aws-quickstart | AWS Kubernetes cluster via CloudFormation and kubeadm | AWS library

Installing the LB controller on your cluster is not enough, you need to setup the necessary policy and permission for your controller to interact with ELB.

The link you provided explains this pretty well. Traffic within VPC happens exclusivity within AWS internal network, not over the Internet. As such, its AWS responsibility to ensure its security based on AWS shared responsibility model.

If you believe that AWS is incapable of security its networks and infrastructure, then it does not really matter much if your traffic from LB to targets is encrypted or not. A rough employee, or a random thief, may as well get direct access to your instances, EBS volumes, KMS keys or S3 storage. SSL encryption will not prevent this.

Thus, SSL between LB and targets is generally not applied, unless due to some external requirements which you have no control over. Also take into account that AWS is over a decade old, and so far there hasn't been any publicized security breaches regarding AWS part of shared security model.

From only Error looks like you are using the wrong cloudformation resource. The Type of an application load balancer is AWS::ElasticLoadBalancingV2::LoadBalancer. It has V2 on the end. And the one you are probably using is AWS::ElasticLoadBalancing::LoadBalancer and that creates a classic load balancer.

The error you are getting is due to the difference in the return values for Ref function between classic LB and application LB. But if you post your code I can help more :D