Control: ELB application load balancers should have drop invalid header fields configured

powerpipe control run terraform_aws_compliance.control.elb_application_lb_drop_invalid_header_fields

powerpipe login
powerpipe control run terraform_aws_compliance.control.elb_application_lb_drop_invalid_header_fields --share

select
  address as resource,
  case
    when (attributes_std ->> 'load_balancer_type') like any (array ['gateway', 'network']) then 'skip'
    when (attributes_std ->> 'drop_invalid_header_fields')::boolean and ((attributes_std ->> 'load_balancer_type') is null or (attributes_std ->> 'load_balancer_type') = 'application')
    then 'ok'
    else 'alarm'
  end status,
  split_part(address, '.', 2) || case
    when (attributes_std ->> 'load_balancer_type') like any (array ['gateway', 'network']) then ' load balancer is of ' || (attributes_std ->> 'load_balancer_type') || ' type'
    when (attributes_std ->> 'drop_invalid_header_fields')::boolean
    and ((attributes_std ->> 'load_balancer_type') is null or (attributes_std ->> 'load_balancer_type') = 'application')
    then ' configured to drop invalid http header field(s)'
    else ' not configured to drop invalid http header field(s)'
    end || '.' reason
  
  , path || ':' || start_line
from
  terraform_resource
where
  type in ('aws_lb', 'aws_alb');