AWS Load Balancers Add RFC 9151 CNSA Policies
Defense contractors can now enforce NSA-grade TLS at the load-balancer layer, no custom termination required.
TL;DR
AWS Application Load Balancer and Network Load Balancer now support TLS security policies compliant with RFC 9151, the CNSA 1.0 cryptographic requirements defined by the NSA. Available in GovCloud and all commercial regions at no added cost. The policies come in two flavors: strict RFC 9151 enforcement, and interoperability policies that default to CNSA while accommodating non-CNSA clients during transition. For defense contractors running GovCloud workloads, this removes the friction of DIY TLS termination to meet NSA cipher mandates.
Pick an RFC 9151 security policy from the ALB or NLB listener dropdown and CNSA 1.0 cipher enforcement is handled at the load balancer. No backend TLS reconfiguration, no sidecar proxies, no custom termination on EC2. For defense contractors who've been meeting NSA cipher requirements at the application layer, the work collapses into a console field.
The policies ship in two categories. Strict policies enforce full RFC 9151: only CNSA-approved ciphers, TLS 1.2 and 1.3, no downgrade. Interoperability policies negotiate CNSA by default but fall back for clients that haven't migrated yet. In practice that second tier matters: a defense contractor's public-facing application has to serve both CNSA-compliant agency clients and commercial partners who won't speak CNSA on day one. The two-tier design gives operators a migration path instead of a hard cutover. Adopt CNSA now, tighten later when client populations catch up.
This fills the remaining gap in AWS's compliance policy stack. ALB and NLB already offered FIPS 140-3 validated TLS policies since November 2023 and hybrid post-quantum key exchange via ML-KEM since November 2025. CNSA 1.0 was the missing piece for workloads subject to NSA requirements under CNSS policies. The feature is live in GovCloud and all commercial regions at no additional cost. No premium tier, no compliance SKU upcharge. Update listener policies through the console, CLI, API, or SDK.
Published ·Deep Fathom