diff --git a/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/query.rego b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/query.rego index bca984dcf86..15514a775e2 100644 --- a/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/query.rego +++ b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/query.rego @@ -11,6 +11,7 @@ CxPolicy[result] { lb := {"aws_alb", "aws_lb"} resource := input.document[i].resource[lb[idx]][name] not is_internal_alb(resource) + not is_nlb(resource) count({x | x := associated_waf(name)}) == 0 result := { @@ -28,6 +29,11 @@ is_internal_alb(resource) { resource.internal == true } +is_nlb(resource) { + non_alb_types := {"network", "gateway"} + non_alb_types[resource.load_balancer_type] +} + associated_waf(name) { waf := input.document[_].resource[waf_resources[_]][_] attribute := waf.resource_arn diff --git a/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/negative3.tf b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/negative3.tf new file mode 100644 index 00000000000..012f9bc96ff --- /dev/null +++ b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/negative3.tf @@ -0,0 +1,6 @@ +resource "aws_lb" "nlb" { + name = "test-nlb-tf" + internal = false + load_balancer_type = "network" + subnets = [for subnet in aws_subnet.public : subnet.id] +}