SSL/TLS termination in AWS - Mini Project: Build & Apply

SSL/TLS Termination with AWS Elastic Load Balancer

📖 Scenario: You are setting up a secure web application on AWS. To protect your users' data, you want to use SSL/TLS encryption. Instead of configuring SSL on each server, you will use AWS Elastic Load Balancer (ELB) to handle SSL/TLS termination. This means the ELB will decrypt incoming encrypted traffic and forward it as plain HTTP to your servers.

🎯 Goal: Build an AWS Elastic Load Balancer configuration that terminates SSL/TLS connections using a specified SSL certificate and forwards traffic to backend instances over HTTP.

📋 What You'll Learn

Create a load balancer resource with HTTPS listener on port 443

Use a given SSL certificate ARN for SSL termination

Forward traffic from the load balancer to backend instances on port 80

Configure a target group for backend instances

Ensure the load balancer uses the correct security policy for SSL

💡 Why This Matters

🌍 Real World

SSL/TLS termination at the load balancer is a common practice to simplify certificate management and reduce CPU load on backend servers.

💼 Career

Cloud engineers and DevOps professionals often configure load balancers for secure web applications using SSL/TLS termination.

1

Create a target group for backend instances

Create an AWS target group named web-target-group that listens on port 80 using the HTTP protocol.

AWS

# Your code here to create the target group

Hint

Use aws_lb_target_group resource with name, port, and protocol set as specified.

2

Define the SSL certificate ARN variable

Create a variable named ssl_certificate_arn to hold the ARN string of your SSL certificate.

AWS

resource "aws_lb_target_group" "web_target_group" {
  name     = "web-target-group"
  port     = 80
  protocol = "HTTP"
  vpc_id   = "vpc-12345678"
}

# Your code here to define ssl_certificate_arn variable

Hint

Use variable block with type = string and a description.

3

Create an Application Load Balancer with HTTPS listener

Create an AWS Application Load Balancer resource named app_lb with an HTTPS listener on port 443. Use the variable ssl_certificate_arn for the SSL certificate ARN. Configure the listener to forward traffic to the target group web-target-group on port 80.

AWS

resource "aws_lb_target_group" "web_target_group" {
  name     = "web-target-group"
  port     = 80
  protocol = "HTTP"
  vpc_id   = "vpc-12345678"
}

variable "ssl_certificate_arn" {
  type        = string
  description = "ARN of the SSL certificate for the load balancer"
}

# Your code here to create the Application Load Balancer with HTTPS listener

Hint

Use aws_lb for the load balancer and aws_lb_listener for the HTTPS listener. Reference the SSL certificate ARN variable.

4

Add security group and finalize configuration

Add a security group with ID sg-12345678 to the load balancer app_lb and ensure the load balancer is in subnets subnet-11111111 and subnet-22222222. Confirm the SSL policy is set to ELBSecurityPolicy-2016-08 for secure SSL/TLS settings.

AWS

resource "aws_lb_target_group" "web_target_group" {
  name     = "web-target-group"
  port     = 80
  protocol = "HTTP"
  vpc_id   = "vpc-12345678"
}

variable "ssl_certificate_arn" {
  type        = string
  description = "ARN of the SSL certificate for the load balancer"
}

resource "aws_lb" "app_lb" {
  name               = "app-lb"
  internal           = false
  load_balancer_type = "application"
  # Add security_groups and subnets here
}

resource "aws_lb_listener" "https_listener" {
  load_balancer_arn = aws_lb.app_lb.arn
  port              = 443
  protocol          = "HTTPS"

  ssl_policy        = "ELBSecurityPolicy-2016-08"
  certificate_arn   = var.ssl_certificate_arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.web_target_group.arn
  }
}

# Your code here to finalize configuration

Hint

Make sure the aws_lb resource includes the security_groups and subnets attributes as specified, and the listener has the correct ssl_policy.

Practice

1. What is the main purpose of SSL/TLS termination on an AWS load balancer?

easy

A. To store SSL certificates on backend servers

B. To decrypt incoming HTTPS traffic before sending it to backend servers

C. To encrypt traffic between backend servers

D. To disable HTTPS on the load balancer

Solution

1. Step 1: Understand SSL/TLS termination role

   SSL/TLS termination means the load balancer decrypts HTTPS traffic so backend servers receive plain HTTP.

2. Step 2: Identify where decryption happens

   The load balancer handles the SSL certificates and decrypts traffic, simplifying backend server setup.

3. Final Answer:

   To decrypt incoming HTTPS traffic before sending it to backend servers -> Option B

4. Quick Check:

   SSL/TLS termination = decrypt at load balancer [OK]

Hint: SSL termination means decrypt at load balancer, not backend [OK]

Common Mistakes:

• Thinking backend servers handle SSL decryption
• Confusing encryption with decryption location
• Assuming SSL certificates must be on backend servers

2. Which AWS load balancer listener configuration correctly enables SSL/TLS termination?

easy

A. Listener protocol HTTP on port 80 with SSL certificate attached

B. Listener protocol TCP on port 443 without SSL certificate

C. Listener protocol HTTPS on port 443 with SSL certificate attached

D. Listener protocol HTTPS on port 80 without SSL certificate

Solution

1. Step 1: Identify correct protocol and port for SSL termination

   HTTPS protocol on port 443 is standard for SSL/TLS termination.

2. Step 2: Confirm SSL certificate attachment

   SSL certificate must be attached to the HTTPS listener to enable termination.

3. Final Answer:

   Listener protocol HTTPS on port 443 with SSL certificate attached -> Option C

4. Quick Check:

   HTTPS + port 443 + cert = SSL termination [OK]

Hint: SSL termination needs HTTPS listener on port 443 with cert [OK]

Common Mistakes:

• Using HTTP protocol with SSL certificate
• Using wrong port for HTTPS
• Not attaching SSL certificate to listener

3. Given this AWS Application Load Balancer listener configuration:
Listener: HTTPS on port 443 with SSL certificate
What happens if a client sends an HTTP request to port 80?

medium

A. The request is forwarded to backend servers without encryption

B. The request is accepted as plain HTTP without encryption

C. The request is automatically redirected to HTTPS on port 443

D. The request is rejected with a connection error

Solution

1. Step 1: Check listener configuration for port 80

   No listener is defined on port 80, so the load balancer does not accept HTTP requests.

2. Step 2: Understand behavior without HTTP listener

   Without an HTTP listener, requests to port 80 fail with connection errors.

3. Final Answer:

   The request is rejected with a connection error -> Option D

4. Quick Check:

   No HTTP listener = connection error on port 80 [OK]

Hint: No HTTP listener means HTTP requests fail, no redirect [OK]

Common Mistakes:

• Assuming automatic HTTP to HTTPS redirect without listener
• Thinking HTTP requests are accepted without encryption
• Confusing backend server behavior with load balancer

4. You configured an AWS load balancer with an HTTPS listener on port 443 and attached a valid SSL certificate. However, clients report SSL errors when connecting. What is the most likely cause?

medium

A. The SSL certificate is expired or not trusted by clients

B. The load balancer listener is set to HTTP instead of HTTPS

C. Backend servers do not support HTTPS

D. The load balancer is missing a target group

Solution

1. Step 1: Verify SSL certificate validity

   SSL errors often occur if the certificate is expired or not trusted by client browsers.

2. Step 2: Check listener and backend setup

   Listener is HTTPS with certificate attached, so listener config is correct; backend HTTPS support is optional after termination.

3. Final Answer:

   The SSL certificate is expired or not trusted by clients -> Option A

4. Quick Check:

   SSL errors usually mean bad or expired cert [OK]

Hint: SSL errors usually mean certificate issues [OK]

Common Mistakes:

• Assuming backend HTTPS affects client SSL errors
• Confusing listener protocol with certificate validity
• Ignoring certificate expiration or trust chain

5. You want to ensure all HTTP traffic to your AWS Application Load Balancer is securely redirected to HTTPS. Which configuration achieves this best?

hard

A. Create an HTTP listener on port 80 that redirects all requests to HTTPS on port 443

B. Create an HTTPS listener on port 443 and disable HTTP listener

C. Configure backend servers to redirect HTTP to HTTPS

D. Attach SSL certificates to backend servers only

Solution

1. Step 1: Understand how to redirect HTTP to HTTPS at load balancer

   Creating an HTTP listener on port 80 that redirects to HTTPS ensures all HTTP requests become secure.

2. Step 2: Evaluate other options

   Disabling HTTP listener blocks HTTP requests; backend redirects add latency and complexity; attaching certs only to backend does not redirect.

3. Final Answer:

   Create an HTTP listener on port 80 that redirects all requests to HTTPS on port 443 -> Option A

4. Quick Check:

   HTTP listener with redirect = secure all traffic [OK]

Hint: Use HTTP listener redirect to HTTPS for secure traffic [OK]

Common Mistakes:

• Disabling HTTP listener without redirect
• Relying on backend servers for redirects
• Not attaching SSL cert to load balancer listener