Project: KICS (Provisioning / Security & Compliance)
File: 6e3fd2ed-5c83-4c68-9679-7700d224d379.md

title: ALB Not Dropping Invalid Headers hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 6e3fd2ed-5c83-4c68-9679-7700d224d379 Query name: ALB Not Dropping Invalid Headers Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Best Practices URL: It's considered a best practice when using Application Load Balancers to drop invalid header fields<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1 14" resource "awsalb" "disabled1" { internal = false loadbalancertype = "application" name = "alb" subnets = module.vpc.public_subnets } resource "awsalb" "disabled2" { internal = false loadbalancertype = "application" name = "alb" subnets = module.vpc.public_subnets dropinvalidheader_fields = false } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1 14" resource "awslb" "disabled1" { internal = false loadbalancertype = "application" name = "alb" subnets = module.vpc.public_subnets } resource "awslb" "disabled2" { internal = false loadbalancertype = "application" name = "alb" subnets = module.vpc.public_subnets dropinvalidheader_fields = false } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="1 12" resource "awsalb" "disabled1" { internal = false name = "alb" subnets = module.vpc.public_subnets } resource "awslb" "disabled2" { internal = false name = "alb" subnets = module.vpc.public_subnets dropinvalidheader_fields = false } ``` <details><summary>Positive test num. 4 - tf file</summary> ```tf hl_lines="8" module "alb" { source = "terraform-aws-modules/alb/aws" version = "~> 6.0" name = "my-alb" loadbalancertype = "application" dropinvalidheader_fields = false vpc_id = "vpc-abcde012" subnets = ["subnet-abcde012", "subnet-bcde012a"] security_groups = ["sg-edcd9784", "sg-edcd9785"] access_logs = { bucket = "my-alb-logs" } target_groups = [ { name_prefix = "pref-" backend_protocol = "HTTP" backend_port = 80 target_type = "instance" targets = [ { target_id = "i-0123456789abcdefg" port = 80 }, { target_id = "i-a1b2c3d4e5f6g7h8i" port = 8080 } ] } ] https_listeners = [ { port = 443 protocol = "HTTPS" certificatearn = "arn:aws:iam::123456789012:server-certificate/testcert-123456789012" targetgroupindex = 0 } ] httptcplisteners = [ { port = 80 protocol = "HTTP" targetgroupindex = 0 } ] tags = { Environment = "Test" } } ``` </details> <details><summary>Positive test num. 5 - tf file</summary> ```tf hl_lines="1" module "alb" { source = "terraform-aws-modules/alb/aws" version = "~> 6.0" name = "my-alb" loadbalancertype = "application" vpc_id = "vpc-abcde012" subnets = ["subnet-abcde012", "subnet-bcde012a"] security_groups = ["sg-edcd9784", "sg-edcd9785"] access_logs = { bucket = "my-alb-logs" } target_groups = [ { name_prefix = "pref-" backend_protocol = "HTTP" backend_port = 80 target_type = "instance" targets = [ { target_id = "i-0123456789abcdefg" port = 80 }, { target_id = "i-a1b2c3d4e5f6g7h8i" port = 8080 } ] } ] https_listeners = [ { port = 443 protocol = "HTTPS" certificatearn = "arn:aws:iam::123456789012:server-certificate/testcert-123456789012" targetgroupindex = 0 } ] httptcplisteners = [ { port = 80 protocol = "HTTP" targetgroupindex = 0 } ] tags = { Environment = "Test" } } ``` </details> <details><summary>Positive test

6 - tf file</summary> ```tf hl_lines="1" module "alb" { source = "terraform-aws-modules/alb/aws" version = "~> 6.0" name = "my-alb" vpc_id = "vpc-abcde012" subnets = ["subnet-abcde012", "subnet-bcde012a"] security_groups = ["sg-edcd9784", "sg-edcd9785"] access_logs = { bucket = "my-alb-logs" } target_groups = [ { name_prefix = "pref-" backend_protocol = "HTTP" backend_port = 80 target_type = "instance" targets = [ { target_id = "i-0123456789abcdefg" port = 80 }, { target_id = "i-a1b2c3d4e5f6g7h8i" port = 8080 } ] } ] https_listeners = [ { port = 443 protocol = "HTTPS" certificatearn = "arn:aws:iam::123456789012:server-certificate/testcert-123456789012" targetgroupindex = 0 } ] httptcplisteners = [ { port = 80 protocol = "HTTP" targetgroupindex = 0 } ] tags = { Environment = "Test" } } ``` </details> ```tf title="Negative test num. 1 - tf file" resource "aws_alb" "enabled" { internal = false loadbalancertype = "application" name = "alb" subnets = module.vpc.public_subnets dropinvalidheader_fields = true } ``` ```tf title="Negative test num. 2 - tf file" resource "aws_lb" "enabled" { internal = false loadbalancertype = "application" name = "alb" subnets = module.vpc.public_subnets dropinvalidheader_fields = true } ``` ```tf title="Negative test num. 3 - tf file" resource "aws_alb" "enabled" { internal = false name = "alb" subnets = module.vpc.public_subnets dropinvalidheader_fields = true } resource "aws_lb" "enabled" { internal = false name = "alb" subnets = module.vpc.public_subnets dropinvalidheader_fields = true } ``` <details><summary>Negative test num. 4 - tf file</summary> ```tf module "alb" { source = "terraform-aws-modules/alb/aws" version = "~> 6.0" name = "my-alb" loadbalancertype = "application" dropinvalidheader_fields = true vpc_id = "vpc-abcde012" subnets = ["subnet-abcde012", "subnet-bcde012a"] security_groups = ["sg-edcd9784", "sg-edcd9785"] access_logs = { bucket = "my-alb-logs" } target_groups = [ { name_prefix = "pref-" backend_protocol = "HTTP" backend_port = 80 target_type = "instance" targets = [ { target_id = "i-0123456789abcdefg" port = 80 }, { target_id = "i-a1b2c3d4e5f6g7h8i" port = 8080 } ] } ] https_listeners = [ { port = 443 protocol = "HTTPS" certificatearn = "arn:aws:iam::123456789012:server-certificate/testcert-123456789012" targetgroupindex = 0 } ] httptcplisteners = [ { port = 80 protocol = "HTTP" targetgroupindex = 0 } ] tags = { Environment = "Test" } } ``` </details> <details><summary>Negative test num. 5 - tf file</summary> ```tf module "alb" { source = "terraform-aws-modules/alb/aws" version = "~> 6.0" name = "my-alb" dropinvalidheader_fields = true vpc_id = "vpc-abcde012" subnets = ["subnet-abcde012", "subnet-bcde012a"] security_groups = ["sg-edcd9784", "sg-edcd9785"] access_logs = { bucket = "my-alb-logs" } target_groups = [ { name_prefix = "pref-" backend_protocol = "HTTP" backend_port = 80 target_type = "instance" targets = [ { target_id = "i-0123456789abcdefg" port = 80 }, { target_id = "i-a1b2c3d4e5f6g7h8i" port = 8080 } ] } ] https_listeners = [ { port = 443 protocol = "HTTPS" certificatearn = "arn:aws:iam::123456789012:server-certificate/testcert-123456789012" targetgroupindex = 0 } ] httptcplisteners = [ { port = 80 protocol = "HTTP" targetgroupindex = 0 } ] tags = { Environment = "Test" } } ``` </details>