Description

Detects AWS ELBv2 Target Groups configured to use unencrypted HTTP protocol instead of HTTPS. This configuration allows transmission of data in plaintext, potentially exposing sensitive information to network eavesdropping and man-in-the-middle attacks.

Detection Strategy

• Scan AWS CloudFormation templates for TargetGroup resources of type 'AWS::ElasticLoadBalancingV2::TargetGroup'

• Check if the TargetGroup's protocol configuration is set to HTTP instead of HTTPS

• Report a vulnerability if an insecure HTTP protocol is specified in the TargetGroup configuration

Vulnerable code example

Resources:
  VulnerableTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      # Health checks disabled - makes target group monitoring impossible
      HealthCheckEnabled: false  
      Name: UnsafeTargets
      Protocol: HTTP...

✅ Secure code example

Resources:
  SecureTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckEnabled: true  # Enable health checks for better monitoring
      Name: SecureTargets
      Protocol: HTTPS  # Use HTTPS to encrypt traffic in transit
      TargetType: ip...