6WAF

Load balancer uses an outdated TLS security policy

MEDIUM / LOW

What's the problem

An HTTPS (ALB) or TLS (NLB) listener uses a policy that is not on ELB.17's recommended list. MEDIUM when the policy still accepts TLS 1.0/1.1; LOW (6WAF) when it already requires TLS 1.2+ but is not one of the TLS 1.3 / post-quantum policies ELB.17 asks for

How 6WAF detects it

  • Deterministic checks through AWS API calls (IAM, S3, EC2/VPC, CloudTrail, KMS, Secrets Manager, ACM, detection services) — no LLM is used for detection; severity is the value the scanner assigns, shown above.
  • Scanning uses an IAM Role you deploy yourself via CloudFormation; 6WAF stores no credentials and you revoke access any time by deleting the stack.
  • Automated scoring covers only part of the scope of standards such as ISO 27001 — this is a technical assessment, not a certification.

Pillar: Security — Fast Scan

Group: Network (Security Groups, VPC, public endpoints)

Reference standard: AWS Security Hub ELB.17 · 6WAF classification

Get the 39-point AWS waste checklist by email (free, self-serve)

Unticked: we only send the checklist and delete the email after 90 days. Privacy policy

Scan this check (and the other 132) automatically in ~10 minutes

Start free

Related checks

Security Group open to all internet trafficPort 22 (SSH) open to the internetPort 3389 (RDP) open to the internetDatabase or cache port open to the internet