Skip to content

Instantly share code, notes, and snippets.

@adler
Last active August 29, 2015 14:07
Show Gist options
  • Save adler/55512f7c8ffaccb7bd5d to your computer and use it in GitHub Desktop.
Save adler/55512f7c8ffaccb7bd5d to your computer and use it in GitHub Desktop.
CloudFormation to disable SSLv3 based on ELBSecurityPolicy-2014-01
"appName" : {
"Type" : "AWS::ElasticLoadBalancing::LoadBalancer",
"Properties" : {
"Subnets" : [{ "Ref" : "SubnetA" }, { "Ref" : "SubnetB" }, { "Ref" : "SubnetC" }],
"SecurityGroups" : [ { "Ref" : "lbSG" } ],
"CrossZone" : true,
"Policies": [ {
"PolicyName" : "TLSOnlyPolicy",
"PolicyType" : "SSLNegotiationPolicyType",
"Attributes" : [
{ "Name" : "Protocol-SSLv3", "Value" : "false" },
{ "Name" : "Protocol-TLSv1", "Value" : "true" },
{ "Name" : "Protocol-TLSv1.1", "Value" : "true" },
{ "Name" : "Protocol-TLSv1.2", "Value" : "true" },
{ "Name" : "Server-Defined-Cipher-Order", "Value" : "true" },
{ "Name" : "DHE-RSA-AES256-SHA", "Value" : "true" },
{ "Name" : "ECDHE-ECDSA-AES128-GCM-SHA256", "Value" : "true" },
{ "Name" : "ECDHE-RSA-AES128-GCM-SHA256", "Value" : "true" },
{ "Name" : "ECDHE-ECDSA-AES128-SHA256", "Value" : "true" },
{ "Name" : "ECDHE-RSA-AES128-SHA256", "Value" : "true" },
{ "Name" : "ECDHE-ECDSA-AES128-SHA", "Value" : "true" },
{ "Name" : "ECDHE-RSA-AES128-SHA", "Value" : "true" },
{ "Name" : "ECDHE-ECDSA-AES256-GCM-SHA384", "Value" : "true" },
{ "Name" : "ECDHE-RSA-AES256-GCM-SHA384", "Value" : "true" },
{ "Name" : "ECDHE-ECDSA-AES256-SHA384", "Value" : "true" },
{ "Name" : "ECDHE-RSA-AES256-SHA384", "Value" : "true" },
{ "Name" : "ECDHE-RSA-AES256-SHA", "Value" : "true" },
{ "Name" : "ECDHE-ECDSA-AES256-SHA", "Value" : "true" },
{ "Name" : "AES128-GCM-SHA256", "Value" : "true" },
{ "Name" : "AES128-SHA256", "Value" : "true" },
{ "Name" : "AES128-SHA", "Value" : "true" },
{ "Name" : "AES256-GCM-SHA384", "Value" : "true" },
{ "Name" : "AES256-SHA256", "Value" : "true" },
{ "Name" : "AES256-SHA", "Value" : "true" },
{ "Name" : "DHE-RSA-AES128-SHA", "Value" : "true" },
{ "Name" : "DHE-DSS-AES128-SHA", "Value" : "true" },
{ "Name" : "ECDHE-RSA-RC4-SHA", "Value" : "true" },
{ "Name" : "RC4-SHA", "Value" : "true" }
]
} ],
"Listeners" : [ {
"LoadBalancerPort" : "443",
"InstancePort" : "443",
"Protocol" : "HTTPS",
"PolicyNames" : ["TLSOnlyPolicy"],
"SSLCertificateId" : { "Ref" : "SslCertId" }
}
}
},
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment