fix(terraform): exclude NLBs and GWLBs from ALB WAF integration check#7975
Open
cx-ori-bendet wants to merge 1 commit intomasterfrom
Open
fix(terraform): exclude NLBs and GWLBs from ALB WAF integration check#7975cx-ori-bendet wants to merge 1 commit intomasterfrom
cx-ori-bendet wants to merge 1 commit intomasterfrom
Conversation
Network Load Balancers (load_balancer_type = "network") and Gateway Load Balancers (load_balancer_type = "gateway") do not support WAF integration, so the "ALB Is Not Integrated With WAF" rule should only apply to Application Load Balancers. Add is_nlb() helper (mirroring is_internal_alb()) and exclude non-ALB resources from the CxPolicy condition. Add a negative test case for an NLB without WAF to cover this scenario. Fixes #7964 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
github-actions
bot
added
community
Contributor
|
KICS version: v2.1.18
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
load_balancer_type = "network") and Gateway Load Balancers (load_balancer_type = "gateway") do not support AWS WAF integration — only Application Load Balancers doaws_lb/aws_albresource without a WAF association regardless of type, producing false positives for NLBsis_nlb()helper (mirroring the existingis_internal_alb()pattern) that returns true for"network"and"gateway"load balancer typesnot is_nlb(resource)condition toCxPolicyso only ALBs are checkednegative3.tftest case: an NLB without WAF that should produce no findingFixes #7964
Test plan
aws_lbwithload_balancer_type = "network"and no WAF — should produce no findingaws_lbwithload_balancer_type = "application"and no WAF — should still produce a findingaws_lbwith noload_balancer_typeset (defaults to application) and no WAF — should still produce a findinggo test ./test/... -run TestQueriesto verify all query tests passI submit this contribution under the Apache-2.0 license.
🤖 Generated with Claude Code