Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix CKV2_AWS_20 false positives for NLB listeners on port 80 (TCP) #6945

Open
pingoleon108 opened this issue Jan 9, 2025 · 0 comments
Open
Labels
checks Check additions or changes

Comments

@pingoleon108
Copy link

Describe the issue

Currently, the CKV2_AWS_20 rule uses an AND condition requiring port != 80 and protocol != HTTP for the listener to pass. This causes false failures for cases like a Network Load Balancer (NLB) using TCP on port 80, even though there is no HTTP traffic to redirect. For example, if you configure port=80 but protocol=TCP, the rule incorrectly fails because port != 80 is false, violating the AND logic. Changing it to an OR check—i.e., port != 80 OR protocol != HTTP—would fix the issue and correctly skip the rule when HTTP is not involved.

Examples
Please share an example code sample (in the IaC of your choice) + the expected outcomes.
This code should pass.

resource "aws_lb_listener" "lb_listener" {
load_balancer_arn = aws_lb.lb.arn
port = "80"
protocol = "TCP"

default_action {
type = "forward"
target_group_arn = aws_lb_target_group.lb_tg.arn
}
}

Version (please complete the following information):
(version: 3.2.269)

Additional context
Line 32 should be or

@pingoleon108 pingoleon108 added the checks Check additions or changes label Jan 9, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
checks Check additions or changes
Projects
None yet
Development

No branches or pull requests

1 participant