Repository navigation
bug(misconf): false positive in AWS-0126 when the TLS policy is Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08 #11118
Description
Description
The check treats a TLS policy as secure only if its name matches one of two hard-coded values:
checks/cloud/aws/elasticsearch/use_secure_tls_policy.rego
recommended_tls_policies := {
"Policy-Min-TLS-1-2-2019-07",
"Policy-Min-TLS-1-2-PFS-2023-10",
}
is_tls_policy_secure(domain) if domain.endpoint.tlspolicy.value in recommended_tls_policiesDomainEndpointOptions.TLSSecurityPolicy accepts four values:
Policy-Min-TLS-1-0-2019-07- minimum TLS 1.0, correctly reportedPolicy-Min-TLS-1-2-2019-07- minimum TLS 1.2, acceptedPolicy-Min-TLS-1-2-PFS-2023-10- TLS 1.2 to 1.3 with PFS, acceptedPolicy-Min-TLS-1-2-RFC9151-FIPS-2024-08- TLS 1.3 with FIPS, reported as outdated, false positive
Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08 is the strictest of the four and is reported as an outdated policy.
There is a second problem in the same rule. The value is compared without a value.is_known guard, so a value Trivy could not resolve, for example one coming from an unresolved variable, also produces a finding.
Reproduction
resource "aws_elasticsearch_domain" "example" {
domain_endpoint_options {
enforce_https = true
tls_security_policy = "Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08"
}
}Output:
AWS-0126 (HIGH): Domain does not have a secure TLS policy.Expected
Only Policy-Min-TLS-1-0-2019-07 produces a finding. An unresolvable value produces no finding.
Fix
Match on patterns rather than an exact list of names, the way AWS-0005 does for API Gateway security policies:
secure_tls_policies := ["Policy-Min-TLS-1-2-*", "Policy-Min-TLS-1-3-*"]Policy-Min-TLS-1-2-* covers all three current secure policies and any further ones AWS adds to that family, and does not match Policy-Min-TLS-1-0-2019-07. The second pattern covers a future family with a 1.3 minimum.
Activity
nightcityblade commentedon Aug 18, 2026
Hi, I'd like to work on this. I'll submit a PR shortly.
SumitDalavi commentedon Sep 8, 2026
Hello, I would like to propose a fix for this issue
Please review the PR: aquasecurity/trivy-checks#621
Thanks!
kokhlo commentedon Sep 29, 2026
I'd like to work on this. The check has moved to aquasecurity/trivy-checks, so the PR will go there.
Note that the TLS policies live in
checks/cloud/aws/elasticsearch/use_secure_tls_policy.regoin that repo, not inaquasecurity/trivy.For the PQC question raised in the task description:
Policy-Min-TLS-1-2-PFS-2023-10-PQC-2024-09does not exist for Elasticsearch/OpenSearch.DomainEndpointOptions.TLSSecurityPolicyaccepts exactly four values, all confirmed in the API reference and the AWS SDKs:Policy-Min-TLS-1-0-2019-07Policy-Min-TLS-1-2-2019-07Policy-Min-TLS-1-2-PFS-2023-10Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08The PQC policy
SecurityPolicy_TLS13_1_2_PFS_PQ_2025_09belongs to API Gateway and is already handled by AWS-0005. Only the FIPS one is missing from the check, so the fix matches the two TLS 1.2+ policy families by pattern rather than listing names, and covers future additions without another rule edit.