'ALB SSL Policies are much simpler than ELB (classic) policies.
- Custom policies are not allowed.
- Try to use ELBSecurityPolicy-2016-08
- Alert on unknown policy or if using ELBSecurityPolicy-TLS-1-0-2015-04
- The ELBSecurityPolicy-2016-08 and ELBSecurityPolicy-2015-05 security policies for Application Load Balancers are identical.
http://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html#describe-ssl-policies'

def check_ssl_policy(self, alb):

    supported_ssl_policies = set(['ELBSecurityPolicy-2016-08', 'ELBSecurityPolicy-TLS-1-2-2017-01', 'ELBSecurityPolicy-TLS-1-1-2017-01', 'ELBSecurityPolicy-2015-05', 'ELBSecurityPolicy-TLS-1-0-2015-04'])
    for listener in alb.config.get('Listeners', []):
        port = listener.get('Port')
        ssl_policy = listener.get('SslPolicy')
        if (not ssl_policy):
            continue
        if (ssl_policy == 'ELBSecurityPolicy-TLS-1-0-2015-04'):
            notes = 'Policy    {0}    on    port    {1}'.format(ssl_policy, port)
            self.add_issue(5, 'ELBSecurityPolicy-TLS-1-0-2015-04    contains    a    weaker    cipher    (DES-CBC3-SHA)    for    backwards    compatibility    with    Windows    XP    systems.    Vulnerable    to    SWEET32    CVE-2016-2183.', alb, notes=notes)
        if (ssl_policy not in supported_ssl_policies):
            self.add_issue(10, 'Unknown    reference    policy.', alb, notes=ssl_policy)
