Desync mitigation mode not configured

Severity: Low
Service: Elastic Load Balancing
Check ID: ELBV1_DESYNC_MITIGATION

What this check finds

Desync mitigation mode protects your application from issues due to HTTP Desync and should be set to 'Strictest'. https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/config-desync-mitigation-mode.html

Passing looks like: Desync mitigation mode configured.

How to fix it

Enable desync mitigation on the Classic Load Balancer and set it to 'strictest'.

AWS CLI

aws elb modify-load-balancer-attributes --load-balancer-name LB_NAME --load-balancer-attributes '{"DesyncMitigationMode":"strictest"}'

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

EC2 → Load Balancers → select Classic LB → Attributes → Edit → Desync mitigation mode.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to Desync mitigation mode not configured
Framework	Controls
SOC 2 — Trust Services Criteria	CC6.4 Network Security Controls
NIST SP 800-53 Rev5 (Moderate)	SC-7 Boundary Protection SI-10 Information Input Validation
NIST Cybersecurity Framework 2.0	PR.IR-01 Networks and environments are protected from unauthorized logical access and usage PR.PS-02 Software is maintained commensurate with risk
ISO/IEC 27001:2022 Annex A	A.8.20 Networks security A.8.26 Application security requirements

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Elastic Load Balancing checks

All Elastic Load Balancing checks