bug(terraform): ELBv2 LB Access Log Disabled - false positves

[david-mnz]

https://docs.kics.io/latest/queries/terraform-queries/aws/3e34db4f-0ad9-4290-bfd0-4a9ee884acaf/

ELBv2 LB Access Log Disabled
Query id: 3e34db4f-0ad9-4290-bfd0-4a9ee884acaf
Query name: ELBv2 LB Access Log Disabled
Platform: Terraform
Severity: Medium
Category: Observability
CWE: 778
Risk score: 3.0
URL: GitHub

Expected Behavior

I expect that the following aws_lb resource should not be flagged by kics.io rule below.

resource "aws_lb" "test_nlb" {
name = "test-nlb"
subnets = [for subnet in aws_subnet.public : subnet.id]
internal = false
load_balancer_type = "network"

enable_deletion_protection = true

access_logs {
bucket = aws_s3_bucket.lb_logs.id
prefix = ""test-nlb""
enabled = true
}

tags = "development"
}

Actual Behavior

The kics.io rule flags this resource as a vulnerability.

Specifications

• Platform: AWS/Terraform

[omribz156]

I checked this against current master (600c0469) with only query 3e34db4f-0ad9-4290-bfd0-4a9ee884acaf enabled, and I cannot reproduce the false positive now.

I tried both:

• a valid NLB example with load_balancer_type = "network" and access_logs.enabled = true
• the snippet shape from the issue body

Both returned TOTAL: 0.

Command used:

go run ./cmd/console/main.go scan -p <tf-file> -q assets\queries\terraform\aws\elb_v2_lb_access_log_disabled --type Terraform --disable-secrets --no-progress --minimal-ui --ignore-on-exit results

So this may already be fixed on current master, or the original report may depend on a different surrounding Terraform file / KICS version. If there is still a failing case, I can take a focused pass with the exact input that still reports.

This check was Codex-assisted, with the result reviewed before posting.