Repository: aquasecurity/tfsec
Pull request #1083 (2021-09-21 18:13:09)

Added cloudfront_default_certificate check to aws-cloudfront-use-secure-tls-policy rule
Proposed fix for issue #1082 

CLAassistant: [![CLA assistant check](https://cla-assistant.io/pull/badge/not_signed)](https://cla-assistant.io/aquasecurity/tfsec?pullRequest=1083) <br/>Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our [Contributor License Agreement](https://cla-assistant.io/aquasecurity/tfsec?pullRequest=1083) before we can accept your contribution.<br/><sub>You have signed the CLA already but the status is still pending? Let us [recheck](https://cla-assistant.io/check/aquasecurity/tfsec?pullRequest=1083) it.</sub>

Patch:
diff --git a/internal/app/tfsec/rules/aws/cloudfront/use_secure_tls_policy_rule.go b/internal/app/tfsec/rules/aws/cloudfront/use_secure_tls_policy_rule.go
index 8019c56c8..aef46ffa5 100644
--- a/internal/app/tfsec/rules/aws/cloudfront/use_secure_tls_policy_rule.go
+++ b/internal/app/tfsec/rules/aws/cloudfront/use_secure_tls_policy_rule.go
@@ -29,7 +29,7 @@ You should not use outdated/insecure TLS versions for encryption. You should be
 			BadExample: []string{`
 resource "aws_cloudfront_distribution" "bad_example" {
   viewer_certificate {
-    cloudfront_default_certificate = true
+    cloudfront_default_certificate = false
     minimum_protocol_version = "TLSv1.0"
   }
 }
@@ -37,7 +37,7 @@ resource "aws_cloudfront_distribution" "bad_example" {
 			GoodExample: []string{`
 resource "aws_cloudfront_distribution" "good_example" {
   viewer_certificate {
-    cloudfront_default_certificate = true
+    cloudfront_default_certificate = false
     minimum_protocol_version = "TLSv1.2_2021"
   }
 }
@@ -60,6 +60,11 @@ resource "aws_cloudfront_distribution" "good_example" {
 				return
 			}
 
+			defaultCertificateAttr := viewerCertificateBlock.GetAttribute("cloudfront_default_certificate")
+			if defaultCertificateAttr.IsTrue() {
+				return
+			}
+
 			minVersionAttr := viewerCertificateBlock.GetAttribute("minimum_protocol_version")
 			if minVersionAttr.IsNil() {
 				set.AddResult().


Test patch:
diff --git a/internal/app/tfsec/rules/aws/cloudfront/use_secure_tls_policy_rule_test.go b/internal/app/tfsec/rules/aws/cloudfront/use_secure_tls_policy_rule_test.go
index a0f5f3bc5..c1cd2f357 100644
--- a/internal/app/tfsec/rules/aws/cloudfront/use_secure_tls_policy_rule_test.go
+++ b/internal/app/tfsec/rules/aws/cloudfront/use_secure_tls_policy_rule_test.go
@@ -28,7 +28,7 @@ resource "aws_cloudfront_distribution" "s3_distribution" {
 			source: `
 resource "aws_cloudfront_distribution" "s3_distribution" {
   viewer_certificate {
-    cloudfront_default_certificate = true
+    cloudfront_default_certificate = false
   }
 }`,
 			mustIncludeResultCode: expectedCode,
@@ -38,12 +38,22 @@ resource "aws_cloudfront_distribution" "s3_distribution" {
 			source: `
 resource "aws_cloudfront_distribution" "s3_distribution" {
   viewer_certificate {
-    cloudfront_default_certificate = true
+    cloudfront_default_certificate = false
 	minimum_protocol_version = "TLSv1.2_2018"
   }
 }`,
 			mustIncludeResultCode: expectedCode,
 		},
+		{
+			name: "check don't trigger if cloudfront_default_certificate is set to true",
+			source: `
+resource "aws_cloudfront_distribution" "s3_distribution" {
+  viewer_certificate {
+    cloudfront_default_certificate = true
+  }
+}`,
+			mustExcludeResultCode: expectedCode,
+		},
 	}
 
 	for _, test := range tests {