Repository: Checkmarx/kics (language: python)

Issue:
Terraform ALB Without WAF Should Include wafv2
Associating an aws_wafv2_web_acl to an aws_lb application type does not clear the "ALB Is Not Integrated With WAF" finding. 
EX:
```
resource "aws_lb" "alb" {
  name               = "test-lb-tf"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.lb_sg.id]
  subnets            = [for subnet in aws_subnet.public : subnet.id]
}

resource "aws_wafv2_web_acl" "example" {
  name        = "web-acl-association-example"
  scope       = "REGIONAL"

  default_action {
    allow {}
  }
  
  visibility_config {
    cloudwatch_metrics_enabled = false
    metric_name                = "friendly-metric-name"
    sampled_requests_enabled   = false
  }
}

resource "aws_wafv2_web_acl_association" "alb_waf_association" {
  resource_arn = aws_lb.alb.arn
  web_acl_arn  = aws_wafv2_web_acl.example.arn
}
```

A similar issue #5480 was fixed previously for API Gateway, so more than likely a similar fix should be applied to ALB.
https://github.com/Checkmarx/kics/blob/c73bbc5f28ec59592cd7edd0bb908ed31cd7e211/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/query.rego#L27

### Expected Behavior
No finding should be returned for this.


### Actual Behavior
ALB Is Not Integrated With WAF is still reported after adding the association


### Specifications
This is being reported inside a GitLab KICS SAST scan. 


Discussion / hints:

Fix patch:
diff --git a/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/query.rego b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/query.rego
index 3f0098d019d..bca984dcf86 100644
--- a/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/query.rego
+++ b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/query.rego
@@ -2,11 +2,16 @@ package Cx
 
 import data.generic.terraform as tf_lib
 
+waf_resources := [
+    "aws_wafv2_web_acl_association",
+    "aws_wafregional_web_acl_association",
+]
+
 CxPolicy[result] {
 	lb := {"aws_alb", "aws_lb"}
 	resource := input.document[i].resource[lb[idx]][name]
 	not is_internal_alb(resource)
-	not associated_waf(name)
+	count({x | x := associated_waf(name)}) == 0
 
 	result := {
 		"documentId": input.document[i].id,
@@ -24,7 +29,7 @@ is_internal_alb(resource) {
 }
 
 associated_waf(name) {
-	waf := input.document[_].resource.aws_wafregional_web_acl_association[waf_name]
+	waf := input.document[_].resource[waf_resources[_]][_]
 	attribute := waf.resource_arn
 	attribute_split := split(attribute, ".")
 	options := {"${aws_alb", "${aws_lb"}


Test patch:
diff --git a/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/negative.tf b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/negative1.tf
similarity index 100%
rename from assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/negative.tf
rename to assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/negative1.tf
diff --git a/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/negative2.tf b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/negative2.tf
new file mode 100644
index 00000000000..363bcdeada9
--- /dev/null
+++ b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/negative2.tf
@@ -0,0 +1,12 @@
+resource "aws_lb" "alb" {
+  name               = "test-lb-tf"
+  internal           = false
+  load_balancer_type = "application"
+  security_groups    = [aws_security_group.lb_sg.id]
+  subnets            = [for subnet in aws_subnet.public : subnet.id]
+}
+
+resource "aws_wafv2_web_acl_association" "alb_waf_association" {
+  resource_arn = aws_lb.alb.arn
+  web_acl_arn  = aws_wafv2_web_acl.example.arn
+}
\ No newline at end of file
diff --git a/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/positive.tf b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/positive1.tf
similarity index 100%
rename from assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/positive.tf
rename to assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/positive1.tf
diff --git a/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/positive2.tf b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/positive2.tf
new file mode 100644
index 00000000000..60f8ea2fc87
--- /dev/null
+++ b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/positive2.tf
@@ -0,0 +1,12 @@
+resource "aws_lb" "alb" {
+  name               = "test-lb-tf"
+  internal           = false
+  load_balancer_type = "application"
+  security_groups    = [aws_security_group.lb_sg.id]
+  subnets            = [for subnet in aws_subnet.public : subnet.id]
+}
+
+resource "aws_wafv2_web_acl_association" "alb_waf_association" {
+  resource_arn = aws_lb.alba.arn
+  web_acl_arn  = aws_wafv2_web_acl.example.arn
+}
\ No newline at end of file
diff --git a/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/positive_expected_result.json b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/positive_expected_result.json
index c447e1598d4..412dc085a1f 100644
--- a/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/positive_expected_result.json
+++ b/assets/queries/terraform/aws/alb_is_not_integrated_with_waf/test/positive_expected_result.json
@@ -2,6 +2,13 @@
   {
     "queryName": "ALB Is Not Integrated With WAF",
     "severity": "MEDIUM",
-    "line": 1
+    "line": 1,
+    "filename": "positive1.tf"
+  },
+  {
+    "queryName": "ALB Is Not Integrated With WAF",
+    "severity": "MEDIUM",
+    "line": 1,
+    "filename": "positive2.tf"
   }
 ]