Every place a client session terminates, with the protocol and negotiated policy it terminates under: listener protocol and SslPolicy on each load balancer, HTTP listeners that redirect rather than serve, an ACM certificate behind each one, and CloudFront viewer policies that refuse plain HTTP
The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.
Fetch
$ aws elbv2 describe-load-balancers --query 'LoadBalancers[].{LB:LoadBalancerName,Arn:LoadBalancerArn,Type:Type,Scheme:Scheme}'$ aws elbv2 describe-listeners --load-balancer-arn <LOAD_BALANCER_ARN> --query 'Listeners[].{Port:Port,Protocol:Protocol,SslPolicy:SslPolicy,Certificates:Certificates[].CertificateArn,Action:DefaultActions[0].Type,Redirect:DefaultActions[0].RedirectConfig}'$ aws elbv2 describe-ssl-policies --query "SslPolicies[?contains(Name,'FIPS')].Name"$ aws configservice get-compliance-details-by-config-rule --config-rule-name alb-http-to-https-redirection-check --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name cloudfront-viewer-policy-https --compliance-types NON_COMPLIANTExpected output
From describe-listeners, one row per listener: Protocol from HTTP, HTTPS, TCP, TLS, UDP, TCP_UDP, GENEVE, QUIC or TCP_QUIC; SslPolicy present only on HTTPS and TLS listeners and naming a policy such as ELBSecurityPolicy-TLS13-1-2-2021-06 (TLS 1.3 and 1.2 only) or ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04; Certificates carrying the default certificate ARN; and for a plain HTTP listener a DefaultActions entry of Type redirect whose RedirectConfig names Protocol HTTPS with StatusCode HTTP_301. Note the CLI default: a listener created by CLI, CloudFormation or CDK without an explicit policy gets ELBSecurityPolicy-2016-08, which still negotiates TLS 1.0. From the two Config rules, empty NON_COMPLIANT sets mean no Application Load Balancer serves an HTTP listener without redirection and no CloudFront distribution leaves ViewerProtocolPolicy at allow-all. Run the CloudFront call in US East (N. Virginia): CLOUDFRONT_VIEWER_POLICY_HTTPS evaluates only there, matching CloudFront's global scope, so the same command in any other Region returns nothing at all — a silence that reads exactly like a pass and is not one.
Map — what it proves
- recipe1
- recipe— an authored recipe collects evidence for this control
- KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
- orphan— no Key Security Indicator reaches it — a person writes it up instead
What else these families can fetch:SC 13/35 →
GovCloud
Elastic Load Balancing, the security policies including the FIPS families, and AWS Certificate Manager are available in GovCloud (US); load-balancer and certificate ARNs use partition arn:aws-us-gov. ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK is available in all supported Regions. Two rules in this family are not usable there: CLOUDFRONT_VIEWER_POLICY_HTTPS evaluates only in US East (N. Virginia), matching CloudFront's global scope and leaving GovCloud with no CloudFront distributions to evaluate, and ELBV2_ACM_CERTIFICATE_REQUIRED is excluded from both GovCloud (US) Regions — so in GovCloud the certificate check comes from the Certificates field of describe-listeners directly, not from Config.
Notes & assertions
SC-23 says protect the authenticity of communications sessions, and authenticity has a floor and a ceiling. The floor is transport: a session that can be read or injected into on the wire is not authentic in any sense, and the floor is entirely in this output — which listeners terminate TLS, under which negotiated policy, with which certificate, and whether the HTTP door redirects instead of answering. The ceiling is session identity above the transport: regenerating a session identifier on privilege change, invalidating it at logout, binding it to the principal it was issued to, refusing one that was replayed. That lives in application code and emits no AWS telemetry, which is what keeps this partial. Say which half you are evidencing, or a reader will assume the larger one. Read SslPolicy as a version floor, not a checkmark. The policy name encodes the oldest protocol it will negotiate: ELBSecurityPolicy-TLS13-1-2-2021-06 admits TLS 1.3 and 1.2 only, while ELBSecurityPolicy-TLS13-1-0-2021-06 and the 2016-08 default still admit TLS 1.0. The FIPS families — listed by the describe-ssl-policies query above — use the AWS-LC FIPS validated module, and AWS marks ELBSecurityPolicy-TLS13-1-1-FIPS-2023-04 and ELBSecurityPolicy-TLS13-1-0-FIPS-2023-04 as legacy compatibility only, FIPS cryptography that, in AWS's own words, may not conform to the latest NIST guidance for TLS configuration. FIPS in the name is therefore not by itself the answer to a FIPS question. The redirection rule is narrower than it sounds: ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK is NON_COMPLIANT both when an HTTP listener has no redirect and when it forwards to another HTTP listener instead of redirecting — but it covers Application Load Balancers only. Network Load Balancer TLS listeners, API Gateway, and anything terminating TLS on an instance are outside it and have to be enumerated by hand.
References
- AWS CLI: elbv2 describe-listeners (Protocol, SslPolicy, Certificates, DefaultActions with RedirectConfig Protocol/Port/StatusCode) https://docs.aws.amazon.com/cli/latest/reference/elbv2/describe-listeners.html
- Security policies for your Application Load Balancer — protocols by policy, the FIPS families on the AWS-LC validated module, the legacy-only TLS13-1-1/1-0 FIPS policies, and the ELBSecurityPolicy-2016-08 CLI default https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html
- AWS Config managed rule: alb-http-to-https-redirection-check (ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK; also NON_COMPLIANT when an HTTP listener forwards to an HTTP listener) https://docs.aws.amazon.com/config/latest/developerguide/alb-http-to-https-redirection-check.html
- AWS Config managed rule: cloudfront-viewer-policy-https (CLOUDFRONT_VIEWER_POLICY_HTTPS; NON_COMPLIANT when ViewerProtocolPolicy is allow-all; evaluates only in US East (N. Virginia)) https://docs.aws.amazon.com/config/latest/developerguide/cloudfront-viewer-policy-https.html
- AWS Config managed rule: elbv2-acm-certificate-required (ELBV2_ACM_CERTIFICATE_REQUIRED) — excluded from both AWS GovCloud (US) Regions https://docs.aws.amazon.com/config/latest/developerguide/elbv2-acm-certificate-required.html
This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.
The Service Configuration run (10)
- automatable
- partial — needs judgement
- narrative — no API proves this
Every authored recipe filed under SVC, in the order the plan works them. The mark says how much of the evidence the command produces on its own.
- partialAWS Config compliance results across the storage services proving customer data is encrypted at rest — S3 buckets with default server-side encryption, EBS volumes encrypted, and RDS storage encrypted, all backed by KMScontinuousconfig-encryption-at-restAWS Config · Amazon S3 · Amazon EBS · Amazon RDS · AWS KMS
- partialAWS Config compliance results proving data in transit is protected by TLS — S3 bucket policies denying non-TLS requests, load-balancer listeners restricted to SSL/HTTPS, and Redshift clusters requiring SSLcontinuousconfig-encryption-in-transitAWS Config · Amazon S3 · Elastic Load Balancing · Amazon Redshift
- partialAWS Config compliance results proving KMS customer-managed keys are lifecycle-managed — automatic annual rotation enabled and no active key scheduled for deletion — the key-hygiene half of the cryptographic-protection controlcontinuousconfig-kms-key-managementAWS Config · AWS KMS
- partialAWS Config compliance results plus the State Manager association list proving a defined configuration is actually applied and re-applied to every managed node — instances are under SSM management, and the associations that carry your baseline report COMPLIANT on a schedule rather than driftingcontinuousssm-configuration-baseline-enforcedAWS Config · AWS Systems Manager
- partialCryptographic proof that the audit trail CloudTrail delivered has not been altered or deleted, plus the compliance state of the write-once controls that make stored records and container images tamper-evidentweeklyintegrity-verification-and-immutabilityAWS CloudTrail · AWS Config · Amazon S3 · AWS Backup · Amazon ECR
- partialDNSSEC signing status of every public hosted zone, with the key-signing key state and the DS record that carries the chain of trust to the parentweeklyroute53-dnssec-signingAmazon Route 53 · AWS KMS
- partialPer-VPC DNSSEC validation status of the Route 53 Resolver, joined against the full VPC inventory so that a VPC which never enabled validation is visible rather than absentweeklyroute53-resolver-dnssec-validationAmazon Route 53 · Amazon VPC
- partialEvery place a client session terminates, with the protocol and negotiated policy it terminates under: listener protocol and SslPolicy on each load balancer, HTTP listeners that redirect rather than serve, an ACM certificate behind each one, and CloudFront viewer policies that refuse plain HTTPyou are herequarterlysession-authenticity-tls-terminationElastic Load Balancing · Amazon CloudFront · AWS Certificate Manager · AWS Config
- partialThe hosted zones that serve name resolution, each marked private or public so internal and external resolution can be shown to be served by separate zones, and the Resolver endpoints that carry queries across the VPC boundary with their direction and operational statuscontinuousname-resolution-role-separationAmazon Route 53 · Amazon Route 53 Resolver
- partialWhether secret scanning, push protection and validity checking are switched on in this organization and which repositories those settings actually reach, together with the alerts themselves — each carrying the kind of credential found, whether the credential was confirmed to still work, how it was closed and by whom, and whether a push containing it was blocked or waved through. The settings are the population; the alerts are what was found in it, and an alert list read without the settings beside it cannot be told apart from a list produced by scanning nothing.continuoussecret-exposure-detection-and-push-protectionGitHub secret scanning · GitHub code security configurations