diff --git a/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/query.rego b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/query.rego index bca984dcf86..d3fe45f03c7 100644 --- a/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/query.rego +++ b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/query.rego @@ -10,6 +10,7 @@ waf_resources := [ CxPolicy[result] { lb := {"aws_alb", "aws_lb"} resource := input.document[i].resource[lb[idx]][name] + is_application_load_balancer(lb[idx], resource) not is_internal_alb(resource) count({x | x := associated_waf(name)}) == 0 @@ -24,6 +25,16 @@ CxPolicy[result] { } } +is_application_load_balancer(lb_type, resource) { + # Both aws_alb and aws_lb with load_balancer_type "application" or not specified (defaults to application) + not resource.load_balancer_type +} + +is_application_load_balancer(lb_type, resource) { + # Both aws_alb and aws_lb with load_balancer_type explicitly set to "application" + resource.load_balancer_type == "application" +} + is_internal_alb(resource) { resource.internal == true } diff --git a/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/negative3.tf b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/negative3.tf new file mode 100644 index 00000000000..93b4548fc31 --- /dev/null +++ b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/negative3.tf @@ -0,0 +1,6 @@ +resource "aws_lb" "nlb" { + name = "test-nlb-tf" + internal = false + load_balancer_type = "network" + subnets = [aws_subnet.public1.id, aws_subnet.public2.id] +} diff --git a/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/negative4.tf b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/negative4.tf new file mode 100644 index 00000000000..c51bc5c7ddc --- /dev/null +++ b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/negative4.tf @@ -0,0 +1,6 @@ +resource "aws_alb" "nlb" { + name = "test-nlb-tf" + internal = false + load_balancer_type = "network" + subnets = [aws_subnet.public1.id, aws_subnet.public2.id] +} diff --git a/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/positive3.tf b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/positive3.tf new file mode 100644 index 00000000000..94754fc46d8 --- /dev/null +++ b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/positive3.tf @@ -0,0 +1,5 @@ +resource "aws_lb" "alb" { + name = "test-lb-tf" + internal = false + subnets = [aws_subnet.public1.id, aws_subnet.public2.id] +} diff --git a/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/positive_expected_result.json b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/positive_expected_result.json index 412dc085a1f..1455e9ae090 100644 --- a/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/positive_expected_result.json +++ b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/positive_expected_result.json @@ -10,5 +10,11 @@ "severity": "MEDIUM", "line": 1, "filename": "positive2.tf" + }, + { + "queryName": "ALB Is Not Integrated With WAF", + "severity": "MEDIUM", + "line": 1, + "filename": "positive3.tf" } ]