Description

Detects when AWS Elastic Load Balancer (ELB) target groups are configured to use insecure HTTP protocol instead of HTTPS. Using unencrypted HTTP protocol can expose sensitive data to man-in-the-middle attacks and eavesdropping during transit.

Detection Strategy

• Examines Terraform configurations for 'aws_lb_target_group' resource definitions

• Checks if the target group protocol is set to HTTP instead of HTTPS

• Reports a vulnerability when unencrypted HTTP protocol is used in the target group configuration

• Triggers on any AWS Load Balancer target group that doesn't enforce HTTPS communication

Vulnerable code example

resource "aws_lb_target_group" "example" {
  name        = "my-target-group"
  protocol    = "HTTP"  # Vulnerable: Using unencrypted HTTP instead of HTTPS
  port        = 80
  vpc_id      = aws_vpc.main.id
}

✅ Secure code example

resource "aws_lb_target_group" "example" {
  name        = "my-target-group"
  protocol    = "HTTPS"  # Fixed: Using encrypted HTTPS protocol for secure communication
  port        = 443     # Changed to standard HTTPS port
  vpc_id      = aws_vpc.main.id
  
  health_check {
    protocol = "HTTPS"  # Ensure health checks also use HTTPS...