feat(sdk): add ELBv2 PQ TLS check

HugoPBrito · HugoPBrito · commit aadd1a6ff02e · 2026-07-14T13:21:13.000+01:00
- Add configurable post-quantum TLS policy validation

- Emit one PASS or FAIL report per load balancer

- Add config schema coverage and SDK tests
diff --git a/docs/user-guide/cli/tutorials/configuration_file.mdx b/docs/user-guide/cli/tutorials/configuration_file.mdx
@@ -78,6 +78,7 @@ The following list includes all the AWS checks with configurable variables that
 | `elasticache_redis_cluster_backup_enabled`                             | `minimum_snapshot_retention_period`               | Integer         | `7`                                                                                                                                  |
 | `elb_is_in_multiple_az`                                                | `elb_min_azs`                                     | Integer         | `2`                                                                                                                                  |
 | `elbv2_is_in_multiple_az`                                              | `elbv2_min_azs`                                   | Integer         | `2`                                                                                                                                  |
+| `elbv2_listener_pqc_tls_enabled`                                       | `elbv2_listener_pqc_tls_allowed_policies`         | List of Strings | See `config.yaml`                                                                                                                    |
 | `eventbridge_bus_cross_account_access`                                 | `trusted_account_ids`                             | List of Strings | `[]`                                                                                                                                 |
 | `eventbridge_schema_registry_cross_account_access`                     | `trusted_account_ids`                             | List of Strings | `[]`                                                                                                                                 |
 | `glue_etl_jobs_no_secrets_in_arguments`                                | `secrets_ignore_patterns`                         | List of Strings | `[]`                                                                                                                                 |
diff --git a/prowler/changelog.d/elbv2-listener-pqc-tls-enabled.added.md b/prowler/changelog.d/elbv2-listener-pqc-tls-enabled.added.md
@@ -0,0 +1 @@
+`elbv2_listener_pqc_tls_enabled` check for AWS provider, verifying that ELBv2 listeners use post-quantum TLS policies
diff --git a/prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.json b/prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.json
@@ -1181,6 +1181,7 @@
         "elb_insecure_ssl_ciphers",
         "elb_ssl_listeners",
         "elbv2_insecure_ssl_ciphers",
+        "elbv2_listener_pqc_tls_enabled",
         "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
diff --git a/prowler/compliance/aws/ccc_aws.json b/prowler/compliance/aws/ccc_aws.json
@@ -49,6 +49,7 @@
         "elb_insecure_ssl_ciphers",
         "elb_ssl_listeners",
         "elbv2_insecure_ssl_ciphers",
+        "elbv2_listener_pqc_tls_enabled",
         "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
diff --git a/prowler/compliance/aws/ens_rd2022_aws.json b/prowler/compliance/aws/ens_rd2022_aws.json
@@ -2495,6 +2495,7 @@
       ],
       "Checks": [
         "elbv2_insecure_ssl_ciphers",
+        "elbv2_listener_pqc_tls_enabled",
         "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled"
@@ -2521,6 +2522,7 @@
       ],
       "Checks": [
         "elbv2_insecure_ssl_ciphers",
+        "elbv2_listener_pqc_tls_enabled",
         "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled"
diff --git a/prowler/compliance/aws/fedramp_moderate_revision_4_aws.json b/prowler/compliance/aws/fedramp_moderate_revision_4_aws.json
@@ -1377,6 +1377,7 @@
       "Checks": [
         "apigateway_restapi_client_certificate_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "elbv2_listener_pqc_tls_enabled",
         "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
@@ -1399,6 +1400,7 @@
       "Checks": [
         "apigateway_restapi_client_certificate_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "elbv2_listener_pqc_tls_enabled",
         "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
diff --git a/prowler/compliance/aws/ffiec_aws.json b/prowler/compliance/aws/ffiec_aws.json
@@ -615,6 +615,7 @@
       "Checks": [
         "apigateway_restapi_client_certificate_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "elbv2_listener_pqc_tls_enabled",
         "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
diff --git a/prowler/compliance/aws/gxp_21_cfr_part_11_aws.json b/prowler/compliance/aws/gxp_21_cfr_part_11_aws.json
@@ -266,6 +266,7 @@
         "ec2_ebs_default_encryption",
         "efs_encryption_at_rest_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "elbv2_listener_pqc_tls_enabled",
         "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
diff --git a/prowler/compliance/aws/iso27001_2013_aws.json b/prowler/compliance/aws/iso27001_2013_aws.json
@@ -36,6 +36,7 @@
       "Checks": [
         "elb_insecure_ssl_ciphers",
         "elbv2_insecure_ssl_ciphers",
+        "elbv2_listener_pqc_tls_enabled",
         "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled"
diff --git a/prowler/compliance/aws/kisa_isms_p_2023_aws.json b/prowler/compliance/aws/kisa_isms_p_2023_aws.json
@@ -2064,6 +2064,7 @@
         "elb_ssl_listeners",
         "elb_ssl_listeners_use_acm_certificate",
         "elbv2_insecure_ssl_ciphers",
+        "elbv2_listener_pqc_tls_enabled",
         "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
@@ -3142,6 +3143,7 @@
         "elb_ssl_listeners_use_acm_certificate",
         "elbv2_desync_mitigation_mode",
         "elbv2_insecure_ssl_ciphers",
+        "elbv2_listener_pqc_tls_enabled",
         "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
diff --git a/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json b/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json
@@ -2066,6 +2066,7 @@
         "elb_ssl_listeners",
         "elb_ssl_listeners_use_acm_certificate",
         "elbv2_insecure_ssl_ciphers",
+        "elbv2_listener_pqc_tls_enabled",
         "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
@@ -3145,6 +3146,7 @@
         "elb_ssl_listeners_use_acm_certificate",
         "elbv2_desync_mitigation_mode",
         "elbv2_insecure_ssl_ciphers",
+        "elbv2_listener_pqc_tls_enabled",
         "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
diff --git a/prowler/compliance/aws/nist_800_171_revision_2_aws.json b/prowler/compliance/aws/nist_800_171_revision_2_aws.json
@@ -717,6 +717,7 @@
         "apigateway_restapi_client_certificate_enabled",
         "ec2_ebs_volume_encryption",
         "elbv2_insecure_ssl_ciphers",
+        "elbv2_listener_pqc_tls_enabled",
         "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
diff --git a/prowler/compliance/aws/nist_800_53_revision_5_aws.json b/prowler/compliance/aws/nist_800_53_revision_5_aws.json
@@ -5592,6 +5592,7 @@
       "Checks": [
         "apigateway_restapi_client_certificate_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "elbv2_listener_pqc_tls_enabled",
         "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
diff --git a/prowler/compliance/aws/rbi_cyber_security_framework_aws.json b/prowler/compliance/aws/rbi_cyber_security_framework_aws.json
@@ -40,6 +40,7 @@
         "ec2_instance_public_ip",
         "efs_encryption_at_rest_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "elbv2_listener_pqc_tls_enabled",
         "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
diff --git a/prowler/compliance/aws/secnumcloud_3.2_aws.json b/prowler/compliance/aws/secnumcloud_3.2_aws.json
@@ -490,6 +490,7 @@
         "elbv2_ssl_listeners",
         "elb_insecure_ssl_ciphers",
         "elbv2_insecure_ssl_ciphers",
+        "elbv2_listener_pqc_tls_enabled",
         "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
diff --git a/prowler/config/config.yaml b/prowler/config/config.yaml
@@ -424,6 +424,21 @@ aws:
     - "SecurityPolicy_TLS13_1_2_PFS_PQ_2025_09"
     - "SecurityPolicy_TLS13_1_2_PQ_2025_09"
 
+  # aws.elbv2_listener_pqc_tls_enabled
+  # Allowed post-quantum TLS security policies for ELBv2 HTTPS/TLS listeners
+  elbv2_listener_pqc_tls_allowed_policies:
+    - "ELBSecurityPolicy-TLS13-1-2-PQ-2025-09"
+    - "ELBSecurityPolicy-TLS13-1-2-Ext1-PQ-2025-09"
+    - "ELBSecurityPolicy-TLS13-1-2-Ext2-PQ-2025-09"
+    - "ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09"
+    - "ELBSecurityPolicy-TLS13-1-3-PQ-2025-09"
+    - "ELBSecurityPolicy-TLS13-1-2-FIPS-PQ-2025-09"
+    - "ELBSecurityPolicy-TLS13-1-2-Ext0-FIPS-PQ-2025-09"
+    - "ELBSecurityPolicy-TLS13-1-2-Ext1-FIPS-PQ-2025-09"
+    - "ELBSecurityPolicy-TLS13-1-2-Ext2-FIPS-PQ-2025-09"
+    - "ELBSecurityPolicy-TLS13-1-2-Res-FIPS-PQ-2025-09"
+    - "ELBSecurityPolicy-TLS13-1-3-FIPS-PQ-2025-09"
+
   # aws.rolesanywhere_trust_anchor_pqc_pki
   # Allowed post-quantum key algorithms for AWS Private CAs backing IAM Roles Anywhere trust anchors
   rolesanywhere_pqc_pca_key_algorithms:
diff --git a/prowler/config/schema/aws.py b/prowler/config/schema/aws.py
@@ -415,6 +415,10 @@ class AWSProviderConfig(ProviderConfigBase):
         le=6,
         description="Min AZs an Application/Network LB must span. Range: 1..6.",
     )
+    elbv2_listener_pqc_tls_allowed_policies: Optional[list[str]] = Field(
+        default=None,
+        description="ELBv2 SSL policies that satisfy the PQ TLS listener check.",
+    )
 
     # --- ElastiCache -----------------------------------------------------
     minimum_snapshot_retention_period: Optional[int] = Field(
diff --git a/prowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/__init__.py b/prowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/__init__.py
diff --git a/prowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.metadata.json b/prowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.metadata.json
@@ -0,0 +1,42 @@
+{
+  "Provider": "aws",
+  "CheckID": "elbv2_listener_pqc_tls_enabled",
+  "CheckTitle": "ELBv2 post-quantum TLS policy reduces harvest-now-decrypt-later risk for HTTPS/TLS listeners",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices"
+  ],
+  "ServiceName": "elbv2",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "AwsElbv2LoadBalancer",
+  "ResourceGroup": "network",
+  "Description": "**ELBv2 HTTPS and TLS listeners** are assessed for use of **post-quantum (PQ) TLS security policies**. Listeners whose `SslPolicy` is not in the approved PQ set lack hybrid key exchange (ML-KEM 768 + ECDHE), which can increase harvest-now-decrypt-later exposure for recorded traffic.",
+  "Risk": "Without PQ-ready TLS policies, encrypted traffic captured today may be stored for future cryptanalysis if a **cryptographically relevant quantum computer** becomes available (**harvest-now, decrypt-later** attack). PQ-ready TLS policies reduce this long-term confidentiality risk for sensitive data, credentials, and session tokens transmitted through the load balancer.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html",
+    "https://aws.amazon.com/security/post-quantum-cryptography/",
+    "https://csrc.nist.gov/projects/post-quantum-cryptography"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aws elbv2 modify-listener --listener-arn <listener_arn> --ssl-policy ELBSecurityPolicy-TLS13-1-2-PQ-2025-09",
+      "NativeIaC": "```yaml\nResources:\n  <example_resource_name>:\n    Type: AWS::ElasticLoadBalancingV2::Listener\n    Properties:\n      LoadBalancerArn: <example_resource_arn>\n      Protocol: HTTPS\n      Port: 443\n      DefaultActions:\n        - Type: forward\n          TargetGroupArn: <example_resource_arn>\n      Certificates:\n        - CertificateArn: <example_certificate_arn>\n      SslPolicy: ELBSecurityPolicy-TLS13-1-2-PQ-2025-09  # FIX: uses a post-quantum TLS policy\n```",
+      "Other": "1. In the AWS Console, go to EC2 > Load Balancers\n2. Select the load balancer and open the Listeners tab\n3. Select the HTTPS/TLS listener and choose Edit\n4. Set Security policy to ELBSecurityPolicy-TLS13-1-2-PQ-2025-09 (or any approved PQ policy)\n5. Save changes",
+      "Terraform": "```hcl\nresource \"aws_lb_listener\" \"<example_resource_name>\" {\n  load_balancer_arn = \"<example_resource_arn>\"\n  port              = 443\n  protocol          = \"HTTPS\"\n  ssl_policy        = \"ELBSecurityPolicy-TLS13-1-2-PQ-2025-09\" # FIX: post-quantum TLS policy\n  certificate_arn   = \"<example_certificate_arn>\"\n\n  default_action {\n    type             = \"forward\"\n    target_group_arn = \"<example_resource_arn>\"\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Migrate all ELBv2 HTTPS and TLS listeners to a **post-quantum TLS policy** (`ELBSecurityPolicy-TLS13-*-PQ-2025-09` family) to enable hybrid key exchange (ML-KEM + ECDHE). Periodically review and update policies as AWS publishes new PQ-ready options.",
+      "Url": "https://hub.prowler.com/check/elbv2_listener_pqc_tls_enabled"
+    }
+  },
+  "Categories": [
+    "encryption"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "elbv2_insecure_ssl_ciphers"
+  ],
+  "Notes": ""
+}
diff --git a/prowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.py b/prowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.py
@@ -0,0 +1,96 @@
+"""Check that ELBv2 HTTPS/TLS listeners use post-quantum TLS policies."""
+
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.lib.logger import logger
+from prowler.providers.aws.services.elbv2.elbv2_client import elbv2_client
+
+PQ_TLS_POLICIES_DEFAULT = [
+    "ELBSecurityPolicy-TLS13-1-2-PQ-2025-09",
+    "ELBSecurityPolicy-TLS13-1-2-Ext1-PQ-2025-09",
+    "ELBSecurityPolicy-TLS13-1-2-Ext2-PQ-2025-09",
+    "ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09",
+    "ELBSecurityPolicy-TLS13-1-3-PQ-2025-09",
+    "ELBSecurityPolicy-TLS13-1-2-FIPS-PQ-2025-09",
+    "ELBSecurityPolicy-TLS13-1-2-Ext0-FIPS-PQ-2025-09",
+    "ELBSecurityPolicy-TLS13-1-2-Ext1-FIPS-PQ-2025-09",
+    "ELBSecurityPolicy-TLS13-1-2-Ext2-FIPS-PQ-2025-09",
+    "ELBSecurityPolicy-TLS13-1-2-Res-FIPS-PQ-2025-09",
+    "ELBSecurityPolicy-TLS13-1-3-FIPS-PQ-2025-09",
+]
+
+
+def _get_allowed_policies(configured_policies: object) -> list[str]:
+    """Return configured ELBv2 PQ TLS policies or the built-in defaults."""
+    if (
+        not isinstance(configured_policies, (list, tuple, set))
+        or not configured_policies
+    ):
+        logger.warning(
+            "Invalid or empty elbv2_listener_pqc_tls_allowed_policies configuration; using built-in default PQ TLS policies."
+        )
+        return PQ_TLS_POLICIES_DEFAULT
+
+    return list(configured_policies)
+
+
+class elbv2_listener_pqc_tls_enabled(Check):
+    """Verify that every ELBv2 HTTPS or TLS listener uses a post-quantum TLS policy.
+
+    This check evaluates whether each HTTPS (ALB) or TLS (NLB) listener on an
+    ELBv2 load balancer terminates TLS with a security policy that offers
+    post-quantum (PQ) hybrid key exchange (ML-KEM 768 combined with ECDHE).
+    - PASS: All HTTPS/TLS listeners on the load balancer use a PQ TLS policy.
+    - FAIL: At least one HTTPS/TLS listener uses a non-PQ TLS policy.
+    """
+
+    def execute(self) -> list[Check_Report_AWS]:
+        """Execute the PQ TLS policy check for every ELBv2 load balancer.
+
+        Returns:
+            A list of reports, one per load balancer.
+        """
+        findings = []
+        pq_tls_policies = _get_allowed_policies(
+            elbv2_client.audit_config.get("elbv2_listener_pqc_tls_allowed_policies")
+        )
+        for lb in elbv2_client.loadbalancersv2.values():
+            report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
+
+            if lb.listener_discovery_failed:
+                report.status = "FAIL"
+                error_detail = (
+                    f" Error: {lb.listener_discovery_error}"
+                    if lb.listener_discovery_error
+                    else ""
+                )
+                report.status_extended = f"ELBv2 {lb.name} could not retrieve listeners; post-quantum TLS policy compliance cannot be determined.{error_detail}"
+                findings.append(report)
+                continue
+
+            has_tls_listeners = False
+            non_pq_listeners = []
+            for listener_arn, listener in lb.listeners.items():
+                if listener.protocol in ("HTTPS", "TLS"):
+                    has_tls_listeners = True
+                    if listener.ssl_policy not in pq_tls_policies:
+                        ssl_policy = listener.ssl_policy or "<none>"
+                        non_pq_listeners.append(
+                            f"{listener.protocol}:{listener.port} ({listener_arn}) uses {ssl_policy}"
+                        )
+
+            if not has_tls_listeners:
+                report.status = "PASS"
+                report.status_extended = f"ELBv2 {lb.name} has no HTTPS/TLS listeners."
+                findings.append(report)
+                continue
+
+            if non_pq_listeners:
+                report.status = "FAIL"
+                report.status_extended = f"ELBv2 {lb.name} has HTTPS/TLS listeners without post-quantum TLS policy: {', '.join(non_pq_listeners)}."
+            else:
+                report.status = "PASS"
+                report.status_extended = f"ELBv2 {lb.name} has all HTTPS/TLS listeners using a post-quantum TLS policy."
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/aws/services/elbv2/elbv2_service.py b/prowler/providers/aws/services/elbv2/elbv2_service.py
@@ -74,6 +74,7 @@ def _describe_listeners(self, load_balancer):
             ):
                 for listener in page["Listeners"]:
                     load_balancer[1].listeners[listener["ListenerArn"]] = Listenerv2(
+                        arn=listener["ListenerArn"],
                         region=regional_client.region,
                         port=listener.get("Port", 0),
                         ssl_policy=listener.get("SslPolicy", ""),
@@ -86,10 +87,14 @@ def _describe_listeners(self, load_balancer):
                     f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
                 )
             else:
+                load_balancer[1].listener_discovery_failed = True
+                load_balancer[1].listener_discovery_error = str(error)
                 logger.error(
                     f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
                 )
         except Exception as error:
+            load_balancer[1].listener_discovery_failed = True
+            load_balancer[1].listener_discovery_error = str(error)
             logger.error(
                 f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
@@ -190,6 +195,7 @@ class ListenerRule(BaseModel):
 
 
 class Listenerv2(BaseModel):
+    arn: str
     region: str
     port: int
     protocol: str
@@ -209,6 +215,8 @@ class LoadBalancerv2(BaseModel):
     drop_invalid_header_fields: Optional[str]
     cross_zone_load_balancing: Optional[str]
     listeners: Dict[str, Listenerv2] = {}
+    listener_discovery_failed: bool = False
+    listener_discovery_error: Optional[str] = None
     scheme: Optional[str]
     security_groups: list[str] = []
     # Key: ZoneName, Value: SubnetId
diff --git a/tests/config/config_test.py b/tests/config/config_test.py
@@ -320,6 +320,19 @@ def mock_prowler_get_latest_release(_, **_kwargs):
     "minimum_snapshot_retention_period": 7,
     "elb_min_azs": 2,
     "elbv2_min_azs": 2,
+    "elbv2_listener_pqc_tls_allowed_policies": [
+        "ELBSecurityPolicy-TLS13-1-2-PQ-2025-09",
+        "ELBSecurityPolicy-TLS13-1-2-Ext1-PQ-2025-09",
+        "ELBSecurityPolicy-TLS13-1-2-Ext2-PQ-2025-09",
+        "ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09",
+        "ELBSecurityPolicy-TLS13-1-3-PQ-2025-09",
+        "ELBSecurityPolicy-TLS13-1-2-FIPS-PQ-2025-09",
+        "ELBSecurityPolicy-TLS13-1-2-Ext0-FIPS-PQ-2025-09",
+        "ELBSecurityPolicy-TLS13-1-2-Ext1-FIPS-PQ-2025-09",
+        "ELBSecurityPolicy-TLS13-1-2-Ext2-FIPS-PQ-2025-09",
+        "ELBSecurityPolicy-TLS13-1-2-Res-FIPS-PQ-2025-09",
+        "ELBSecurityPolicy-TLS13-1-3-FIPS-PQ-2025-09",
+    ],
     "secrets_ignore_patterns": [],
     "max_days_secret_unused": 90,
     "max_days_secret_unrotated": 90,
diff --git a/tests/config/fixtures/config.yaml b/tests/config/fixtures/config.yaml
diff --git a/tests/config/schema/aws_schema_test.py b/tests/config/schema/aws_schema_test.py
diff --git a/tests/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled_test.py b/tests/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled_test.py

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	+`elbv2_listener_pqc_tls_enabled` check for AWS provider, verifying that ELBv2 listeners use post-quantum TLS policies