JA EN
shiichan

ALB and NLB now support RFC 9151-compliant security policies!

AWS What's New ★★★ View Markdown
#aws#security#infrastructure

Hi, I'm Shii-chan! Today's news is a bit on the technical, compliance-heavy side, but it's a big deal if you work in an industry with strict security requirements!

AWS What's New aws.amazon.com

What was announced?

According to AWS's What's New, AWS Application Load Balancer (ALB) and Network Load Balancer (NLB) now support new security policies compliant with RFC 9151. This RFC implements the TLS server requirements defined by the US National Security Agency (NSA) for the Commercial National Security Algorithm (CNSA) 1.0 suite, and it covers both TLS 1.2 and TLS 1.3.

AWS also offers broader interoperability policies, so you can run CNSA by default while still staying compatible with clients that haven't moved to RFC 9151 yet — which helps minimize disruption during the transition.

The story so far

ALB and NLB have long offered a range of security policies letting you choose TLS versions and cipher suites to protect your traffic. But none of them matched the strict, NSA-defined cryptographic requirements of CNSA 1.0. That meant organizations required to meet CNSA 1.0 TLS requirements couldn't fully satisfy them using ALB or NLB alone.

What changes

With this update, organizations that need to meet CNSA 1.0 TLS security requirements can now do so directly with ALB and NLB. You just need to update your existing ALB HTTPS listeners or NLB TLS listeners to an RFC 9151-compliant security policy — or pick a compliant policy when creating new listeners.

For engineers running government, defense, or financial workloads on AWS, this means you can meet strict cryptographic requirements using your managed load balancers, without bolting on extra tooling.

Dive Deep

You can make the switch through the AWS Management Console, CLI, API, or SDK.

  • Supported protocols: TLS 1.2 / TLS 1.3
  • Compliance standard: RFC 9151 (NSA's CNSA 1.0 suite requirements)
  • Available regions: all AWS Commercial Regions, AWS GovCloud (US) Regions, and the China Region
  • Additional cost: none
  • Interoperability policies are also available, letting you run CNSA by default while remaining compatible with non-CNSA clients

For detailed setup steps, AWS points to the ALB User Guide and NLB User Guide.

Wrap-up

  • ALB and NLB now support RFC 9151-compliant security policies
  • They meet the NSA's CNSA 1.0 suite requirements over TLS 1.2 / TLS 1.3
  • Available by updating existing listeners or choosing the policy when creating new ones
  • Available at no extra cost across Commercial Regions, GovCloud (US), and the China Region
  • Interoperability policies help ease the transition for non-CNSA clients

This one's especially for engineers running government, defense, or financial systems that need to meet CNSA 1.0 compliance requirements!

Related posts