Cloudformation NLB Listener Rules are incorrectly detected as ALB rules and fail the HTTPS expectation

Describe the bug NLB listeners are evaluated as ALB listeners, and fail because they don’t use HTTPS

To Reproduce

1. Create a Cloudformation template with NLB listeners (e.g. TCP)
2. Run default tests
3. Tests will fail with `"AWS::ElasticLoadBalancingV2::Listener.<listenername>" failed in check "Ensure ALB protocol is HTTPS"

Expected behavior NLB rules should pass.

Screenshots

Desktop (please complete the following information):

• OS: Ubuntu 20.04
• Checkov Version: 1.0.423

Additional context This resource:

    "ConsulDnsListener": {                                          
      "Type": "AWS::ElasticLoadBalancingV2::Listener",              
      "Properties": {                                               
        "DefaultActions": [                                         
          {                                                         
            "TargetGroupArn": {                                     
              "Ref": "ConsulDnsTargetGroup"                         
            },                                                      
            "Type": "forward"                                       
          }                                                         
        ],                                                          
        "LoadBalancerArn": {                                        
          "Ref": "LoadBalancerArn"                                  
        },                                                          
        "Port": 53,                                                 
        "Protocol": "TCP_UDP"                                       
      }                                                             
    },     

Produces this error:

{
  "type": "failure",
  "message": "Resource \"AWS::ElasticLoadBalancingV2::Listener.ConsulDnsListener\" failed in check \"Ensure ALB protocol is HTTPS\""
}```

[matthiasr]

I agree with @luckymike – we run our own TLS terminators, fronted by NLBs. As it is, the test is both worded wrong (claims an ALB when it is an NLB) and flags valid use cases (non-TCP listeners, or cases where the connection is end-to-end encrypted).

#375 describes the solution, this issue describes the problem. It appears that I cannot reopen an issue that was opened by someone else?

[luckymike]

@nimrodkor I guess the confusion here is that the rule inaccurately identifies the listener as an ALB rule: https://github.com/bridgecrewio/checkov/blob/master/checkov/cloudformation/checks/resource/aws/ALBListenerHTTPS.py#L23

conf['Properties']['Protocol'] == 'TLS' is an NLB listener, not an ALB listener.

IMO, this check is overly broad and naive about the actual supported listener scenarios. For example, UDP or TCP_UDP are valid NLB listener types which don’t support load balancer terminated TLS.

At a minimum, this check should probably be reworded to correctly reflect the scope as being wider than ALB, but a better approach would likely be to split out ALB and NLB checks, b/c enforcing HTTPS for all ALBs is easy to justify as a standard, while NLBs have much broader use-cases.