bug(misconf): false positive in AWS-0126 when the TLS policy is Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08

Description

The check treats a TLS policy as secure only if its name matches one of two hard-coded values:

checks/cloud/aws/elasticsearch/use_secure_tls_policy.rego

recommended_tls_policies := {
      "Policy-Min-TLS-1-2-2019-07",
      "Policy-Min-TLS-1-2-PFS-2023-10",
}

is_tls_policy_secure(domain) if domain.endpoint.tlspolicy.value in recommended_tls_policies

DomainEndpointOptions.TLSSecurityPolicy accepts four values:

• Policy-Min-TLS-1-0-2019-07 - minimum TLS 1.0, correctly reported
• Policy-Min-TLS-1-2-2019-07 - minimum TLS 1.2, accepted
• Policy-Min-TLS-1-2-PFS-2023-10 - TLS 1.2 to 1.3 with PFS, accepted
• Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08 - TLS 1.3 with FIPS, reported as outdated, false positive

Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08 is the strictest of the four and is reported as an outdated policy.

There is a second problem in the same rule. The value is compared without a value.is_known guard, so a value Trivy could not resolve, for example one coming from an unresolved variable, also produces a finding.

Reproduction

resource "aws_elasticsearch_domain" "example" {
  domain_endpoint_options {
    enforce_https       = true
    tls_security_policy = "Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08"
  }
}

Output:

AWS-0126 (HIGH): Domain does not have a secure TLS policy.

Expected

Only Policy-Min-TLS-1-0-2019-07 produces a finding. An unresolvable value produces no finding.

Fix

Match on patterns rather than an exact list of names, the way AWS-0005 does for API Gateway security policies:

secure_tls_policies := ["Policy-Min-TLS-1-2-*", "Policy-Min-TLS-1-3-*"]

Policy-Min-TLS-1-2-* covers all three current secure policies and any further ones AWS adds to that family, and does not match Policy-Min-TLS-1-0-2019-07. The second pattern covers a future family with a 1.3 minimum.

References

• DomainEndpointOptions.TLSSecurityPolicy valid values