logo

Database

Terraform Https Traffic Only Disabled

Description

Detects Azure Storage Account configurations that allow insecure data transfer by not enforcing HTTPS-only traffic. When HTTPS traffic is not enforced, data can be transmitted over unencrypted channels, potentially exposing sensitive information to interception and tampering.

Weakness:

372 - Use of an insecure channel - HTTP

Category: Information Collection

Detection Strategy

    • Identifies Azure Storage Account resource blocks in Terraform configuration files

    • Examines the resource configuration to check if HTTPS-only traffic enforcement is explicitly disabled

    • Reports a vulnerability when an Azure Storage Account is configured with enable_https_traffic_only set to false

Vulnerable code example

resource "azurerm_storage_account" "vulnerable" {
  name                      = "storageaccount"
  resource_group_name       = "example-rg"
  location                  = "eastus"
  account_tier             = "Standard"
  account_replication_type = "LRS"
  enable_https_traffic_only = false  # Vulnerable: Allows non-HTTPS traffic, exposing data to potential MitM attacks
}

✅ Secure code example

resource "azurerm_storage_account" "secure" {
  name                      = "storageaccount"
  resource_group_name       = "example-rg"
  location                  = "eastus"
  account_tier             = "Standard"
  account_replication_type = "LRS"
  enable_https_traffic_only = true    # Secure: Enforce HTTPS-only traffic to prevent MitM attacks
  min_tls_version         = "TLS1_2"  # Secure: Enforce minimum TLS 1.2 for strong encryption...