rules:
- id: insecure-load-balancer-tls-version
  patterns:
  - pattern-either:
    - patterns:
      - pattern: ssl_policy = $ANYTHING
      # See: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html#describe-ssl-policies
      - pattern-not-regex: "ELBSecurityPolicy-TLS13-1-[23]-[0-9-]+"
      - pattern-not-regex: "ELBSecurityPolicy-FS-1-2-[(Res)0-9-]+"
    - patterns:
      - pattern: protocol = "HTTP"
      - pattern-not-inside: |
          resource $ANYTHING $NAME {
            ...
            default_action {
              ...
              redirect {
                ...
                protocol = "HTTPS"
                ...
              }
              ...
            }
            ...
          }
  - pattern-inside: |
      resource $RESOURCE $X {
        ...
      }
  - metavariable-pattern:
      metavariable: $RESOURCE
      patterns:
      - pattern-either:
          - pattern: |
              "aws_lb_listener"
          - pattern: |
              "aws_alb_listener"
  message: >-
    Detected an AWS load balancer with an insecure TLS version.
    TLS versions less than 1.2 are considered insecure because they
    can be broken. To fix this, set your `ssl_policy` to
    `"ELBSecurityPolicy-TLS13-1-2-2021-06"`, or include a default action
    to redirect to HTTPS.
  metadata:
    category: security
    technology:
    - terraform
    - aws
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    cwe:
    - 'CWE-326: Inadequate Encryption Strength'
    references:
    - https://www.ietf.org/rfc/rfc5246.txt
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
  languages: [hcl]
  severity: WARNING