During a pentest of one of our apps running behind an AWS API GW the report showed that the API GW returns a "server awselb/2.0" header, which is identified as a risk by the pentesters. To my knowledge there is no way to remove/suppress such a header, but perhaps I am missing something? Is this something anybody else has ever faced?
can you please update on how did you resolve this?