feat(aws): add elbv2_listener_pqc_tls_enabled security check - #11254
Merged
Conversation
github-actions
Bot
added
documentation
provider/aws
HugoPBrito
pushed a commit
that referenced
this pull request
May 20, 2026
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
Contributor
|
✅ No Conflicts No conflict markers, and the branch merges cleanly into its base. |
Contributor
|
✅ All required changelog fragments are present. |
Contributor
Compliance Mapping ReviewThis PR adds new checks. Please verify that they have been mapped to the relevant compliance framework requirements. New checks already mapped in this PR
Use the |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #11254 +/- ##
===========================================
- Coverage 93.99% 11.30% -82.70%
===========================================
Files 267 1012 +745
Lines 39781 35925 -3856
===========================================
- Hits 37391 4060 -33331
- Misses 2390 31865 +29475
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
Contributor
🔒 Container Security ScanImage: ✅ No Vulnerabilities DetectedThe container image passed all security checks. No known CVEs were found.📋 Resources:
|
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds a configurable AWS ELBv2 check for post-quantum TLS policies, listener-discovery failure tracking, check metadata, configuration schema and defaults, documentation, changelog content, and comprehensive ALB/NLB tests. ChangesELBv2 PQ TLS compliance
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant ELBv2Service
participant PQTLSCheck
participant AWSConfig
participant CheckReportAWS
ELBv2Service->>PQTLSCheck: provide load balancers and listeners
PQTLSCheck->>AWSConfig: read allowed PQ TLS policies
PQTLSCheck->>CheckReportAWS: emit PASS or FAIL finding
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
🔒 Container Security ScanImage: ✅ No Vulnerabilities DetectedThe container image passed all security checks. No known CVEs were found.📋 Resources:
|
HugoPBrito
force-pushed
the
feat/elbv2-listener-pqc-tls-enabled
branch
from
July 14, 2026 10:30
541d266 to
b753d90
Compare
HugoPBrito
marked this pull request as ready for review
July 14, 2026 11:43
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
HugoPBrito
force-pushed
the
feat/elbv2-listener-pqc-tls-enabled
branch
from
July 14, 2026 12:06
b753d90 to
b2d5b24
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@prowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.py`:
- Around line 59-83: Update the report handling in the listener evaluation flow
so every load balancer produces exactly one PASS or FAIL report. In the
lb.listener_discovery_failed branch, replace the MANUAL status with an
appropriate FAIL status while preserving the failure details and append
behavior. For load balancers with no TLS listeners, set an appropriate PASS
status and clear status_extended, append the report, then continue without
creating a second report.
In
`@tests/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled_test.py`:
- Around line 302-345: Add a new FAIL test alongside
test_listener_with_classical_tls_policy_fail and
test_listener_with_legacy_policy_fail that creates an HTTPS listener with an
empty SslPolicy, executes the check, and asserts status_extended identifies the
listener with “uses <none>”. Preserve the existing result, resource, and region
assertions as appropriate for this fallback case.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 68b61c16-6ce7-43a8-8998-bb5543e78e3b
⛔ Files ignored due to path filters (13)
prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/ccc_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/ens_rd2022_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/fedramp_moderate_revision_4_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/ffiec_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/gxp_21_cfr_part_11_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/iso27001_2013_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/kisa_isms_p_2023_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/kisa_isms_p_2023_korean_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/nist_800_171_revision_2_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/nist_800_53_revision_5_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/rbi_cyber_security_framework_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/secnumcloud_3.2_aws.jsonis excluded by!prowler/compliance/**/*.json
📒 Files selected for processing (12)
docs/user-guide/cli/tutorials/configuration_file.mdxprowler/changelog.d/elbv2-listener-pqc-tls-enabled.added.mdprowler/config/config.yamlprowler/config/schema/aws.pyprowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/__init__.pyprowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.metadata.jsonprowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.pyprowler/providers/aws/services/elbv2/elbv2_service.pytests/config/config_test.pytests/config/fixtures/config.yamltests/config/schema/aws_schema_test.pytests/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled_test.py
HugoPBrito
force-pushed
the
feat/elbv2-listener-pqc-tls-enabled
branch
from
July 14, 2026 12:21
b2d5b24 to
aadd1a6
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@prowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.py`:
- Around line 7-19: Update the PQ_TLS_POLICIES_DEFAULT allowlist to include
ELBSecurityPolicy-TLS13-1-0-PQ-2025-09 and
ELBSecurityPolicy-TLS13-1-0-FIPS-PQ-2025-09, preserving the existing policy
entries and ordering convention.
In
`@tests/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled_test.py`:
- Around line 108-169: Merge _mock_and_execute_with_audit_config into
_mock_and_execute by adding an optional audit_config=None parameter and passing
it through to both set_mocked_aws_provider calls. Update all callers of
_mock_and_execute_with_audit_config to call _mock_and_execute(audit_config=...),
then remove the duplicate helper.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 120d753e-e480-4084-b430-d8742c3cd00a
⛔ Files ignored due to path filters (13)
prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/ccc_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/ens_rd2022_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/fedramp_moderate_revision_4_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/ffiec_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/gxp_21_cfr_part_11_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/iso27001_2013_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/kisa_isms_p_2023_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/kisa_isms_p_2023_korean_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/nist_800_171_revision_2_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/nist_800_53_revision_5_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/rbi_cyber_security_framework_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/secnumcloud_3.2_aws.jsonis excluded by!prowler/compliance/**/*.json
📒 Files selected for processing (12)
docs/user-guide/cli/tutorials/configuration_file.mdxprowler/changelog.d/elbv2-listener-pqc-tls-enabled.added.mdprowler/config/config.yamlprowler/config/schema/aws.pyprowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/__init__.pyprowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.metadata.jsonprowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.pyprowler/providers/aws/services/elbv2/elbv2_service.pytests/config/config_test.pytests/config/fixtures/config.yamltests/config/schema/aws_schema_test.pytests/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled_test.py
HugoPBrito
force-pushed
the
feat/elbv2-listener-pqc-tls-enabled
branch
from
July 15, 2026 08:05
aadd1a6 to
105c491
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/config/schema/aws_schema_test.py`:
- Around line 179-205: Rename the test class
Test_AWS_ELBv2_PQC_TLS_Allowed_Policies to TestAWSELBv2PQCTLSAllowedPolicies,
preserving all existing test methods and behavior.
In
`@tests/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled_test.py`:
- Around line 531-573: Add a test alongside
test_tls_listener_with_pq_policy_pass and
test_tls_listener_with_non_pq_policy_fail that creates an NLB with only a TCP
listener, executes _mock_and_execute, and asserts PASS with the expected “no
HTTPS/TLS listeners” status message. Also verify the result identifies my-nlb
and its load balancer ARN.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: c5f7c746-c329-4b3e-92ed-c15d84c76a0f
⛔ Files ignored due to path filters (13)
prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/ccc_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/ens_rd2022_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/fedramp_moderate_revision_4_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/ffiec_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/gxp_21_cfr_part_11_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/iso27001_2013_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/kisa_isms_p_2023_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/kisa_isms_p_2023_korean_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/nist_800_171_revision_2_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/nist_800_53_revision_5_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/rbi_cyber_security_framework_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/secnumcloud_3.2_aws.jsonis excluded by!prowler/compliance/**/*.json
📒 Files selected for processing (12)
docs/user-guide/cli/tutorials/configuration_file.mdxprowler/changelog.d/elbv2-listener-pqc-tls-enabled.added.mdprowler/config/config.yamlprowler/config/schema/aws.pyprowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/__init__.pyprowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.metadata.jsonprowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.pyprowler/providers/aws/services/elbv2/elbv2_service.pytests/config/config_test.pytests/config/fixtures/config.yamltests/config/schema/aws_schema_test.pytests/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled_test.py
- Add configurable post-quantum TLS policy validation - Emit one PASS or FAIL report per load balancer - Add config schema coverage and SDK tests
HugoPBrito
force-pushed
the
feat/elbv2-listener-pqc-tls-enabled
branch
from
July 15, 2026 08:14
105c491 to
2b86c77
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@prowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.metadata.json`:
- Line 30: Update the remediation text in the metadata entry to reference the
configured allowed PQ policy names or allowlist rather than the entire
ELBSecurityPolicy-TLS13-*-PQ-2025-09 family. Ensure the guidance only recommends
policies accepted by the default allowlist and preserves the existing migration
and periodic-review intent.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 18cbcbe6-596c-4fbd-9660-0990eeb1e2d7
⛔ Files ignored due to path filters (13)
prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/ccc_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/ens_rd2022_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/fedramp_moderate_revision_4_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/ffiec_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/gxp_21_cfr_part_11_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/iso27001_2013_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/kisa_isms_p_2023_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/kisa_isms_p_2023_korean_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/nist_800_171_revision_2_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/nist_800_53_revision_5_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/rbi_cyber_security_framework_aws.jsonis excluded by!prowler/compliance/**/*.jsonprowler/compliance/aws/secnumcloud_3.2_aws.jsonis excluded by!prowler/compliance/**/*.json
📒 Files selected for processing (12)
docs/user-guide/cli/tutorials/configuration_file.mdxprowler/changelog.d/elbv2-listener-pqc-tls-enabled.added.mdprowler/config/config.yamlprowler/config/schema/aws.pyprowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/__init__.pyprowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.metadata.jsonprowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled.pyprowler/providers/aws/services/elbv2/elbv2_service.pytests/config/config_test.pytests/config/fixtures/config.yamltests/config/schema/aws_schema_test.pytests/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/elbv2_listener_pqc_tls_enabled_test.py
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
"Harvest now, decrypt later" attacks capture TLS-encrypted traffic today with the intent to decrypt it once a cryptographically relevant quantum computer becomes available. Without post-quantum (PQ) TLS policies on ELBv2 listeners, sensitive data, credentials, and session tokens passing through load balancers are vulnerable to this forward-looking threat. AWS has published the
ELBSecurityPolicy-TLS13-*-PQ-2025-09policy family that adds hybrid key exchange (ML-KEM 768 + classical ECDHE), but the existing Prowler checkelbv2_insecure_ssl_ciphersfolds PQ policies into its generic "secure" allowlist without surfacing PQ readiness as a distinct signal.Description
This check evaluates every ELBv2 HTTPS (ALB) or TLS (NLB) listener's
SslPolicyagainst a configurable allowlist of post-quantum TLS policies. A load balancer passes when all its HTTPS/TLS listeners use a PQ policy from the approved set, and fails when any listener uses a policy outside that set — including modern but classical-only policies likeELBSecurityPolicy-TLS13-1-2-2021-06. HTTP listeners and non-TLS NLB listeners are skipped (no TLS termination). The PQ allowlist is configurable viaelbv2_listener_pqc_tls_allowed_policiesinaws_audit_configto accommodate future AWS policy releases. Remediation is to switch affected listeners toELBSecurityPolicy-TLS13-1-2-PQ-2025-09or another approved PQ policy.Steps to review
prowler/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/prowler/compliance/aws/to ensure the check is correctly mapped to relevant requirementspoetry run pytest tests/providers/aws/services/elbv2/elbv2_listener_pqc_tls_enabled/ -vChecklist
Community Checklist
SDK/CLI
License
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
Summary by CodeRabbit