Compute

1# Compliant fixture — MUST pass (POLICY_OK).
2# An internet-facing Network Load Balancer (L4) legitimately has no HTTPS:443
3# listener — it fronts raw TCP/UDP. The ALB HTTPS rule must NOT fire on it.
4resource "aws_lb" "game" {
5  name               = "game-nlb"
6  internal           = false
7  load_balancer_type = "network"
8  subnets            = ["subnet-1", "subnet-2"]
9}
10
11resource "aws_lb_listener" "game_tcp" {
12  load_balancer_arn = aws_lb.game.arn
13  port              = 7000
14  protocol          = "TCP"
15
16  default_action {
17    type             = "forward"
18    target_group_arn = aws_lb_target_group.game.arn
19  }
20}