AWS First Steps
New feature

AWS Application and Network Load Balancers now support RFC 9151 compliant security policies

AWS Application Load Balancer and Network Load Balancer now support new TLS-based security policies compliant with RFC 9151 for CNSA 1.0 requirements, enabling compatibility with both CNSA and non-CNSA clients during transition.

AWS Application Load Balancer (ALB) and Network Load Balancer (NLB) now support new TLS-based security policies that comply with RFC 9151 TLS server requirements for Commercial National Security Algorithm (CNSA) 1.0 suite requirements. These policies implement cryptographic requirements defined by the US National Security Agency (NSA) for secure communications using TLS 1.2 and TLS 1.3 protocols. Customers required to meet CNSA 1.0 TLS security requirements can now use ALB and NLB with RFC 9151 compliant security policies. Broader interoperability policies are also supported, allowing you to implement CNSA by default while maintaining compatibility with non-CNSA clients during their transition to RFC 9151 compliance, minimizing service disruption. This feature is available for ALB and NLB in all AWS Commercial Regions, AWS GovCloud (US) Regions, and the China region at no additional cost. To use this capability, update existing ALB HTTPS listeners or NLB TLS listeners to an RFC 9151 compliant security policy, or select a compliant policy when creating new listeners through the AWS Management Console, CLI, API, or SDK.

Read the original AWS announcement

Related articles and terms

Elastic Load BalancingA load balancer service that automatically distributes incoming traffic across multiple targets, available in four types: ALB, NLB, GLB, and CLBWhy ELB Has Three Types - The Design Rationale Behind ALB, NLB, and CLBExplore why ALB, NLB, and CLB (Classic) coexist rather than being unified into a single service, examining OSI model layers, performance characteristics, and historical context.Centralized Security Rules with AWS Firewall Manager - Deploying WAF and Security Groups Across Your OrganizationLearn how to centrally manage WAF rules, Security Groups, and Network Firewall policies across your entire organization, with automatic enforcement on new accounts to maintain a consistent security baseline.Why Is the Default VPC CIDR /16? - IP Address Design Trivia and Common PitfallsLearn why the default VPC CIDR is set to /16, the history of RFC 1918 private address space, the 5 reserved IP addresses in each subnet, and common CIDR design mistakes.Security Posture Management - Building a Unified Security Monitoring Foundation with AWS Security HubLearn about unified security monitoring with AWS Security Hub and automated threat detection through GuardDuty integration. This guide covers visualizing compliance with security best practices and security governance for multi-account environments.