WAF-SEC-040 – Encryption in Transit – TLS Enforcement

Engine: terraform | Provider: aws | Automated: Yes

ALB and NLB listeners must use HTTPS, not HTTP

Application and Network Load Balancer listeners must be configured with the HTTPS protocol (or TLS for NLB). Listeners configured with plain HTTP on port 80 are only acceptable if they redirect to HTTPS via a fixed-response redirect rule and do not forward traffic to targets.

Scope: resource — aws_lb_listener, aws_alb_listener

Assertions: * protocol not equals HTTP — Load balancer listener MUST use HTTPS (or HTTP-to-HTTPS redirect), not plain HTTP forwarding.

Remediation: Change the listener protocol to HTTPS and provide a valid ACM certificate ARN. If a port 80 listener is required for redirect purposes, change the default_action to type = "redirect" with redirect { protocol = "HTTPS", status_code = "HTTP_301" }.

Engine: terraform | Provider: aws | Automated: Yes

CloudFront distributions must enforce TLS 1.2 or higher

CloudFront distributions must have a viewer_certificate block with minimum_protocol_version set to at least TLSv1.2_2021 to prevent connections using outdated TLS versions.

Scope: resource — aws_cloudfront_distribution

Assertions: * viewer_certificate attribute exists — CloudFront distribution must have an explicit viewer_certificate block configured.

Remediation: Add a viewer_certificate block to the aws_cloudfront_distribution resource. Set minimum_protocol_version = "TLSv1.2_2021" and ssl_support_method = "sni-only". Use a custom ACM certificate instead of the default CloudFront certificate for production workloads with custom domains.

Engine: terraform | Provider: azurerm | Automated: Yes

Azure App Service and Function Apps must enforce TLS 1.2

All azurerm_linux_web_app, azurerm_windows_web_app, azurerm_linux_function_app, and azurerm_windows_function_app resources must set site_config.minimum_tls_version to "1.2".

Scope: resource — azurerm_linux_web_app, azurerm_windows_web_app, azurerm_linux_function_app, azurerm_windows_function_app

Assertions: * site_config.minimum_tls_version equals 1.2 — App Service / Function App must enforce TLS 1.2 minimum.

Remediation: Set minimum_tls_version = "1.2" in the site_config block of every App Service and Function App resource.

Engine: terraform | Provider: azurerm | Automated: Yes

Azure CDN endpoints must not allow plain HTTP delivery

All azurerm_cdn_endpoint resources must set is_http_allowed to false so content is only served over HTTPS.

Scope: resource — azurerm_cdn_endpoint

Assertions: * is_http_allowed is false — CDN endpoint must not allow plain HTTP delivery.

Remediation: Set is_http_allowed = false on every azurerm_cdn_endpoint resource. Configure HTTPS delivery and a valid custom domain certificate if needed.

Engine: terraform | Provider: google | Automated: Yes

Google Cloud SSL policies must enforce TLS 1.2 or higher

All google_compute_ssl_policy resources must set min_tls_version to "TLS_1_2" or "TLS_1_3".

Scope: resource — google_compute_ssl_policy

Assertions: * min_tls_version in ['TLS_1_2', 'TLS_1_3'] — SSL policy must enforce TLS 1.2 or higher.

Remediation: Set min_tls_version = "TLS_1_2" (or "TLS_1_3") on every google_compute_ssl_policy resource.

Engine: terraform | Provider: stackit | Automated: Yes

STACKIT resources must be tagged with data classification

All STACKIT resources that store or process data must carry a data-class tag (public, internal, confidential, restricted) to enforce appropriate security controls.

Scope: resource — stackit_object_storage_bucket, stackit_postgres_flex_instance, stackit_mysql_instance, stackit_redis_instance, stackit_opensearch_instance, stackit_load_balancer, stackit_network

Assertions: * tags key exists — STACKIT resource must have a 'data-class' tag.

Remediation: Add a data-class tag to all STACKIT resources. Use a shared tagging module and enforce it via CI/CD checks.

Engine: terraform | Provider: ovh | Automated: Yes

OVHcloud resources must be tagged with data classification

All OVHcloud resources that store or process data must carry a data-class tag or label (public, internal, confidential, restricted) to enforce appropriate security controls.

Scope: resource — ovh_cloud_project_instance, ovh_vps, ovh_dedicated_server, ovh_cloud_project

Assertions: * tags key exists — OVHcloud resource must have a 'data-class' tag or label.

Remediation: Add a data-class tag or label to all OVHcloud resources. Document the tagging scheme and enforce it via CI/CD checks.

Engine: terraform | Provider: hcloud | Automated: Yes

Hetzner Cloud resources must be labelled with data classification

All Hetzner Cloud resources that store or process data must carry a data-class label (public, internal, confidential, restricted) to enforce appropriate security controls.

Scope: resource — hcloud_server, hcloud_volume, hcloud_network, hcloud_load_balancer

Assertions: * labels key exists — Hetzner Cloud resource must have a 'data-class' label.

Remediation: Add a data-class label to all Hetzner Cloud resources. Use a shared labelling module and enforce it via CI/CD checks.