Metadata

Id: terraform-alicloud-slb-policy-with-insecure-tls-version-in-use

Provider: Alicloud

Platform: Terraform

Severity: Medium

Category: Encryption

Learn More

• Provider Reference

Description

An SLB policy should not include insecure TLS protocol versions. Specifically, alicloud_slb_tls_cipher_policy resources must not specify TLSv1.0 or TLSv1.1 in the tls_versions attribute. This rule detects resources whose tls_versions contains insecure entries.

Compliant Code Examples

resource "alicloud_slb_tls_cipher_policy" "negative" {
  tls_cipher_policy_name = "Test-example_value"
  tls_versions           = ["TLSv1.2","TLSv1.3"]
  ciphers                = ["AES256-SHA256", "AES128-GCM-SHA256","TLS_AES_256_GCM_SHA384"]
}

Non-Compliant Code Examples

resource "alicloud_slb_tls_cipher_policy" "positive" {
  tls_cipher_policy_name = "Test-example_value"
  tls_versions           = ["TLSv1.1","TLSv1.2"]
  ciphers                = ["AES256-SHA","AES256-SHA256", "AES128-GCM-SHA256"]
}