# Every place a client session terminates, with the protocol and negotiated policy it terminates under: listener protocol and SslPolicy on each load balancer, HTTP listeners that redirect rather than serve, an ACM certificate behind each one, and CloudFront viewer policies that refuse plain HTTP

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/session-authenticity-tls-termination

Recipe id: `session-authenticity-tls-termination` · cadence quarterly · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-SVC-SIN`
- KSI `KSI-SVC-VCM`
- control `sc-23`

## Collection

Kind: `cli`

```sh
# describe-load-balancers
aws elbv2 describe-load-balancers --query 'LoadBalancers[].{LB:LoadBalancerName,Arn:LoadBalancerArn,Type:Type,Scheme:Scheme}'
# describe-listeners
aws elbv2 describe-listeners --load-balancer-arn <LOAD_BALANCER_ARN> --query 'Listeners[].{Port:Port,Protocol:Protocol,SslPolicy:SslPolicy,Certificates:Certificates[].CertificateArn,Action:DefaultActions[0].Type,Redirect:DefaultActions[0].RedirectConfig}'
# describe-ssl-policies
aws elbv2 describe-ssl-policies --query "SslPolicies[?contains(Name,'FIPS')].Name"
# alb-http-to-https-redirection-check
aws configservice get-compliance-details-by-config-rule --config-rule-name alb-http-to-https-redirection-check --compliance-types NON_COMPLIANT
# cloudfront-viewer-policy-https
aws configservice get-compliance-details-by-config-rule --config-rule-name cloudfront-viewer-policy-https --compliance-types NON_COMPLIANT
```

## Expected output

From describe-listeners, one row per listener: Protocol from HTTP, HTTPS, TCP, TLS, UDP, TCP_UDP, GENEVE, QUIC or TCP_QUIC; SslPolicy present only on HTTPS and TLS listeners and naming a policy such as ELBSecurityPolicy-TLS13-1-2-2021-06 (TLS 1.3 and 1.2 only) or ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04; Certificates carrying the default certificate ARN; and for a plain HTTP listener a DefaultActions entry of Type redirect whose RedirectConfig names Protocol HTTPS with StatusCode HTTP_301. Note the CLI default: a listener created by CLI, CloudFormation or CDK without an explicit policy gets ELBSecurityPolicy-2016-08, which still negotiates TLS 1.0. From the two Config rules, empty NON_COMPLIANT sets mean no Application Load Balancer serves an HTTP listener without redirection and no CloudFront distribution leaves ViewerProtocolPolicy at allow-all. Run the CloudFront call in US East (N. Virginia): CLOUDFRONT_VIEWER_POLICY_HTTPS evaluates only there, matching CloudFront's global scope, so the same command in any other Region returns nothing at all — a silence that reads exactly like a pass and is not one.

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

Elastic Load Balancing, the security policies including the FIPS families, and AWS Certificate Manager are available in GovCloud (US); load-balancer and certificate ARNs use partition arn:aws-us-gov. ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK is available in all supported Regions. Two rules in this family are not usable there: CLOUDFRONT_VIEWER_POLICY_HTTPS evaluates only in US East (N. Virginia), matching CloudFront's global scope and leaving GovCloud with no CloudFront distributions to evaluate, and ELBV2_ACM_CERTIFICATE_REQUIRED is excluded from both GovCloud (US) Regions — so in GovCloud the certificate check comes from the Certificates field of describe-listeners directly, not from Config.

## Notes

SC-23 says protect the authenticity of communications sessions, and authenticity has a floor and a ceiling. The floor is transport: a session that can be read or injected into on the wire is not authentic in any sense, and the floor is entirely in this output — which listeners terminate TLS, under which negotiated policy, with which certificate, and whether the HTTP door redirects instead of answering. The ceiling is session identity above the transport: regenerating a session identifier on privilege change, invalidating it at logout, binding it to the principal it was issued to, refusing one that was replayed. That lives in application code and emits no AWS telemetry, which is what keeps this partial. Say which half you are evidencing, or a reader will assume the larger one.

Read SslPolicy as a version floor, not a checkmark. The policy name encodes the oldest protocol it will negotiate: ELBSecurityPolicy-TLS13-1-2-2021-06 admits TLS 1.3 and 1.2 only, while ELBSecurityPolicy-TLS13-1-0-2021-06 and the 2016-08 default still admit TLS 1.0. The FIPS families — listed by the describe-ssl-policies query above — use the AWS-LC FIPS validated module, and AWS marks ELBSecurityPolicy-TLS13-1-1-FIPS-2023-04 and ELBSecurityPolicy-TLS13-1-0-FIPS-2023-04 as legacy compatibility only, FIPS cryptography that, in AWS's own words, may not conform to the latest NIST guidance for TLS configuration. FIPS in the name is therefore not by itself the answer to a FIPS question.

The redirection rule is narrower than it sounds: ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK is NON_COMPLIANT both when an HTTP listener has no redirect and when it forwards to another HTTP listener instead of redirecting — but it covers Application Load Balancers only. Network Load Balancer TLS listeners, API Gateway, and anything terminating TLS on an instance are outside it and have to be enumerated by hand.

## References

- {"title":"AWS CLI: elbv2 describe-listeners (Protocol, SslPolicy, Certificates, DefaultActions with RedirectConfig Protocol/Port/StatusCode)","url":"https://docs.aws.amazon.com/cli/latest/reference/elbv2/describe-listeners.html"}
- {"title":"Security policies for your Application Load Balancer — protocols by policy, the FIPS families on the AWS-LC validated module, the legacy-only TLS13-1-1/1-0 FIPS policies, and the ELBSecurityPolicy-2016-08 CLI default","url":"https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html"}
- {"title":"AWS Config managed rule: alb-http-to-https-redirection-check (ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK; also NON_COMPLIANT when an HTTP listener forwards to an HTTP listener)","url":"https://docs.aws.amazon.com/config/latest/developerguide/alb-http-to-https-redirection-check.html"}
- {"title":"AWS Config managed rule: cloudfront-viewer-policy-https (CLOUDFRONT_VIEWER_POLICY_HTTPS; NON_COMPLIANT when ViewerProtocolPolicy is allow-all; evaluates only in US East (N. Virginia))","url":"https://docs.aws.amazon.com/config/latest/developerguide/cloudfront-viewer-policy-https.html"}
- {"title":"AWS Config managed rule: elbv2-acm-certificate-required (ELBV2_ACM_CERTIFICATE_REQUIRED) — excluded from both AWS GovCloud (US) Regions","url":"https://docs.aws.amazon.com/config/latest/developerguide/elbv2-acm-certificate-required.html"}