{
    "name": "elbWeakCipher",
    "file": "elbWeakCipher.rego",
    "policy_type": "aws",
    "resource_type": "aws_load_balancer_policy",
    "template_args": {
        "prefix": "",
        "weak_ciphers": [
            "DHE-DSS-AES128-SHA",
            "CAMELLIA128-SHA",
            "EDH-RSA-DES-CBC3-SHA",
            "DES-CBC3-SHA",
            "ECDHE-RSA-RC4-SHA",
            "RC4-SHA",
            "ECDHE-ECDSA-RC4-SHA",
            "DHE-DSS-AES256-GCM-SHA384",
            "DHE-RSA-AES256-GCM-SHA384",
            "DHE-RSA-AES256-SHA256",
            "DHE-DSS-AES256-SHA256",
            "DHE-RSA-AES256-SHA",
            "DHE-DSS-AES256-SHA",
            "DHE-RSA-CAMELLIA256-SHA",
            "DHE-DSS-CAMELLIA256-SHA",
            "CAMELLIA256-SHA",
            "EDH-DSS-DES-CBC3-SHA",
            "DHE-DSS-AES128-GCM-SHA256",
            "DHE-RSA-AES128-GCM-SHA256",
            "DHE-RSA-AES128-SHA256",
            "DHE-DSS-AES128-SHA256",
            "DHE-RSA-CAMELLIA128-SHA",
            "DHE-DSS-CAMELLIA128-SHA",
            "ADH-AES128-GCM-SHA256",
            "ADH-AES128-SHA",
            "ADH-AES128-SHA256",
            "ADH-AES256-GCM-SHA384",
            "ADH-AES256-SHA",
            "ADH-AES256-SHA256",
            "ADH-CAMELLIA128-SHA",
            "ADH-CAMELLIA256-SHA",
            "ADH-DES-CBC3-SHA",
            "ADH-DES-CBC-SHA",
            "ADH-RC4-MD5",
            "ADH-SEED-SHA",
            "DES-CBC-SHA",
            "DHE-DSS-SEED-SHA",
            "DHE-RSA-SEED-SHA",
            "EDH-DSS-DES-CBC-SHA",
            "EDH-RSA-DES-CBC-SHA",
            "IDEA-CBC-SHA",
            "RC4-MD5",
            "SEED-SHA",
            "DES-CBC3-MD5",
            "DES-CBC-MD5",
            "RC2-CBC-MD5",
            "PSK-AES256-CBC-SHA",
            "PSK-3DES-EDE-CBC-SHA",
            "KRB5-DES-CBC3-SHA",
            "KRB5-DES-CBC3-MD5",
            "PSK-AES128-CBC-SHA",
            "PSK-RC4-SHA",
            "KRB5-RC4-SHA",
            "KRB5-RC4-MD5",
            "KRB5-DES-CBC-SHA",
            "KRB5-DES-CBC-MD5",
            "EXP-EDH-RSA-DES-CBC-SHA",
            "EXP-EDH-DSS-DES-CBC-SHA",
            "EXP-ADH-DES-CBC-SHA",
            "EXP-DES-CBC-SHA",
            "EXP-RC2-CBC-MD5",
            "EXP-KRB5-RC2-CBC-SHA",
            "EXP-KRB5-DES-CBC-SHA",
            "EXP-KRB5-RC2-CBC-MD5",
            "EXP-KRB5-DES-CBC-MD5",
            "EXP-ADH-RC4-MD5",
            "EXP-RC4-MD5",
            "EXP-KRB5-RC4-SHA",
            "EXP-KRB5-RC4-MD5"
        ]
    },
    "severity": "HIGH",
    "description": "Remove insecure ciphers for your ELB Predefined or Custom Security Policy, to reduce the risk of the SSL connection between the client and the load balancer being exploited.",
    "reference_id": "AWS.ELB.EncryptionandKeyManagement.High.0403",
    "category": "Infrastructure Security",
    "version": 2,
    "id": "AC_AWS_0171"
}