It appears AWS lets you configure this[1]. You may have chosen a policy and never changed it. A note on that page says if you don't choose a policy, you'll always use the latest one. It looks like you can create a custom one, as well.

[1]http://docs.aws.amazon.com/ElasticLoadBalancing/latest/Devel...

Use these services as tcp load balancers and terminate SSL on your backends.

Using a LB to offload SSL termination might seem like a good idea (you save a bit of CPU, really not more than a few percent in practice), but you expose your customer traffic to capture/inspection between the LB and your backends. This network can span multiple hops or even datacenters.

Also, when the next openssl vuln hits, you can patch your setup in no time and do not need to wait for the LBs to be patched at your vendor's will.

rc4 may be "bad", but if you notice, it is so densely deployed on clients, it's hard to avoid.