问

AWS Cloudformation:负载均衡器自定义SSL协商策略

岁月完好发布于 2022-12-13 00:47

ssl

cloud

format

尝试使用自定义SSL协商策略设置云信息模板.我得到的cloudformation错误是:

无法启用CREATE_FAILED AWS :: ElasticLoadBalancing :: LoadBalancer BackendELB SSLNegotiationPolicy

我的cloudformation模板部分如下:

"Policies" : [
                {
                    "PolicyName": "SSLNegotiationPolicy",
                    "PolicyType": "SSLNegotiationPolicyType",
                    "Attributes": [
                        { "Name" : "Protocol-TLSv1", "Value" : "true" },
                        { "Name" : "Protocol-TLSv1.1", "Value" : "true" },
                        { "Name" : "Protocol-TLSv1.2", "Value" : "true" },
                        { "Name" : "Protocol-SSLv2", "Value" : "false" },
                        { "Name" : "Protocol-SSLv3", "Value" : "false" },
                        { "Name" : "ECDHE-RSA-AES128-GCM-SHA256", "Value" : "true" },
                        { "Name" : "ECDHE-ECDSA-AES128-SHA256", "Value" : "true" },
                        { "Name" : "ECDHE-RSA-AES128-SHA256", "Value" : "true" },
                        { "Name" : "ECDHE-ECDSA-AES128-SHA", "Value" : "true" },
                        { "Name" : "ECDHE-RSA-AES128-SHA", "Value" : "true" },
                        { "Name" : "DHE-RSA-AES128-SHA", "Value" : "true" },
                        { "Name" : "ECDHE-ECDSA-AES256-GCM-SHA384", "Value" : "true" },
                        { "Name" : "ECDHE-RSA-AES256-GCM-SHA384", "Value" : "true" },
                        { "Name" : "ECDHE-ECDSA-AES256-SHA384", "Value" : "true" },
                        { "Name" : "ECDHE-RSA-AES256-SHA384", "Value" : "true" },
                        { "Name" : "ECDHE-RSA-AES256-SHA", "Value" : "true" },
                        { "Name" : "ECDHE-ECDSA-AES256-SHA", "Value" : "true" },
                        { "Name" : "AES128-GCM-SHA256", "Value" : "true" },
                        { "Name" : "AES128-SHA256", "Value" : "true" },
                        { "Name" : "AES128-SHA", "Value" : "true" },
                        { "Name" : "AES256-GCM-SHA384", "Value" : "true" },
                        { "Name" : "AES256-SHA256", "Value" : "true" },
                        { "Name" : "AES256-SHA", "Value" : "true" },
                        { "Name" : "DHE-DSS-AES128-SHA", "Value" : "true" },
                        { "Name" : "RC4-SHA", "Value" : "false" },
                        { "Name" : "ECDHE-ECDSA-RC4-SHA", "Value" : "false" }
                    ],
                    "InstancePorts" : [ "443" ]
               } 
           ]

如果我删除了InstancePorts部分,那么ELB创建时没有错误,但新的负载均衡器不使用概述的策略.

有任何想法吗？

附带问题:是否有必要将策略的每个值设置为true或false,或者如果模板中未定义密码,是否默认为推荐的SSL策略中定义的值？

1 个回答

我认为你走在正确的轨道上.您可以使用以下方法查看现有安全策略内容:

aws elb describe-load-balancer-policies

我为完整性指定了所有内容,例如下面的政策:

    "Policies" : [
      {
        "PolicyName" : "My-ELBSecurityPolicy-2014-10-DisableRC4",
        "PolicyType" : "SSLNegotiationPolicyType",
        "Attributes" : [
            { "Name": "Protocol-SSLv2", "Value": "false" }, 
            { "Name": "Protocol-TLSv1", "Value": "true" }, 
            { "Name": "Protocol-SSLv3", "Value": "false" }, 
            { "Name": "Protocol-TLSv1.1", "Value": "true" }, 
            { "Name": "Protocol-TLSv1.2", "Value": "true" }, 
            { "Name": "Server-Defined-Cipher-Order", "Value": "true" }, 
            { "Name": "ECDHE-ECDSA-AES128-GCM-SHA256", "Value": "true" }, 
            { "Name": "ECDHE-RSA-AES128-GCM-SHA256", "Value": "true" }, 
            { "Name": "ECDHE-ECDSA-AES128-SHA256", "Value": "true" }, 
            { "Name": "ECDHE-RSA-AES128-SHA256", "Value": "true" }, 
            { "Name": "ECDHE-ECDSA-AES128-SHA", "Value": "true" }, 
            { "Name": "ECDHE-RSA-AES128-SHA", "Value": "true" }, 
            { "Name": "DHE-RSA-AES128-SHA", "Value": "true" }, 
            { "Name": "ECDHE-ECDSA-AES256-GCM-SHA384", "Value": "true" }, 
            { "Name": "ECDHE-RSA-AES256-GCM-SHA384", "Value": "true" }, 
            { "Name": "ECDHE-ECDSA-AES256-SHA384", "Value": "true" }, 
            { "Name": "ECDHE-RSA-AES256-SHA384", "Value": "true" }, 
            { "Name": "ECDHE-RSA-AES256-SHA", "Value": "true" }, 
            { "Name": "ECDHE-ECDSA-AES256-SHA", "Value": "true" }, 
            { "Name": "AES128-GCM-SHA256", "Value": "true" }, 
            { "Name": "AES128-SHA256", "Value": "true" }, 
            { "Name": "AES128-SHA", "Value": "true" }, 
            { "Name": "AES256-GCM-SHA384", "Value": "true" }, 
            { "Name": "AES256-SHA256", "Value": "true" }, 
            { "Name": "AES256-SHA", "Value": "true" }, 
            { "Name": "DHE-DSS-AES128-SHA", "Value": "true" }, 
            { "Name": "CAMELLIA128-SHA", "Value": "false" }, 
            { "Name": "EDH-RSA-DES-CBC3-SHA", "Value": "false" }, 
            { "Name": "DES-CBC3-SHA", "Value": "false" }, 
            { "Name": "ECDHE-RSA-RC4-SHA", "Value": "false" }, 
            { "Name": "RC4-SHA", "Value": "false" }, 
            { "Name": "ECDHE-ECDSA-RC4-SHA", "Value": "false" }, 
            { "Name": "DHE-DSS-AES256-GCM-SHA384", "Value": "false" }, 
            { "Name": "DHE-RSA-AES256-GCM-SHA384", "Value": "false" }, 
            { "Name": "DHE-RSA-AES256-SHA256", "Value": "false" }, 
            { "Name": "DHE-DSS-AES256-SHA256", "Value": "false" }, 
            { "Name": "DHE-RSA-AES256-SHA", "Value": "false" }, 
            { "Name": "DHE-DSS-AES256-SHA", "Value": "false" }, 
            { "Name": "DHE-RSA-CAMELLIA256-SHA", "Value": "false" }, 
            { "Name": "DHE-DSS-CAMELLIA256-SHA", "Value": "false" }, 
            { "Name": "CAMELLIA256-SHA", "Value": "false" }, 
            { "Name": "EDH-DSS-DES-CBC3-SHA", "Value": "false" }, 
            { "Name": "DHE-DSS-AES128-GCM-SHA256", "Value": "false" }, 
            { "Name": "DHE-RSA-AES128-GCM-SHA256", "Value": "false" }, 
            { "Name": "DHE-RSA-AES128-SHA256", "Value": "false" }, 
            { "Name": "DHE-DSS-AES128-SHA256", "Value": "false" }, 
            { "Name": "DHE-RSA-CAMELLIA128-SHA", "Value": "false" }, 
            { "Name": "DHE-DSS-CAMELLIA128-SHA", "Value": "false" }, 
            { "Name": "ADH-AES128-GCM-SHA256", "Value": "false" }, 
            { "Name": "ADH-AES128-SHA", "Value": "false" }, 
            { "Name": "ADH-AES128-SHA256", "Value": "false" }, 
            { "Name": "ADH-AES256-GCM-SHA384", "Value": "false" }, 
            { "Name": "ADH-AES256-SHA", "Value": "false" }, 
            { "Name": "ADH-AES256-SHA256", "Value": "false" }, 
            { "Name": "ADH-CAMELLIA128-SHA", "Value": "false" }, 
            { "Name": "ADH-CAMELLIA256-SHA", "Value": "false" }, 
            { "Name": "ADH-DES-CBC3-SHA", "Value": "false" }, 
            { "Name": "ADH-DES-CBC-SHA", "Value": "false" }, 
            { "Name": "ADH-RC4-MD5", "Value": "false" }, 
            { "Name": "ADH-SEED-SHA", "Value": "false" }, 
            { "Name": "DES-CBC-SHA", "Value": "false" }, 
            { "Name": "DHE-DSS-SEED-SHA", "Value": "false" }, 
            { "Name": "DHE-RSA-SEED-SHA", "Value": "false" }, 
            { "Name": "EDH-DSS-DES-CBC-SHA", "Value": "false" }, 
            { "Name": "EDH-RSA-DES-CBC-SHA", "Value": "false" }, 
            { "Name": "IDEA-CBC-SHA", "Value": "false" }, 
            { "Name": "RC4-MD5", "Value": "false" }, 
            { "Name": "SEED-SHA", "Value": "false" }, 
            { "Name": "DES-CBC3-MD5", "Value": "false" }, 
            { "Name": "DES-CBC-MD5", "Value": "false" }, 
            { "Name": "RC2-CBC-MD5", "Value": "false" }, 
            { "Name": "PSK-AES256-CBC-SHA", "Value": "false" }, 
            { "Name": "PSK-3DES-EDE-CBC-SHA", "Value": "false" }, 
            { "Name": "KRB5-DES-CBC3-SHA", "Value": "false" }, 
            { "Name": "KRB5-DES-CBC3-MD5", "Value": "false" }, 
            { "Name": "PSK-AES128-CBC-SHA", "Value": "false" }, 
            { "Name": "PSK-RC4-SHA", "Value": "false" }, 
            { "Name": "KRB5-RC4-SHA", "Value": "false" }, 
            { "Name": "KRB5-RC4-MD5", "Value": "false" }, 
            { "Name": "KRB5-DES-CBC-SHA", "Value": "false" }, 
            { "Name": "KRB5-DES-CBC-MD5", "Value": "false" }, 
            { "Name": "EXP-EDH-RSA-DES-CBC-SHA", "Value": "false" }, 
            { "Name": "EXP-EDH-DSS-DES-CBC-SHA", "Value": "false" }, 
            { "Name": "EXP-ADH-DES-CBC-SHA", "Value": "false" }, 
            { "Name": "EXP-DES-CBC-SHA", "Value": "false" }, 
            { "Name": "EXP-RC2-CBC-MD5", "Value": "false" }, 
            { "Name": "EXP-KRB5-RC2-CBC-SHA", "Value": "false" }, 
            { "Name": "EXP-KRB5-DES-CBC-SHA", "Value": "false" }, 
            { "Name": "EXP-KRB5-RC2-CBC-MD5", "Value": "false" }, 
            { "Name": "EXP-KRB5-DES-CBC-MD5", "Value": "false" }, 
            { "Name": "EXP-ADH-RC4-MD5", "Value": "false" }, 
            { "Name": "EXP-RC4-MD5", "Value": "false" }, 
            { "Name": "EXP-KRB5-RC4-SHA", "Value": "false" }, 
            { "Name": "EXP-KRB5-RC4-MD5", "Value": "false" }
        ]
      }
    ]

您还必须在ELB规范中引用该策略:

    "Listeners" : [
      { "LoadBalancerPort" : "80",
        "InstancePort" : "80",
        "Protocol" : "HTTP" },
      { "LoadBalancerPort" : "443",
        "InstancePort" : "80",
        "Protocol" : "HTTPS",
        "SSLCertificateId" : "arn:aws:iam::111111111111:server-certificate/somedomain.com",
        "PolicyNames" : [ "My-ELBSecurityPolicy-2014-10-DisableRC4", "SomeOtherPolicy" ]
      }
    ],

2022-12-13 01:06 回答

云海雨岛

撰写答案

今天，你开发时遇到什么问题呢？

立即提问

热门标签