added "App Service HTTP2 Disabled"

assets/queries/terraform/azure/app_service_http2_disabled/metadata.json

@@ -0,0 +1,11 @@
+{
+  "id": "525b53be-62ed-4244-b4df-41aecfcb4071",
+  "queryName": "App Service HTTP2 Disabled",
+  "severity": "LOW",
+  "category": "Networking and Firewall",
+  "descriptionText": "App Service should have 'http2_enabled' enabled",
+  "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#http2_enabled",
+  "platform": "Terraform",
+  "descriptionID": "dee0c164",
+  "cloudProvider": "azure"
+}

assets/queries/terraform/azure/app_service_http2_disabled/query.rego

@@ -0,0 +1,48 @@
+package Cx
+
+import data.generic.common as common_lib
+
+CxPolicy[result] {
+	app := input.document[i].resource.azurerm_app_service[name]
+
+	not common_lib.valid_key(app, "site_config")
+
+	result := {
+		"documentId": input.document[i].id,
+		"searchKey": sprintf("azurerm_app_service[%s]", [name]),
+		"issueType": "MissingAttribute",
+		"keyExpectedValue": sprintf("'azurerm_app_service[%s].site_config' is defined and not null", [name]),
+		"keyActualValue": sprintf("'azurerm_app_service[%s].site_config' is undefined or null", [name]),
+		"searchLine": common_lib.build_search_line(["resource", "azurerm_app_service", name], []),
+	}
+}
+
+CxPolicy[result] {
+	app := input.document[i].resource.azurerm_app_service[name]
+
+	not common_lib.valid_key(app.site_config, "http2_enabled")
+
+	result := {
+		"documentId": input.document[i].id,
+		"searchKey": sprintf("azurerm_app_service[%s].site_config", [name]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": sprintf("'azurerm_app_service[%s].site_config.http2_enabled' is defined and not null", [name]),
+		"keyActualValue": sprintf("'azurerm_app_service[%s].site_config.http2_enabled' is undefined or null", [name]),
+		"searchLine": common_lib.build_search_line(["resource", "azurerm_app_service", name, "site_config"], []),
+	}
+}
+
+CxPolicy[result] {
+	app := input.document[i].resource.azurerm_app_service[name]
+
+	app.site_config.http2_enabled == false
+
+	result := {
+		"documentId": input.document[i].id,
+		"searchKey": sprintf("azurerm_app_service[%s].site_config.http2_enabled", [name]),
+		"issueType": "IncorrectValue",
+		"keyExpectedValue": sprintf("'azurerm_app_service[%s].site_config.http2_enabled' is set to true", [name]),
+		"keyActualValue": sprintf("'azurerm_app_service[%s].site_config.http2_enabled' is set to false", [name]),
+		"searchLine": common_lib.build_search_line(["resource", "azurerm_app_service", name, "site_config", "http2_enabled"], []),
+	}
+}

assets/queries/terraform/azure/app_service_http2_disabled/test/negative.tf

@@ -0,0 +1,23 @@
+resource "azurerm_app_service" "negative" {
+  name                = "example-app-service"
+  location            = azurerm_resource_group.example.location
+  resource_group_name = azurerm_resource_group.example.name
+  app_service_plan_id = azurerm_app_service_plan.example.id
+
+  app_settings = {
+    "SOME_KEY" = "some-value"
+  }
+
+  connection_string {
+    name  = "Database"
+    type  = "SQLServer"
+    value = "Server=some-server.mydomain.com;Integrated Security=SSPI"
+  }
+
+  site_config {
+    dotnet_framework_version = "v4.0"
+    scm_type                 = "LocalGit"
+    min_tls_version = 1.2
+    http2_enabled = true
+  }
+}

assets/queries/terraform/azure/app_service_http2_disabled/test/positive1.tf

@@ -0,0 +1,16 @@
+resource "azurerm_app_service" "positive1" {
+  name                = "example-app-service"
+  location            = azurerm_resource_group.example.location
+  resource_group_name = azurerm_resource_group.example.name
+  app_service_plan_id = azurerm_app_service_plan.example.id
+
+  app_settings = {
+    "SOME_KEY" = "some-value"
+  }
+
+  connection_string {
+    name  = "Database"
+    type  = "SQLServer"
+    value = "Server=some-server.mydomain.com;Integrated Security=SSPI"
+  }
+}

assets/queries/terraform/azure/app_service_http2_disabled/test/positive2.tf

@@ -0,0 +1,22 @@
+resource "azurerm_app_service" "positive2" {
+  name                = "example-app-service"
+  location            = azurerm_resource_group.example.location
+  resource_group_name = azurerm_resource_group.example.name
+  app_service_plan_id = azurerm_app_service_plan.example.id
+
+  app_settings = {
+    "SOME_KEY" = "some-value"
+  }
+
+  connection_string {
+    name  = "Database"
+    type  = "SQLServer"
+    value = "Server=some-server.mydomain.com;Integrated Security=SSPI"
+  }
+
+  site_config {
+    dotnet_framework_version = "v4.0"
+    scm_type                 = "LocalGit"
+    min_tls_version = 1.2
+  }
+}

assets/queries/terraform/azure/app_service_http2_disabled/test/positive3.tf

@@ -0,0 +1,23 @@
+resource "azurerm_app_service" "positive3" {
+  name                = "example-app-service"
+  location            = azurerm_resource_group.example.location
+  resource_group_name = azurerm_resource_group.example.name
+  app_service_plan_id = azurerm_app_service_plan.example.id
+
+  app_settings = {
+    "SOME_KEY" = "some-value"
+  }
+
+  connection_string {
+    name  = "Database"
+    type  = "SQLServer"
+    value = "Server=some-server.mydomain.com;Integrated Security=SSPI"
+  }
+
+  site_config {
+    dotnet_framework_version = "v4.0"
+    scm_type                 = "LocalGit"
+    min_tls_version = 1.2
+    http2_enabled = false
+  }
+}

assets/queries/terraform/azure/app_service_http2_disabled/test/positive_expected_result.json

@@ -0,0 +1,20 @@
+[
+  {
+    "queryName": "App Service HTTP2 Disabled",
+    "severity": "LOW",
+    "line": 1,
+    "fileName": "positive1.tf"
+  },
+  {
+    "queryName": "App Service HTTP2 Disabled",
+    "severity": "LOW",
+    "line": 17,
+    "fileName": "positive2.tf"
+  },
+  {
+    "queryName": "App Service HTTP2 Disabled",
+    "severity": "LOW",
+    "line": 21,
+    "fileName": "positive3.tf"
+  }
+]