addresses, in one or more Availability Zones. It monitors the health of its registered targets, and routes traffic only to the healthy targets. Elastic Load Balancing scales your load balancer as your incoming traffic changes over time. It can automatically scale to the vast majority of workloads. AWS::ElasticLoadBalancingV2::LoadBalancer Specifies an Application Load Balancer, a Network Load Balancer, or a Gateway Load Balancer.

Compliance Frameworks

• AWS CloudFormation ruleset