terraform aws_elastic_beanstalk_environment SSL PolicyNames

Question

Using terraform, does anyone know how to set a predefined SSL Security Policy for an ELB, from within the aws_elastic_beanstalk_environment resource?

I've tried various permutations of parameters, branching out from something like the below, but have had no luck. ```

setting {
    name = "PolicyNames"
    namespace = "aws:elb:listener"
    value = "ELBSecurityPolicy-TLS-1-2-2017-01"
}

```

Can this be done using the setting syntax?

regards Michael

Answer 1

Try this:

setting {
    name = "SSLReferencePolicy"
    namespace = "aws:elb:policies:policy_name"
    value = "ELBSecurityPolicy-TLS-1-2-2017-01"
}

SSLReferencePolicy

The name of a predefined security policy that adheres to AWS security best practices and that you want to enable for a SSLNegotiationPolicyType policy that defines the ciphers and protocols that will be accepted by the load balancer. This policy can be associated only with HTTPS/SSL listeners.

Refer:

aws:elb:policies:policy_name

Answer 2

This works:

setting {
    name = "SSLReferencePolicy"
    namespace = "aws:elb:policies:SSLReferencePolicy"
    value = "ELBSecurityPolicy-TLS-1-2-2017-01"
}

Answer 3

Following works for classic ELB, LoadBalancerPorts is also required to set to 443 for the predefined policy to take effect.

setting {
  namespace = "aws:elb:policies:sslpolicy"
  name      = "SSLReferencePolicy"
  value     = "ELBSecurityPolicy-TLS-1-2-2017-01"
}

setting {
  namespace = "aws:elb:policies:sslpolicy"
  name      = "LoadBalancerPorts"
  value     = "443"
}

Answer 4

I finally got an answer from AWS Premium Support:

option_settings:
  aws:elb:listener:
    PolicyNames: sslpolicy
  aws:elb:policies:sslpolicy:
    LoadBalancerPorts: 443
    SSLReferencePolicy: 'ELBSecurityPolicy-TLS-1-2-2017-01'

Basically, aws:elb:policies:policy_name is not a valid namespace, which is why you get an error like "Updating load balancer named: awseb-e-6-AWSEBLoa-QXCM4ZPPQDJF failed Reason: Policy names must only contain alphanumeric characters or dashes" - policy_name needs to replaced with a name of your choice (in my case sslpolicy) and then listed as a policy in the aws:elb:listener namespace. The LoadBalancerPorts entry is needed to make the new SSLReferencePolicy actually take effect.