AWS elasticloadbalancing medium security documentation change
Summary
Updated documentation for configuring mutual TLS with Application Load Balancer, adding detailed procedures for managing certificate revocation lists (CRLs), replacing CA certificate bundles, and integrating AWS CLI/CloudFormation examples. Removed redundant sections and streamlined instructions.
Security assessment
The changes add documentation for certificate revocation list (CRL) management, which is a critical security control for validating certificate validity. CRL handling helps prevent acceptance of revoked/malicious certificates during mTLS authentication. The addition of revocation list operations directly impacts security posture.
Diff
diff --git a/elasticloadbalancing/latest/application/configuring-mtls-with-elb.md b/elasticloadbalancing/latest/application/configuring-mtls-with-elb.md index 3660a26d4..478f723d9 100644 --- a//elasticloadbalancing/latest/application/configuring-mtls-with-elb.md +++ b//elasticloadbalancing/latest/application/configuring-mtls-with-elb.md @@ -5 +5 @@ -Create a trust storeAssociate a trust storeView trust store detailsModify a trust storeDelete a trust store +Create a trust storeAssociate a trust storeReplace a CA certificate bundleAdd a certificate revocation listDelete a certificate revocation listDelete a trust store @@ -9,3 +9 @@ Create a trust storeAssociate a trust storeView trust store detailsModify a trus -This section includes the procedures for configuring mutual TLS verify mode for authentication on Application Load Balancers. - -To use mutual TLS passthrough mode, you only need to configure the listener to accept any certificates from clients. When you use mutual TLS passthrough, the Application Load Balancer sends the whole client certificate chain to the target using HTTP headers, which enables you to implement corresponding authentication and authorization logic in your application. For more information, see [Create an HTTPS listener for your Application Load Balancer](./create-https-listener.html). +To use mutual TLS passthrough mode, you need only configure the listener to accept any certificates from clients. When you use mutual TLS passthrough, the Application Load Balancer sends the whole client certificate chain to the target using HTTP headers, which enables you to implement corresponding authentication and authorization logic in your application. For more information, see [Create an HTTPS listener for your Application Load Balancer](./create-https-listener.html). @@ -26 +24 @@ To utilize mutual TLS verify mode, perform the following: -Follow the procedures in this section to configure mutual TLS verify mode on your Application Load Balancer in the AWS Management Console. To configure mutual TLS by using API operations instead of the console, see the [Application Load Balancer API Reference Guide](https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/Welcome.html). +Use the following procedures to configure mutual TLS verify mode on your Application Load Balancer. @@ -34 +32,3 @@ Follow the procedures in this section to configure mutual TLS verify mode on you - * View trust store details + * Replace a CA certificate bundle + + * Add a certificate revocation list @@ -36 +36 @@ Follow the procedures in this section to configure mutual TLS verify mode on you - * Modify a trust store + * Delete a certificate revocation list @@ -45,3 +45 @@ Follow the procedures in this section to configure mutual TLS verify mode on you -There are three ways that you can create a trust store: when you create an Application Load Balancer, when you create a secure listener, and by using the Trust Store console. When you add a trust store when you create a load balancer or listener, the trust store is automatically associated with the new listener. When you create a trust store by using the Trust Store console, you must associate it with a listener yourself. - -This section covers creating a trust store using the Trust Store console, but the steps used while creating an Application Load Balancer or listener are the same. For more info, see [Configure a load balancer and a listener ](./create-application-load-balancer.html#configure-load-balancer) and [Create an HTTPS listener](./create-https-listener.html). +If you add a trust store when you create a load balancer or listener, the trust store is automatically associated with the new listener. Otherwise, you must associate it with a listener yourself. @@ -49 +47 @@ This section covers creating a trust store using the Trust Store console, but th -###### Prerequisites: +###### Prerequisites @@ -56 +54,6 @@ This section covers creating a trust store using the Trust Store console, but th -###### To create a trust store using the console +Console + + +The following example creates a trust store using the **Trust Store** portion of the console. Alternatively, you can create the trust store when you create an HTTP listener. + +###### To create a trust store @@ -66 +69 @@ This section covers creating a trust store using the Trust Store console, but th - 1. For **Trust store name** enter a name for your trust store. + 1. For **Trust store name** , enter a name for your trust store. @@ -68 +71 @@ This section covers creating a trust store using the Trust Store console, but th - 2. For **Certificate authority bundle** enter the Amazon S3 path to the ca certificate bundle you want your trust store to use. + 2. For **Certificate authority bundle** , enter the Amazon S3 path to the ca certificate bundle to use. @@ -70 +73 @@ This section covers creating a trust store using the Trust Store console, but th -**Optional:** Use **Object version** to select a previous version of the ca certificate bundle. Otherwise the current version is used. + 3. (Optional) Use **Object version** to select a previous version of the ca certificate bundle. Otherwise, the current version is used. @@ -76 +79 @@ This section covers creating a trust store using the Trust Store console, but th -**Optional:** Use **Object version** to select a previous version of the certificate revocation list. Otherwise the current version is used. + 2. (Optional) Use **Object version** to select a previous version of the certificate revocation list. Otherwise, the current version is used. @@ -78 +81 @@ This section covers creating a trust store using the Trust Store console, but th - 6. (Optional) For **Trust store tags** , you can enter up to 50 tags to apply to your trust store. + 6. (Optional) Expand **Trust store tags** and enter up to 50 tags for your trust store. @@ -84,0 +88,29 @@ This section covers creating a trust store using the Trust Store console, but th +AWS CLI + + +###### To create a trust store + +Use the [create-trust-store](https://docs.aws.amazon.com/cli/latest/reference/elbv2/create-trust-store.html) command. + + + aws elbv2 create-trust-store \ + --name my-trust-store \ + --ca-certificates-bundle-s3-bucket amzn-s3-demo-bucket \ + --ca-certificates-bundle-s3-key certificates/ca-bundle.pem + +CloudFormation + + +###### To create a trust store + +Define a resource of type [AWS::ElasticLoadBalancingV2::TrustStore](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-truststore.html). + + + Resources: + myTrustStore: + Type: 'AWS::ElasticLoadBalancingV2::TrustStore' + Properties: + Name: my-trust-store + CaCertificatesBundleS3Bucket: amzn-s3-demo-bucket + CaCertificatesBundleS3Key: certificates/ca-bundle.pem + @@ -89 +121 @@ After you create a trust store, you must associate it with a listener before you -This section covers associating a trust store to an existing listener. Alternatively, you can associate a trust store while creating an Application Load Balancer or listener. For more info, see [Configure a load balancer and a listener ](./create-application-load-balancer.html#configure-load-balancer) and [Create an HTTPS listener](./create-https-listener.html). +Console @@ -91 +123,4 @@ This section covers associating a trust store to an existing listener. Alternati -###### To associate a trust store using the console + +You can associate a trust store with an existing listener, as shown in the following procedure. Alternatively, you can associate a trust store while creating an HTTPS listener. For more information, see [Create an HTTPS listener](./create-https-listener.html). + +###### To associate a trust store @@ -112 +147 @@ This section covers associating a trust store to an existing listener. Alternati -## View trust store details +AWS CLI @@ -114 +148,0 @@ This section covers associating a trust store to an existing listener. Alternati -### CA certificate bundles @@ -116 +150 @@ This section covers associating a trust store to an existing listener. Alternati -The CA certificate bundle is a required component of the trust store. It's a collection of trusted root and intermediate certificates that have been validated by a certificate authority. These validated certificates ensure the client can trust the certificate being presented is owned by the load balancer. +###### To associate a trust store @@ -118 +152 @@ The CA certificate bundle is a required component of the trust store. It's a col -You can view the contents of the current CA certificate bundle in your trust store at any time. +Use the [modify-listener](https://docs.aws.amazon.com/cli/latest/reference/elbv2/modify-listener.html) command. @@ -120 +153,0 @@ You can view the contents of the current CA certificate bundle in your trust sto -#### View a CA certificate bundle @@ -122 +155,3 @@ You can view the contents of the current CA certificate bundle in your trust sto -###### To view a CA certificate bundle using the console + aws elbv2 modify-listener \ + --listener-arn listener-arn \ + --mutual-authentication "Mode=verify,TrustStoreArn=trust-store-arn" @@ -124 +159 @@ You can view the contents of the current CA certificate bundle in your trust sto - 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). +CloudFormation @@ -126 +160,0 @@ You can view the contents of the current CA certificate bundle in your trust sto - 2. On the navigation pane, choose **Trust Stores**. @@ -128 +162 @@ You can view the contents of the current CA certificate bundle in your trust sto - 3. Select the trust store to view the details page. +###### To associate a trust store @@ -130 +164 @@ You can view the contents of the current CA certificate bundle in your trust sto - 4. Choose **Actions** , then **Get CA bundle**. +Update the [AWS::ElasticLoadBalancingV2::Listener](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-listener.html) resource. @@ -132 +165,0 @@ You can view the contents of the current CA certificate bundle in your trust sto - 5. Choose **Share link** , or **Download**. @@ -133,0 +167,16 @@ You can view the contents of the current CA certificate bundle in your trust sto + Resources: + myHTTPSListener: + Type: 'AWS::ElasticLoadBalancingV2::Listener' + Properties: + LoadBalancerArn: !Ref myLoadBalancer + Protocol: HTTPS + Port: 443 + DefaultActions: + - Type: "forward" + TargetGroupArn: !Ref myTargetGroup + SslPolicy: ELBSecurityPolicy-TLS13-1-2-2021-06 + Certificates: + - CertificateArn: certificate-arn + MutualAuthentication: + - Mode: verify + TrustStoreArn: trust-store-arn @@ -134,0 +184 @@ You can view the contents of the current CA certificate bundle in your trust sto +## Replace a CA certificate bundle @@ -135,0 +186 @@ You can view the contents of the current CA certificate bundle in your trust sto +The CA certificate bundle is a required component of the trust store. It's a collection of trusted root and intermediate certificates that have been validated by a certificate authority. These validated certificates ensure the client can trust the certificate being presented is owned by the load balancer. @@ -137 +188 @@ You can view the contents of the current CA certificate bundle in your trust sto -### Certificate revocation lists +A trust store can only contain one CA certificate bundle at a time, but you can replace the CA certificate bundle at any time after the trust store is created. @@ -139 +190 @@ You can view the contents of the current CA certificate bundle in your trust sto -Optionally, you can create a certificate revocation list for a trust store. Revocation lists are released by certificate authorities and contain data for certificates that have been revoked. Application Load Balancers only support certificate revocation lists in the PEM format. +Console @@ -141 +191,0 @@ Optionally, you can create a certificate revocation list for a trust store. Revo -When a certificate revocation list is added to a trust store, it's given a revocation ID. The revocation IDs increase for every revocation list added to the trust store, and they cannot be changed. If a certificate revocation list is deleted from a trust store, it's revocation ID is also deleted and is not reused for the life of the trust store. @@ -143 +193 @@ When a certificate revocation list is added to a trust store, it's given a revoc -###### Note +###### To replace a CA certificate bundle @@ -145 +195 @@ When a certificate revocation list is added to a trust store, it's given a revoc -Application Load Balancers cannot revoke certificates that have a negative serial number, within a certificate revocation list. + 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). @@ -147 +197 @@ Application Load Balancers cannot revoke certificates that have a negative seria -#### View a certificate revocation list + 2. On the navigation pane, choose **Trust Stores**. @@ -149 +199 @@ Application Load Balancers cannot revoke certificates that have a negative seria -###### To view a revocation list using the console + 3. Select the trust store. @@ -151 +201 @@ Application Load Balancers cannot revoke certificates that have a negative seria - 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). + 4. Choose **Actions** , **Replace CA bundle**. @@ -153 +203 @@ Application Load Balancers cannot revoke certificates that have a negative seria - 2. On the navigation pane, choose **Trust Stores**. + 5. On the **Replace CA bundle** page, under **Certificate authority bundle** , enter the Amazon S3 location of the desired CA bundle. @@ -155 +205 @@ Application Load Balancers cannot revoke certificates that have a negative seria - 3. Select the trust store to view the details page. + 6. (Optional) Use **Object version** to select a previous version of the certificate revocation list. Otherwise, the current version is used. @@ -157 +207 @@ Application Load Balancers cannot revoke certificates that have a negative seria - 4. On the **Certificate revocation lists** tab, select **Actions** , then **Get revocation list**. + 7. Select **Replace CA bundle**. @@ -159 +208,0 @@ Application Load Balancers cannot revoke certificates that have a negative seria - 5. Choose **Share link** , or **Download**. @@ -162,0 +212 @@ Application Load Balancers cannot revoke certificates that have a negative seria +AWS CLI @@ -164 +213,0 @@ Application Load Balancers cannot revoke certificates that have a negative seria -## Modify a trust store @@ -166 +215 @@ Application Load Balancers cannot revoke certificates that have a negative seria -A trust store can only contain one CA certificate bundle at a time, but you can replace the CA certificate bundle at any time after the trust store is created. +###### To replace a CA certificate bundle @@ -168 +217 @@ A trust store can only contain one CA certificate bundle at a time, but you can -### Replace a CA certificate bundle +Use the [modify-trust-store](https://docs.aws.amazon.com/cli/latest/reference/elbv2/modify-trust-store.html) command. @@ -170 +218,0 @@ A trust store can only contain one CA certificate bundle at a time, but you can -###### To replace a CA certificate bundle using the console @@ -172 +220,4 @@ A trust store can only contain one CA certificate bundle at a time, but you can - 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). + aws elbv2 modify-trust-store \ + --trust-store-arn trust-store-arn \ + --ca-certificates-bundle-s3-bucket amzn-s3-demo-bucket-new \ + --ca-certificates-bundle-s3-key certificates/new-ca-bundle-pem @@ -174 +225 @@ A trust store can only contain one CA certificate bundle at a time, but you can - 2. On the navigation pane, choose **Trust Stores**. +CloudFormation