rules:
  - id: missing-alb-drop-http-headers
    severity: WARNING
    languages: [hcl]
    message: >-
      Detected a AWS load balancer that is not configured to drop
      invalid HTTP headers. Add `drop_invalid_header_fields = true`
      in your resource block.
    metadata:
      category: best-practice
      technology:
        - aws
        - terraform
    patterns:
      - pattern-either:
          - pattern: |
              resource "aws_lb" $ENABLED {
                ...
              }
          - pattern: |
              resource "aws_alb" $ENABLED {
                ...
              }
      - pattern-not-inside: |
          resource $ANYTHING $ENABLED {
            ...
            drop_invalid_header_fields = true
            ...
          }