CKV_AWS_103 does not support TLS 1.3 security policies

[awconstable]

Describe the issue
If it is related to an existing check, please note the relevant check ID.
Also, explain the logic for this addition / change.

The AWS default security policy for aws_lb_listener (ELBSecurityPolicy-TLS13-1-2-2021-06) uses TLS 1.3 which the CKV_AWS_103 rule alerts as failed.

The check should ensure 1.2 or above is used.

https://docs.aws.amazon.com/elasticloadbalancing/latest/network/create-tls-listener.html#describe-ssl-policies

Examples
Please share an example code sample (in the IaC of your choice) + the expected outcomes.

resource "aws_lb_listener" "listener" {
  load_balancer_arn = aws_lb.network.arn
  port                 = 5671
  protocol          = "TLS"
  certificate_arn   = data.aws_acm_certificate.cert.arn
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.target.arn
  }
}

Version (please complete the following information):

• Checkov Version: 2.1.225

Additional context
Add any other context about the problem here.

[gruebel]

hey @awconstable thanks for reaching out. Nice, AWS finally added the new policies 🚀 Are you interested in contributing the needed change?
add here an other or block with ELBSecurityPolicy-TLS13

checkov/checkov/terraform/checks/graph_checks/aws/AppLoadBalancerTLS12.yaml

Lines 27 to 41 in f4a9e1e

	- or:
	- cond_type: "attribute"
	resource_types:
	- "aws_lb_listener"
	- "aws_alb_listener"
	attribute: "ssl_policy"
	operator: "starting_with"
	value: "ELBSecurityPolicy-FS-1-2"
	- cond_type: "attribute"
	resource_types:
	- "aws_lb_listener"
	- "aws_alb_listener"
	attribute: "ssl_policy"
	operator: "starting_with"
	value: "ELBSecurityPolicy-TLS-1-2"

and a new test case
https://github.com/bridgecrewio/checkov/tree/master/tests/terraform/graph/checks/resources/AppLoadBalancerTLS12

[theherk]

Seems to me this is resolved by #2934, although the labeling isn't clear. The policy in the example above passes the check.

[gruebel]

hey @theherk the mentioned PR only fixes it for CloudFormation, not Terraform 🙂

[theherk]

@theherk: Yeah, I didn't check thoroughly enough. I just saw it linked from elsewhere, and thought I cleared the check so... "It must be fixed".

But yeah, it isn't. Back into the bushes for me.