Project: KICS (Provisioning / Security & Compliance)
File: de7f5e83-da88-4046-871f-ea18504b1d43.md

title: ALB Listening on HTTP hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: de7f5e83-da88-4046-871f-ea18504b1d43 Query name: ALB Listening on HTTP Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Networking and Firewall URL: AWS Application Load Balancer (alb) should not listen on HTTP<br> ```tf title="Positive test num. 1 - tf file" hl_lines="9" resource "awslblistener" "listener5" { loadbalancerarn = aws_lb.test3.arn port = 80 default_action { type = "redirect" redirect { port = "80" protocol = "HTTP" statuscode = "HTTP301" } } } resource "aws_lb" "test3" { name = "test123" loadbalancertype = "application" subnets = [awssubnet.subnet1.id, awssubnet.subnet2.id] internal = true } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="70" provider "aws" { profile = "default" region = "us-west-2" } data "awsavailabilityzones" "available" { state = "available" } data "aws_ami" "ubuntu" { most_recent = true filter { name = "name" values = ["ubuntu/images/hvm-ssd/ubuntu-xenial-16.04-amd64-server-*"] } filter { name = "virtualization-type" values = ["hvm"] } owners = ["099720109477"] # Canonical } resource "aws_vpc" "vpc1" { cidr_block = "10.10.0.0/16" } resource "aws_subnet" "subnet1" { vpcid = awsvpc.vpc1.id cidr_block = "10.10.10.0/24" availabilityzoneid = data.awsavailabilityzones.available.zone_ids[0] tags = { Name = "subnet1" } } resource "aws_subnet" "subnet2" { vpcid = awsvpc.vpc1.id cidr_block = "10.10.11.0/24" availabilityzoneid = data.awsavailabilityzones.available.zone_ids[1] tags = { Name = "subnet2" } } resource "aws_lb" "test" { name = "test123" loadbalancertype = "application" subnets = [awssubnet.subnet1.id, awssubnet.subnet2.id] internal = true } resource "awslbtarget_group" "test" { port = 80 protocol = "HTTP" target_type = "instance" vpcid = awsvpc.vpc1.id } resource "awsdefaultsecurity_group" "dsg" { vpcid = awsvpc.vpc1.id } resource "awslblistener" "listener" { loadbalancerarn = aws_lb.test.arn port = 80 default_action { type = "forward" targetgrouparn = awslbtarget_group.test.arn } } resource "awslbtargetgroupattachment" "attach1" { targetgrouparn = awslbtarget_group.test.arn targetid = awsinstance.inst1.id port = 80 } resource "aws_instance" "inst1" { vpcsecuritygroupids = [awsdefaultsecuritygroup.dsg.id] subnetid = awssubnet.subnet1.id ami = data.aws_ami.ubuntu.id instance_type = "t3.micro" } resource "awslbtargetgroupattachment" "attach2" { targetgrouparn = awslbtarget_group.test.arn targetid = awsinstance.inst2.id port = 80 } resource "aws_instance" "inst2" { vpcsecuritygroupids = [awsdefaultsecuritygroup.dsg.id] subnetid = awssubnet.subnet1.id ami = data.aws_ami.ubuntu.id instance_type =

} resource "awslbtargetgroupattachment" "attach3" { targetgrouparn = awslbtarget_group.test.arn targetid = awsinstance.inst3.id port = 80 } resource "aws_instance" "inst3" { vpcsecuritygroupids = [awsdefaultsecuritygroup.dsg.id] subnetid = awssubnet.subnet1.id ami = data.aws_ami.ubuntu.id instance_type = "t3.micro" } ``` ```tf title="Negative test num. 1 - tf file" resource "awslblistener" "listener55" { loadbalancerarn = aws_lb.test33.arn port = 80 default_action { type = "redirect" redirect { port = "80" protocol = "HTTPS" statuscode = "HTTPS301" } } } resource "aws_lb" "test33" { name = "test123" loadbalancertype = "application" subnets = [awssubnet.subnet1.id, awssubnet.subnet2.id] internal = true } ``` ```tf title="Negative test num. 2 - tf file" provider "aws2" { profile = "default" region = "us-west-2" } data "awsavailabilityzones" "available2" { state = "available" } data "aws_ami" "ubuntu2" { most_recent = true filter { name = "name" values = ["ubuntu/images/hvm-ssd/ubuntu-xenial-16.04-amd64-server-*"] } filter { name = "virtualization-type" values = ["hvm"] } owners = ["099720109477"] # Canonical } resource "aws_vpc" "vpc1" { cidr_block = "10.10.0.0/16" } resource "aws_subnet" "subnet12" { vpcid = awsvpc.vpc1.id cidr_block = "10.10.10.0/24" availabilityzoneid = data.awsavailabilityzones.available2.zone_ids[0] tags = { Name = "subnet1" } } resource "aws_subnet" "subnet22" { vpcid = awsvpc.vpc1.id cidr_block = "10.10.11.0/24" availabilityzoneid = data.awsavailabilityzones.available2.zone_ids[1] tags = { Name = "subnet2" } } resource "aws_lb" "test2" { name = "test123" loadbalancertype = "application" subnets = [awssubnet.subnet12.id, awssubnet.subnet22.id] internal = true } resource "awslbtarget_group" "test2" { port = 80 protocol = "HTTP" target_type = "instance" vpcid = awsvpc.vpc1.id } resource "awsdefaultsecurity_group" "dsg2" { vpcid = awsvpc.vpc1.id } resource "awslblistener" "listener2" { loadbalancerarn = aws_lb.test2.arn protocol = "HTTPS" port = 80 default_action { type = "forward" targetgrouparn = awslbtarget_group.test2.arn } } resource "awslbtargetgroupattachment" "attach12" { targetgrouparn = awslbtarget_group.test2.arn targetid = awsinstance.inst12.id port = 80 } resource "aws_instance" "inst12" { vpcsecuritygroupids = [awsdefaultsecuritygroup.dsg2.id] subnetid = awssubnet.subnet12.id ami = data.aws_ami.ubuntu2.id instance_type = "t3.micro" } resource "awslbtargetgroupattachment" "attach22" { targetgrouparn = awslbtarget_group.test2.arn targetid = awsinstance.inst22.id port = 80 } resource "aws_instance" "inst22" { vpcsecuritygroupids = [awsdefaultsecuritygroup.dsg2.id] subnetid = awssubnet.subnet12.id ami = data.aws_ami.ubuntu2.id instance_type = "t3.micro" } resource "awslbtargetgroupattachment" "attach32" { targetgrouparn = awslbtarget_group.test2.arn targetid = awsinstance.inst32.id port = 80 } resource "aws_instance" "inst32" { vpcsecuritygroupids = [awsdefaultsecuritygroup.dsg2.id] subnetid = awssubnet.subnet12.id ami = data.aws_ami.ubuntu2.id instance_type = "t3.micro" } ```