16f6c0aecf
Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
736 lines
19 KiB
Plaintext
736 lines
19 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
[source,python]
|
|
----
|
|
url = "http://example.com" # Sensitive
|
|
url = "ftp://anonymous@example.com" # Sensitive
|
|
url = "telnet://anonymous@example.com" # Sensitive
|
|
|
|
import telnetlib
|
|
cnx = telnetlib.Telnet("towel.blinkenlights.nl") # Sensitive
|
|
|
|
import ftplib
|
|
cnx = ftplib.FTP("ftp.example.com") # Sensitive
|
|
|
|
import smtplib
|
|
smtp = smtplib.SMTP("smtp.example.com", port=587) # Sensitive
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_elasticloadbalancingv2/ApplicationLoadBalancer.html[aws_cdk.aws_elasticloadbalancingv2.ApplicationLoadBalancer]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_elasticloadbalancingv2 as elbv2,
|
|
)
|
|
|
|
lb = elbv2.ApplicationLoadBalancer(
|
|
self,
|
|
"LB",
|
|
vpc=vpc,
|
|
internet_facing=True
|
|
)
|
|
|
|
lb.add_listener(
|
|
"Listener-default",
|
|
port=80, # Sensitive
|
|
open=True
|
|
)
|
|
lb.add_listener(
|
|
"Listener-http-explicit",
|
|
protocol=elbv2.ApplicationProtocol.HTTP, # Sensitive
|
|
port=8080,
|
|
open=True
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_elasticloadbalancingv2/ApplicationListener.html[aws_cdk.aws_elasticloadbalancingv2.ApplicationListener]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_elasticloadbalancingv2 as elbv2,
|
|
)
|
|
|
|
elbv2.ApplicationListener(
|
|
self,
|
|
"listener-http-explicit-const",
|
|
load_balancer=lb,
|
|
protocol=elbv2.ApplicationProtocol.HTTP, # Sensitive
|
|
port=8081,
|
|
open=True
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_elasticloadbalancingv2/NetworkLoadBalancer.html[aws_cdk.aws_elasticloadbalancingv2.NetworkLoadBalancer]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_elasticloadbalancingv2 as elbv2,
|
|
)
|
|
lb = elbv2.NetworkLoadBalancer(
|
|
self,
|
|
"LB",
|
|
vpc=vpc,
|
|
internet_facing=True
|
|
)
|
|
|
|
lb.add_listener( # Sensitive
|
|
"Listener-default",
|
|
port=1234
|
|
)
|
|
lb.add_listener(
|
|
"Listener-TCP-explicit",
|
|
protocol=elbv2.Protocol.TCP, # Sensitive
|
|
port=1337
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_elasticloadbalancingv2/NetworkListener.html[aws_cdk.aws_elasticloadbalancingv2.NetworkListener]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_elasticloadbalancingv2 as elbv2,
|
|
)
|
|
|
|
elbv2.NetworkListener(
|
|
self,
|
|
"Listener-TCP-explicit",
|
|
protocol=elbv2.Protocol.TCP, # Sensitive
|
|
port=1338,
|
|
load_balancer=lb
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_elasticloadbalancingv2/CfnListener.html[aws_cdk.aws_elasticloadbalancingv2.CfnListener]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_elasticloadbalancingv2 as elbv2,
|
|
)
|
|
|
|
elbv2.CfnListener(
|
|
self,
|
|
"listener-http",
|
|
default_actions=[application_default_action],
|
|
load_balancer_arn=lb.load_balancer_arn,
|
|
protocol="HTTP", # Sensitive
|
|
port=80
|
|
)
|
|
|
|
elbv2.CfnListener(
|
|
self,
|
|
"listener-tcp",
|
|
default_actions=[network_default_action],
|
|
load_balancer_arn=lb.load_balancer_arn,
|
|
protocol="TCP", # Sensitive
|
|
port=1000
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_elasticloadbalancing/LoadBalancerListener.html[aws_cdk.aws_elasticloadbalancing.LoadBalancerListener]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_elasticloadbalancing as elb,
|
|
)
|
|
|
|
elb.LoadBalancerListener(
|
|
external_port=10000,
|
|
external_protocol=elb.LoadBalancingProtocol.TCP, # Sensitive
|
|
internal_port=10000
|
|
)
|
|
|
|
elb.LoadBalancerListener(
|
|
external_port=10080,
|
|
external_protocol=elb.LoadBalancingProtocol.HTTP, # Sensitive
|
|
internal_port=10080
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_elasticloadbalancing/CfnLoadBalancer.html[aws_cdk.aws_elasticloadbalancing.CfnLoadBalancer]:
|
|
|
|
[source, python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_elasticloadbalancing as elb
|
|
)
|
|
|
|
elb.CfnLoadBalancer(
|
|
self,
|
|
"elb-tcp",
|
|
listeners=[
|
|
elb.CfnLoadBalancer.ListenersProperty(
|
|
instance_port="10000",
|
|
load_balancer_port="10000",
|
|
protocol="tcp" # Sensitive
|
|
)
|
|
],
|
|
subnets=vpc.select_subnets().subnet_ids
|
|
)
|
|
|
|
elb.CfnLoadBalancer(
|
|
self,
|
|
"elb-http-dict",
|
|
listeners=[
|
|
{
|
|
"instancePort":"10000",
|
|
"loadBalancerPort":"10000",
|
|
"protocol":"http" # Sensitive
|
|
}
|
|
],
|
|
subnets=vpc.select_subnets().subnet_ids
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_elasticloadbalancing/LoadBalancer.html[aws_cdk.aws_elasticloadbalancing.LoadBalancer]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_elasticloadbalancing as elb,
|
|
)
|
|
|
|
elb.LoadBalancer(
|
|
self,
|
|
"elb-tcp-dict",
|
|
vpc=vpc,
|
|
listeners=[
|
|
{
|
|
"externalPort":10000,
|
|
"externalProtocol":elb.LoadBalancingProtocol.TCP, # Sensitive
|
|
"internalPort":10000
|
|
}
|
|
]
|
|
)
|
|
|
|
loadBalancer.add_listener(
|
|
external_port=10081,
|
|
external_protocol=elb.LoadBalancingProtocol.HTTP, # Sensitive
|
|
internal_port=10081
|
|
)
|
|
loadBalancer.add_listener(
|
|
external_port=10001,
|
|
external_protocol=elb.LoadBalancingProtocol.TCP, # Sensitive
|
|
internal_port=10001
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_elasticache/CfnReplicationGroup.html[aws_cdk.aws_elasticache.CfnReplicationGroup]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_elasticache as elasticache
|
|
)
|
|
|
|
elasticache.CfnReplicationGroup(
|
|
self,
|
|
"unencrypted-explicit",
|
|
replication_group_description="a replication group",
|
|
automatic_failover_enabled=False,
|
|
transit_encryption_enabled=False, # Sensitive
|
|
cache_subnet_group_name="test",
|
|
engine="redis",
|
|
engine_version="3.2.6",
|
|
num_cache_clusters=1,
|
|
cache_node_type="cache.t2.micro"
|
|
)
|
|
|
|
elasticache.CfnReplicationGroup( # Sensitive, encryption is disabled by default
|
|
self,
|
|
"unencrypted-implicit",
|
|
replication_group_description="a test replication group",
|
|
automatic_failover_enabled=False,
|
|
cache_subnet_group_name="test",
|
|
engine="redis",
|
|
engine_version="3.2.6",
|
|
num_cache_clusters=1,
|
|
cache_node_type="cache.t2.micro"
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_kinesis/CfnStream.html[aws_cdk.aws_kinesis.CfnStream]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_kinesis as kinesis,
|
|
)
|
|
|
|
kinesis.CfnStream( # Sensitive, encryption is disabled by default for CfnStreams
|
|
self,
|
|
"cfnstream-implicit-unencrytped",
|
|
shard_count=1
|
|
)
|
|
|
|
kinesis.CfnStream(self,
|
|
"cfnstream-explicit-unencrytped",
|
|
shard_count=1,
|
|
stream_encryption=None # Sensitive
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_kinesis/Stream.html[aws_cdk.aws_kinesis.Stream]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_kinesis as kinesis,
|
|
)
|
|
|
|
stream = kinesis.Stream(self,
|
|
"stream-explicit-unencrypted",
|
|
shard_count=1,
|
|
encryption=kinesis.StreamEncryption.UNENCRYPTED # Sensitive
|
|
)
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
[source,python]
|
|
----
|
|
url = "https://example.com"
|
|
url = "sftp://anonymous@example.com"
|
|
url = "ssh://anonymous@example.com"
|
|
|
|
import ftplib
|
|
cnx = ftplib.FTP_TLS("ftp.example.com")
|
|
|
|
import smtplib
|
|
smtp = smtplib.SMTP("smtp.example.com", port=587)
|
|
smtp.starttls(context=context)
|
|
|
|
smtp_ssl = smtplib.SMTP_SSL("smtp.gmail.com", port=465)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_elasticloadbalancingv2/ApplicationLoadBalancer.html[aws_cdk.aws_elasticloadbalancingv2.ApplicationLoadBalancer]:
|
|
[source,python]
|
|
|
|
----
|
|
from aws_cdk import (
|
|
aws_elasticloadbalancingv2 as elbv2,
|
|
)
|
|
|
|
lb = elbv2.ApplicationLoadBalancer(
|
|
self,
|
|
"LB",
|
|
vpc=vpc,
|
|
internet_facing=True
|
|
)
|
|
|
|
lb.add_listener(
|
|
"Listener-https-explicit",
|
|
protocol=elbv2.ApplicationProtocol.HTTPS,
|
|
certificates=[elbv2.ListenerCertificate("certificateARN")],
|
|
port=443,
|
|
open=True
|
|
)
|
|
|
|
lb.add_listener(
|
|
"Listener-https-implicit",
|
|
certificates=[elbv2.ListenerCertificate("certificateARN")],
|
|
port=8443,
|
|
open=True
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_elasticloadbalancingv2/ApplicationListener.html[ aws_cdk.aws_elasticloadbalancingv2.ApplicationListener]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_elasticloadbalancingv2 as elbv2,
|
|
)
|
|
|
|
elbv2.ApplicationListener(
|
|
self,
|
|
"listener-https-explicit-const",
|
|
load_balancer=lb,
|
|
protocol=elbv2.ApplicationProtocol.HTTPS,
|
|
certificates=[elbv2.ListenerCertificate("certificateARN")],
|
|
port=444,
|
|
open=True
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_elasticloadbalancingv2/NetworkLoadBalancer.html[aws_cdk.aws_elasticloadbalancingv2.NetworkLoadBalancer]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_elasticloadbalancingv2 as elbv2,
|
|
)
|
|
lb = elbv2.NetworkLoadBalancer(
|
|
self,
|
|
"LB",
|
|
vpc=vpc,
|
|
internet_facing=True
|
|
)
|
|
|
|
lb.add_listener(
|
|
"Listener-TLS-explicit",
|
|
protocol=elbv2.Protocol.TLS,
|
|
certificates=[elbv2.ListenerCertificate("certificateARN")],
|
|
port=443
|
|
)
|
|
lb.add_listener(
|
|
"Listener-TLS-implicit",
|
|
certificates=[elbv2.ListenerCertificate("certificateARN")],
|
|
port=1024
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_elasticloadbalancingv2/NetworkListener.html[aws_cdk.aws_elasticloadbalancingv2.NetworkListener]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_elasticloadbalancingv2 as elbv2,
|
|
)
|
|
|
|
elbv2.NetworkListener(
|
|
self,
|
|
"Listener-TLS-explicit",
|
|
protocol=elbv2.Protocol.TLS,
|
|
certificates=[elbv2.ListenerCertificate("certificateARN")],
|
|
port=443,
|
|
load_balancer=lb
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_elasticloadbalancingv2/CfnListener.html[aws_cdk.aws_elasticloadbalancingv2.CfnListener]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_elasticloadbalancingv2 as elbv2,
|
|
)
|
|
|
|
elbv2.CfnListener(
|
|
self,
|
|
"listener-https",
|
|
default_actions=[application_default_action],
|
|
load_balancer_arn=lb.load_balancer_arn,
|
|
protocol="HTTPS",
|
|
port=443,
|
|
certificates=[elbv2.CfnListener.CertificateProperty(
|
|
certificate_arn="certificateARN"
|
|
)]
|
|
)
|
|
|
|
elbv2.CfnListener(
|
|
self,
|
|
"listener-tls",
|
|
default_actions=[network_default_action],
|
|
load_balancer_arn=lb.load_balancer_arn,
|
|
protocol="TLS",
|
|
port=1001,
|
|
certificates=[elbv2.CfnListener.CertificateProperty(
|
|
certificate_arn="certificateARN"
|
|
)]
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_elasticloadbalancing/LoadBalancerListener.html[aws_cdk.aws_elasticloadbalancing.LoadBalancerListener]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_elasticloadbalancing as elb,
|
|
)
|
|
|
|
elb.LoadBalancerListener(
|
|
external_port=10043,
|
|
external_protocol=elb.LoadBalancingProtocol.SSL,
|
|
internal_port=10043,
|
|
ssl_certificate_arn="certificateARN"
|
|
)
|
|
|
|
elb.LoadBalancerListener(
|
|
external_port=10443,
|
|
external_protocol=elb.LoadBalancingProtocol.HTTPS,
|
|
internal_port=10443,
|
|
ssl_certificate_arn="certificateARN"
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_elasticloadbalancing/CfnLoadBalancer.html[aws_cdk.aws_elasticloadbalancing.CfnLoadBalancer]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_elasticloadbalancing as elb,
|
|
)
|
|
|
|
elb.CfnLoadBalancer(
|
|
self,
|
|
"elb-ssl",
|
|
listeners=[
|
|
elb.CfnLoadBalancer.ListenersProperty(
|
|
instance_port="10043",
|
|
load_balancer_port="10043",
|
|
protocol="ssl",
|
|
ssl_certificate_id=CERTIFICATE_ARN
|
|
)
|
|
],
|
|
subnets=vpc.select_subnets().subnet_ids
|
|
)
|
|
|
|
elb.CfnLoadBalancer(
|
|
self,
|
|
"elb-https-dict",
|
|
listeners=[
|
|
{
|
|
"instancePort":"10443",
|
|
"loadBalancerPort":"10443",
|
|
"protocol":"https",
|
|
"sslCertificateId":CERTIFICATE_ARN
|
|
}
|
|
],
|
|
subnets=vpc.select_subnets().subnet_ids
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_elasticloadbalancing/LoadBalancer.html[aws_cdk.aws_elasticloadbalancing.LoadBalancer]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_elasticloadbalancing as elb,
|
|
)
|
|
|
|
elb.LoadBalancer(
|
|
self,
|
|
"elb-ssl",
|
|
vpc=vpc,
|
|
listeners=[
|
|
{
|
|
"externalPort":10044,
|
|
"externalProtocol":elb.LoadBalancingProtocol.SSL,
|
|
"internalPort":10044,
|
|
"sslCertificateArn":"certificateARN"
|
|
},
|
|
{
|
|
"externalPort":10444,
|
|
"externalProtocol":elb.LoadBalancingProtocol.HTTPS,
|
|
"internalPort":10444,
|
|
"sslCertificateArn":"certificateARN"
|
|
}
|
|
]
|
|
)
|
|
|
|
loadBalancer = elb.LoadBalancer(
|
|
self,
|
|
"elb-multi-listener",
|
|
vpc=vpc
|
|
)
|
|
loadBalancer.add_listener(
|
|
external_port=10045,
|
|
external_protocol=elb.LoadBalancingProtocol.SSL,
|
|
internal_port=10045,
|
|
ssl_certificate_arn="certificateARN"
|
|
)
|
|
loadBalancer.add_listener(
|
|
external_port=10445,
|
|
external_protocol=elb.LoadBalancingProtocol.HTTPS,
|
|
internal_port=10445,
|
|
ssl_certificate_arn="certificateARN"
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_elasticache/CfnReplicationGroup.html[aws_cdk.aws_elasticache.CfnReplicationGroup]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_elasticache as elasticache
|
|
)
|
|
|
|
elasticache.CfnReplicationGroup(
|
|
self,
|
|
"encrypted-explicit",
|
|
replication_group_description="a test replication group",
|
|
automatic_failover_enabled=False,
|
|
transit_encryption_enabled=True,
|
|
cache_subnet_group_name="test",
|
|
engine="redis",
|
|
engine_version="3.2.6",
|
|
num_cache_clusters=1,
|
|
cache_node_type="cache.t2.micro"
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_kinesis/CfnStream.html[aws_cdk.aws_kinesis.CfnStream]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_kinesis as kinesis,
|
|
)
|
|
|
|
kinesis.CfnStream(
|
|
self,
|
|
"cfnstream-explicit-encrytped",
|
|
shard_count=1,
|
|
stream_encryption=kinesis.CfnStream.StreamEncryptionProperty(
|
|
encryption_type="KMS",
|
|
key_id="alias/aws/kinesis"
|
|
)
|
|
)
|
|
|
|
stream = kinesis.CfnStream(
|
|
self,
|
|
"cfnstream-explicit-encrytped-dict",
|
|
shard_count=1,
|
|
stream_encryption={
|
|
"encryptionType": "KMS",
|
|
"keyId": "alias/aws/kinesis"
|
|
}
|
|
)
|
|
----
|
|
|
|
For https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_kinesis/Stream.html[aws_cdk.aws_kinesis.Stream]:
|
|
|
|
[source,python]
|
|
----
|
|
from aws_cdk import (
|
|
aws_kinesis as kinesis,
|
|
aws_kms as kms
|
|
)
|
|
|
|
stream = kinesis.Stream( # Encryption is enabled by default for Streams
|
|
self,
|
|
"stream-implicit-encrypted",
|
|
shard_count=1
|
|
)
|
|
|
|
stream = kinesis.Stream(
|
|
self,
|
|
"stream-explicit-encrypted-managed",
|
|
shard_count=1,
|
|
encryption=kinesis.StreamEncryption.MANAGED
|
|
)
|
|
|
|
key = kms.Key(self, "managed_key")
|
|
stream = kinesis.Stream(
|
|
self,
|
|
"stream-explicit-encrypted-selfmanaged",
|
|
shard_count=1,
|
|
encryption=kinesis.StreamEncryption.KMS,
|
|
encryption_key=key
|
|
)
|
|
----
|
|
|
|
include::../exceptions.adoc[]
|
|
|
|
include::../see.adoc[]
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
* Using {protocol.insecure} protocol is insecure. Use {protocol.alternatives} instead.
|
|
|
|
* Make sure STARTTLS is used to upgrade to a secure connection using SSL/TLS.
|
|
|
|
For `aws_cdk.aws_elasticloadbalancing.LoadBalancer`, `aws_cdk.aws_elasticloadbalancing.CfnLoadBalancer`, `aws_cdk.aws_elasticloadbalancing.LoadBalancerListener`, `aws_cdk.aws_elasticloadbalancingv2.ApplicationLoadBalancer`, `aws_cdk.aws_elasticloadbalancingv2.NetworkLoadBalancer`, `aws_cdk.aws_elasticloadbalancingv2.ApplicationListener`, `aws_cdk.aws_elasticloadbalancingv2.ApplicationListener`, `aws_cdk.aws_elasticloadbalancingv2.NetworkListener` and `aws_cdk.aws_elasticloadbalancingv2.CfnListener`:
|
|
|
|
* Make sure that using network protocols without an SSL/TLS underlay is safe here.
|
|
|
|
For `aws_cdk.aws_elasticache.CfnReplicationGroup`:
|
|
|
|
* Make sure that disabling transit encryption is safe here.
|
|
|
|
For `aws_cdk.aws_kinesis.CfnStream` and `aws_cdk.aws_kinesis.Stream`:
|
|
|
|
* Make sure that disabling stream encryption is safe here.
|
|
|
|
=== Highlighting
|
|
|
|
For `aws_cdk.aws_elasticloadbalancingv2.ApplicationLoadBalancer`:
|
|
|
|
* Highlight the `protocol` parameter of the `add_listener` call when it is set
|
|
to elbv2.ApplicationProtocol.HTTP
|
|
* Highlight the `add_listener` call when the `protocol` parameter is not set
|
|
and the port parameter is 80, 8000, 8080 or 8008
|
|
|
|
For `aws_cdk.aws_elasticloadbalancingv2.ApplicationListener`
|
|
|
|
* Highlight the `protocol` property of the object constructor when it is set to
|
|
elbv2.ApplicationProtocol.HTTP
|
|
* Highlight the object constructor call when the `protocol` parameter is not set
|
|
and the port parameter is 80, 8000, 8080 or 8008
|
|
|
|
For `aws_cdk.aws_elasticloadbalancingv2.NetworkLoadBalancer`
|
|
|
|
* Highlight the `protocol` parameter of the `add_listener` call when it is set
|
|
to elbv2.Protocol.TCP, elbv2.Protocol.UDP, or
|
|
elbv2.Protocol.TCP_UDP
|
|
* Highlight the `add_listener` call when the `protocol` parameter is not set
|
|
and the `certificates` parameter is not set or is an empty `Sequence`.
|
|
|
|
For `aws_cdk.aws_elasticloadbalancingv2.NetworkListener`
|
|
|
|
* Highlight the `protocol` property of the object constructor call when it is set
|
|
to elbv2.ApplicationProtocol.TCP, elbv2.ApplicationProtocol.UDP, or
|
|
elbv2.ApplicationProtocol.TCP_UDP
|
|
* Highlight the constructor call when the `protocol` parameter is not set
|
|
and the `certificates` parameter is not set or is an empty `Sequence`.
|
|
|
|
For `aws_cdk.aws_elasticloadbalancingv2.CfnListener`:
|
|
|
|
* Highlight the `protocol` property of the object constructor when set to
|
|
HTTP, TCP, UDP, or TCP_UDP.
|
|
|
|
For `aws_cdk.aws_elasticloadbalancing.LoadBalancer`:
|
|
|
|
* Highlight the `externalProtocol` dict entry in the `listeners` property of the
|
|
object constructor when set to `elb.LoadBalancingProtocol.TCP` or `elb.LoadBalancingProtocol.HTTP`.
|
|
* Highlight the `externalProtocol` parameter of the call to `add_listener` when set to `elb.LoadBalancingProtocol.TCP` or `elb.LoadBalancingProtocol.HTTP`.
|
|
|
|
For `aws_cdk.aws_elasticloadbalancing.CfnLoadBalancer`:
|
|
|
|
* When the `listeners` property of the object constructor is a `Sequence`
|
|
that contains a `dict` with a "protocol" entry set to "tcp" or "http",
|
|
highligth the "protocol" entry.
|
|
* When the `listeners` property of the object constructor is a `Sequence`
|
|
that contains an `elb.CfnLoadBalancer.ListenersProperty` with a `protocol`
|
|
property set to "tcp" or "http", highlight the protocol property.
|
|
|
|
|
|
For `aws_cdk.aws_elasticloadbalancing.LoadBalancerListener`:
|
|
|
|
* Highlight the `external_protocol` property of the object constructor when set to `elb.LoadBalancingProtocol.TCP` or `elb.LoadBalancingProtocol.HTTP`.
|
|
|
|
For `aws_cdk.aws_elasticache.CfnReplicationGroup`:
|
|
|
|
* Highlight the `transit_encryption_enabled` property of the object constructor if it is
|
|
present and set to False.
|
|
* Highlight the constructor call if the `transit_encryption_enabled` attribute is not set.
|
|
|
|
For `aws_cdk.aws_kinesis.CfnStream`:
|
|
|
|
* Highlight the object constructor when the `stream_encryption` property is not set.
|
|
* Highlight the `stream_encryption` property of the object constructor when set to None.
|
|
|
|
For `aws_cdk.aws_kinesis.Stream`:
|
|
|
|
* Highlight the `encryption` property of the object constructor when it is set to aws_kinesis.StreamEncryption.UNENCRYPTED
|
|
|
|
|
|
endif::env-github,rspecator-view[]
|