title: How to implement HTTP Strict Transport Security (HSTS) on AWS Elastic Load Balancer?
body: <p>I would like to implement HSTS to my application.</p>
  
  <p>I have an ELB terminating SSL and forwarding the traffic to my application, which is an apache server used as reverse proxy. </p>
  
  <p>I know that in order to implement HSTS, I would need to add the header Strict-Transport-Security to my request.</p>
  
  <p>Unfortunately, it seems that I cannot implement it on my Apache server as it would have to be added to the HTTPS Virtual Host and my Apache only has the http virtual host configured, since the SSL is terminated on the ELB.</p>
  
  <p>That means that the ELB would have to add the header Strict-Transport-Security to the request when it pass it forward.</p>
  
  <p>How do I do that? Can I add some sort of security policy that would do that for me?</p>