Control: 4 Application load balancers should be configured to drop HTTP headers

Description

This control evaluates AWS Application Load Balancers (ALB) to ensure they are configured to drop invalid HTTP headers. The control fails if the value of routing.http.drop_invalid_header_fields.enabled is set to false.

By default, ALBs are not configured to drop invalid HTTP header values. Removing these header values prevents HTTP desync attacks.

Remediation

To remediate this issue, configure your load balancer to drop invalid header fields.

To configure the load balancer to drop invalid header fields

Open the Amazon EC2 console.
In the navigation pane, choose Load balancers.
Choose an Application Load Balancer.
From Actions, choose Edit attributes.
Under Drop Invalid Header Fields, choose Enable.
Choose Save.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_elb_4

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_elb_4 --share

SQL

This control uses a named query:

elb_application_lb_drop_http_headers

Control: 4 Application load balancers should be configured to drop HTTP headers

Description

Remediation

Usage

SQL

Tags