rules:
- id: functionapp-enable-http2
  message: >-
    Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled
    = true` to your function
    app resource block
  patterns:
  - pattern: resource
  - pattern-not-inside: |
      resource "azurerm_function_app" "..." {
      ...
        site_config {
          ...
          http2_enabled = true
          ...
        }
      ...
      }
  - pattern-either:
    - pattern-inside: |
        resource "azurerm_function_app" "..." {
        ...
        }
    - pattern-inside: |
        resource "azurerm_function_app" "..." {
        ...
          site_config {
            ...
            http2_enabled = false
            ...
          }
        ...
        }
  metadata:
    cwe:
    - "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"
    category: security
    technology:
    - terraform
    - azure
    references:
    - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app#http2_enabled
    owasp:
    - A04:2021 - Insecure Design
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
  languages: [hcl]
  severity: INFO