ELB HTTPS Listeners Missing

What this rule checks

Detects load balancers with HTTP listeners not redirecting to HTTPS.

How to fix it

1. 1Add HTTPS listener with valid SSL certificate
2. 2Configure HTTP to HTTPS redirect

import { aws_ec2 as ec2, aws_elasticloadbalancingv2 as elbv2 } from 'aws-cdk-lib';

const vpc = new ec2.Vpc(this, 'Vpc');

const alb = new elbv2.ApplicationLoadBalancer(this, 'Alb', { vpc, internetFacing: true });
alb.addListener('Http', {
  port: 80,
  protocol: elbv2.ApplicationProtocol.HTTP,
  defaultAction: elbv2.ListenerAction.fixedResponse(200),
});

import { aws_ec2 as ec2, aws_elasticloadbalancingv2 as elbv2, aws_certificatemanager as acm } from 'aws-cdk-lib';

const vpc = new ec2.Vpc(this, 'Vpc');
const cert = acm.Certificate.fromCertificateArn(this, 'Cert', 'arn:aws:acm:eu-west-2:111122223333:certificate/abc');

const alb = new elbv2.ApplicationLoadBalancer(this, 'Alb', { vpc, internetFacing: true });
alb.addListener('Https', {
  port: 443,
  protocol: elbv2.ApplicationProtocol.HTTPS,
  certificates: [cert],
  defaultAction: elbv2.ListenerAction.fixedResponse(200),
});
alb.addListener('HttpRedirect', {
  port: 80,
  defaultAction: elbv2.ListenerAction.redirect({ protocol: 'HTTPS', port: '443' }),
});

CDK Insights pinpoints the exact file and line in your CDK source for every finding, so you can jump straight to the fix.

Affected resource types

Intentional? Suppress this finding

Sometimes a flag is deliberate — a genuinely public endpoint, say. You can dismiss elb-https-listeners-missing and the reason is kept in the report, not silently hidden.

In .cdk-insights.json:

{
  "ignoreRules": [
    { "id": "elb-https-listeners-missing", "reason": "Why this is intentional" }
  ]
}

Or inline in your CDK code:

Validations.of(scope).acknowledge({
  id: 'cdk-insights::elb-https-listeners-missing',
  reason: 'Why this is intentional',
});

Use the rule ID elb-https-listeners-missing shown above — not the CDK-* ID from SARIF / GitHub code scanning. To dismiss every finding on one construct instead, use ignorePaths. Suppression docs →

More ELB rules