AWS ACM Certificate with wildcard domain name misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AWS_71
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	AWS
Severity	LOW
Framework	CloudFormation, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	70cbe31e-4a01-4462-96ea-0d2baeeb8dd8

Impact

This rule detects whether an AWS ACM (AWS Certificate Manager) certificate's domain name contains wildcard entries. Wildcards in domain names (for example, *.example.com) can be problematic because they allow the certificate to secure every subdomain under a given domain. While convenient, this poses a significant security risk; if any subdomain gets compromised, the same certificate could potentially be exploited to conduct attacks across all other subdomains. Avoiding wildcard certificates adds a layer of security by ensuring that each subdomain has its own distinct certificate, thereby isolating risks.

How to Fix

Resource: AWS::CertificateManager::Certificate

• Arguments: SubjectAlternativeNames

In this example, an AWS ACM certificate is configured with specific subdomains listed in the SubjectAlternativeNames attribute, rather than using a wildcard domain. [source,go]

ExamplePass2Certificate: Type: "AWS::CertificateManager::Certificate" Properties: DomainName: "example.com" ValidationMethod: "DNS" SubjectAlternativeNames:

• • "*.example.com"
• "blog.example.com"
• "api.example.com"

---