AWS elasticloadbalancing high security documentation change

Service: elasticloadbalancing · 2025-08-16 · Security-related high

File: elasticloadbalancing/latest/application/create-https-listener.md

Summary

Expanded HTTPS listener creation documentation with security policy requirements, certificate configuration details, and added AWS CLI/CloudFormation examples enforcing TLS 1.2+

Security assessment

Explicitly mandates specifying security policies (e.g., ELBSecurityPolicy-TLS13-1-2-2021-06) and certificates for secure listeners. The TLS 1.2+ policy requirement addresses cryptographic vulnerabilities in older protocols.

Diff

diff --git a/elasticloadbalancing/latest/application/create-https-listener.md b/elasticloadbalancing/latest/application/create-https-listener.md
index be65778c0..85d663aee 100644
--- a//elasticloadbalancing/latest/application/create-https-listener.md
+++ b//elasticloadbalancing/latest/application/create-https-listener.md
@@ -30 +30 @@ The information on this page helps you create an HTTPS listener for your load ba
-You configure a listener with a protocol and a port for connections from clients to the load balancer, and a target group for the default listener rule. For more information, see [Listener configuration](./load-balancer-listeners.html#listener-configuration).
+You configure a listener with a protocol and a port for connections from clients to the load balancer. For more information, see [Listener configuration](./load-balancer-listeners.html#listener-configuration).
@@ -32 +32,8 @@ You configure a listener with a protocol and a port for connections from clients
-###### To add an HTTPS listener using the console
+When you create a secure listener, you must specify a security policy and a certificate. To add certificates to the certificate list, see [Add certificates to the certificate list](./listener-update-certificates.html#add-certificates).
+
+You must configure a default rule for the listener. You can add other listener rules after you create the listener. For more information, see [Listener rules](./listener-rules.html).
+
+Console
+    
+
+###### To add an HTTPS listener
@@ -42 +49 @@ You configure a listener with a protocol and a port for connections from clients
-  5. For **Protocol : Port** , choose **HTTPS** and keep the default port or enter a different port.
+  5. For **Protocol** , choose **HTTPS**. Keep the default port or enter a different port.
@@ -49,0 +57,2 @@ You configure a listener with a protocol and a port for connections from clients
+If you don't have a target group that meets your needs, choose **Create target group** to create one now. For more information, see [Create a target group](./create-target-group.html).
+
@@ -74 +83,20 @@ The default mode is **passthrough**. If you select **Verify with trust store** :
-  12. Choose **Add**.
+  12. Choose **Add listener**.
+
+
+
+
+AWS CLI
+    
+
+###### To create an HTTPS listener
+
+Use the [create-listener](https://docs.aws.amazon.com/cli/latest/reference/elbv2/create-listener.html) command. The following example creates an HTTPS listener with a default rule that forwards traffic to the specified target group.
+    
+    
+    aws elbv2 create-listener \
+        --load-balancer-arn load-balancer-arn \
+        --protocol HTTPS \
+        --port 443 \
+        --default-actions Type=forward,TargetGroupArn=target-group-arn \
+        --ssl-policy ELBSecurityPolicy-TLS13-1-2-2021-06 \
+        --certificates certificate-arn
@@ -76 +104 @@ The default mode is **passthrough**. If you select **Verify with trust store** :
-  13. To add certificates to the optional certificate list, see [Add certificates to the certificate list](./listener-update-certificates.html#add-certificates).
+CloudFormation
@@ -78,0 +107 @@ The default mode is **passthrough**. If you select **Verify with trust store** :
+###### To create an HTTPS listener
@@ -79,0 +109 @@ The default mode is **passthrough**. If you select **Verify with trust store** :
+Define a resource of type [AWS::ElasticLoadBalancingV2::Listener](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-listener.html). The following example creates an HTTPS listener with a default rule that forwards traffic to the specified target group.
@@ -81 +110,0 @@ The default mode is **passthrough**. If you select **Verify with trust store** :
-###### To add an HTTPS listener using the AWS CLI
@@ -83 +112,13 @@ The default mode is **passthrough**. If you select **Verify with trust store** :
-Use the [create-listener](https://docs.aws.amazon.com/cli/latest/reference/elbv2/create-listener.html) command to create the listener and default rule, and the [create-rule](https://docs.aws.amazon.com/cli/latest/reference/elbv2/create-rule.html) command to define additional listener rules.
+    Resources:
+      myHTTPSListener:
+        Type: 'AWS::ElasticLoadBalancingV2::Listener'
+        Properties: 
+          LoadBalancerArn: !Ref myLoadBalancer
+          Protocol: HTTPS
+          Port: 443
+          DefaultActions:
+            - Type: "forward"
+              TargetGroupArn: !Ref myTargetGroup
+          SslPolicy: ELBSecurityPolicy-TLS13-1-2-2021-06
+          Certificates: 
+            - CertificateArn: certificate-arn