Using plain HTTP is insecure, as it transmits data in an unencrypted and readable format. This weakness exposes data to potential eavesdropping.

Recommendation

Only allow HTTPS for Load Balancer. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener

Metadata

• Severity: informational
• Slug: loadbalancer-http-allowed

CWEs

• 319: Cleartext Transmission of Sensitive Information