La sécurité de l’infrastructure en tant que code (IaC) identifie les mauvaises configurations et les risques de sécurité dans les fichiers d’infrastructure en tant que code avant le déploiement, aidant à garantir que les environnements cloud restent sécurisés et conformes.

Lectures complémentaires

Documentation, liens et articles supplémentaires utiles:

Configurer la sécurité IaCDOCUMENTATION Configurer la sécurité IaCDOCUMENTATION

Allow unsafe lookups enabled in defaults

ansible-allow-unsafe-lookups-enabled-in-defaults

>

Ansible Tower exposed to the internet

ansible-ansible-tower-exposed-to-internet

>

Communication over HTTP

ansible-communication-over-http

>

Communication over HTTP in defaults

ansible-communication-over-http-in-defaults

>

Insecure relative path resolution

ansible-insecure-relative-path-resolution

>

Logging of sensitive data

ansible-logging-of-sensitive-data

>

Logging of sensitive data in defaults

ansible-logging-of-sensitive-data-in-defaults

>

Privilege escalation using become plugin

ansible-privilege-escalation-using-become-plugin

>

Privilege escalation using become plugin in defaults

ansible-privilege-escalation-using-become-plugin-in-defaults

>

Risky file permissions

ansible-risky-file-permissions

>

Unpinned package version

ansible-unpinned-package-version

>

Ansible

>

ALB listening on HTTP

ansible-aws-alb-listening-on-http

>

AMI not encrypted

ansible-aws-ami-not-encrypted

>

AMI shared with multiple accounts

ansible-aws-ami-shared-with-multiple-accounts

>

API Gateway endpoint config is not private

ansible-aws-api-gateway-endpoint-config-is-not-private

>

API Gateway with CloudWatch Logs disabled

ansible-aws-api-gateway-with-cloudwatch-logging-disabled

>

API Gateway without configured authorizer

ansible-aws-api-gateway-without-configured-authorizer

>

API Gateway without SSL certificate

ansible-aws-api-gateway-without-ssl-certificate

>

API Gateway without WAF

ansible-aws-api-gateway-without-waf

>

API Gateway X-Ray disabled

ansible-aws-api-gateway-xray-disabled

>

Authentication without MFA

ansible-aws-authentication-without-mfa

>

Auto Scaling Group with no associated ELB

ansible-aws-auto-scaling-group-with-no-associated-elb

>

Automatic minor upgrades disabled

ansible-aws-automatic-minor-upgrades-disabled

>

AWS password policy with unchangeable passwords

ansible-aws-aws-password-policy-with-unchangeable-passwords

>

Batch job definition with privileged container properties

ansible-aws-batch-job-definition-with-privileged-container-properties

>

CA certificate identifier is outdated

ansible-aws-ca-certificate-identifier-is-outdated

>

CDN configuration is missing

ansible-aws-cdn-configuration-is-missing

>

Certificate has expired

ansible-aws-certificate-has-expired

>

Certificate RSA key bytes lower than 256

ansible-aws-certificate-rsa-key-bytes-lower-than-256

>

CloudFront logging disabled

ansible-aws-cloudfront-logging-disabled

>

CloudFront viewer protocol policy allows HTTP

ansible-aws-viewer-protocol-policy-allows-http

>

CloudFront without minimum protocol TLS 1.2

ansible-aws-cloudfront-without-minimum-protocol-tls-1-2

>

CloudFront without WAF

ansible-aws-cloudfront-without-waf

>

CloudTrail log file validation disabled

ansible-aws-cloudtrail-log-file-validation-disabled

>

CloudTrail log files not encrypted with KMS

ansible-aws-cloudtrail-log-files-not-encrypted-with-kms

>

CloudTrail logging disabled

ansible-aws-cloudtrail-logging-disabled

>

CloudTrail multi-region is disabled

ansible-aws-cloudtrail-multi-region-disabled

>

CloudTrail not integrated with CloudWatch

ansible-aws-cloudtrail-not-integrated-with-cloudwatch

>

CloudTrail SNS topic name undefined

ansible-aws-cloudtrail-sns-topic-name-undefined

>

CloudWatch without retention period specified

ansible-aws-cloudwatch-without-retention-period-specified

>

CMK is unusable

ansible-aws-cmk-is-unusable

>

CMK rotation disabled

ansible-aws-cmk-rotation-disabled

>

CodeBuild project is not encrypted

ansible-aws-codebuild-not-encrypted

>

Config rule for encrypted volumes disabled

ansible-aws-config-rule-for-encrypted-volumes-is-disabled

>

Configuration aggregator to all regions disabled

ansible-aws-config-configuration-aggregator-to-all-regions-disabled

>

Cross-account IAM assume role policy without ExternalId or MFA

ansible-aws-cross-account-iam-assume-role-policy-without-external-id-or-mfa

>

DB instance storage not encrypted

ansible-aws-db-instance-storage-not-encrypted

>

DB security group open to large scope

ansible-aws-db-security-group-open-to-large-scope

>

DB security group with public scope

ansible-aws-db-security-group-with-public-scope

>

Default security groups with unrestricted traffic

ansible-aws-default-security-groups-with-unrestricted-traffic

>

EBS volume encryption disabled

ansible-aws-ebs-volume-encryption-disabled

>

EC2 instance has public IP

ansible-aws-ec2-instance-has-public-ip

>

EC2 instance is not EBS optimized

ansible-aws-ec2-not-ebs-optimized

>

EC2 instance using default security group

ansible-aws-ec2-instance-using-default-security-group

>

EC2 instance using default VPC

ansible-aws-ec2-instance-using-default-vpc

>

EC2 security group allows public access

ansible-aws-ec2-group-has-public-interface

>

ECR image tag not immutable

ansible-aws-ecr-image-tag-not-immutable

>

ECR repository is publicly accessible

ansible-aws-ecr-repository-is-publicly-accessible

>

ECS service admin role is present

ansible-aws-ecs-service-admin-role-is-present

>

ECS service without running tasks

ansible-aws-ecs-service-without-running-tasks

>

ECS services should not be assigned public IP addresses

ansible-aws-ecs-services-assigned-with-public-ip-address

>

ECS task definition network mode not recommended

ansible-aws-ecs-task-definition-network-mode-not-recommended

>

EFS not encrypted

ansible-aws-efs-not-encrypted

>

EFS without KMS

ansible-aws-efs-without-kms

>

EFS without tags

ansible-aws-efs-without-tags

>

ElastiCache using default port

ansible-aws-elasticache-using-default-port

>

ElastiCache without VPC

ansible-aws-elasticache-without-vpc

>

Elasticsearch with HTTPS disabled

ansible-aws-elasticsearch-with-https-disabled

>

ELB using insecure protocols

ansible-aws-elb-using-insecure-protocols

>

ELB using weak ciphers

ansible-aws-elb-using-weak-ciphers

>

Hardcoded AWS access key

ansible-aws-hardcoded-aws-access-key

>

Hardcoded AWS access key in Lambda

ansible-aws-hardcoded-aws-access-key-in-lambda

>

HTTP port open to internet

ansible-aws-http-port-open-to-internet

>

IAM access key is exposed

ansible-aws-iam-access-key-is-exposed

>

IAM database authentication is not enabled

ansible-aws-iam-database-auth-not-enabled

>

IAM group without users

ansible-aws-iam-group-without-users

>

IAM password without minimum length

ansible-aws-iam-password-without-minimum-length

>

IAM policies attached to user

ansible-aws-iam-policies-attached-to-user

>

IAM policies with full privileges

ansible-aws-iam-policies-with-full-privileges

>

IAM policy grants 'AssumeRole' permission across all services

ansible-aws-iam-policy-grants-assumerole-permission-across-all-services

>

IAM policy grants full permissions

ansible-aws-iam-policy-grants-full-permissions

>

IAM role allows all principals to assume

ansible-aws-iam-role-allows-all-principals-to-assume

>

Instance uses metadata service IMDSv1

ansible-aws-instance-uses-metadata-service-imdsv1

>

Instance with no VPC

ansible-aws-instance-with-no-vpc

>

Kinesis not encrypted with KMS

ansible-aws-kinesis-not-encrypted-with-kms

>

KMS key with vulnerable policy

ansible-aws-kms-key-with-full-permissions

>

Lambda function without tags

ansible-aws-lambda-function-without-tags

>

Lambda functions without X-Ray tracing

ansible-aws-lambda-functions-without-x-ray-tracing

>

Lambda permission misconfigured

ansible-aws-lambda-permission-misconfigured

>

Lambda permission principal is wildcard

ansible-aws-lambda-permission-principal-is-wildcard

>

Launch configuration is not encrypted

ansible-aws-launch-configuration-is-not-encrypted

>

Misconfigured password policy expiration

ansible-aws-misconfigured-password-policy-expiration

>

No stack policy

ansible-aws-no-stack-policy

>

Password without reuse prevention

ansible-aws-password-without-reuse-prevention

>

Public Lambda via API Gateway

ansible-aws-public-lambda-via-api-gateway

>

Public port with wide port range

ansible-aws-public-port-wide

>

RDS DB instance is not publicly accessible

ansible-aws-rds-db-instance-publicly-accessible

>

RDS instance associated with a public subnet

ansible-aws-rds-associated-with-public-subnet

>

RDS instance uses a default port

ansible-aws-rds-using-default-port

>

RDS instance with backup disabled

ansible-aws-rds-with-backup-disabled

>

Redis not compliant

ansible-aws-redis-not-compliant

>

Redshift cluster is not encrypted

ansible-aws-redshift-not-encrypted

>

Redshift publicly accessible

ansible-aws-redshift-publicly-accessible

>

Redshift using default port

ansible-aws-redshift-using-default-port

>

Remote desktop port open to internet

ansible-aws-remote-desktop-port-open

>

Root account has active access keys

ansible-aws-root-account-has-active-access-keys

>

Route 53 record undefined

ansible-aws-route53-record-undefined

>

S3 bucket access to any principal

ansible-aws-s3-bucket-access-to-any-principal

>

S3 bucket ACL allows read access to all users

ansible-aws-s3-bucket-acl-allows-read-to-all-users

>

S3 bucket ACL allows read access to any authenticated user

ansible-aws-s3-bucket-acl-allows-read-to-any-authenticated-user

>

S3 bucket allows delete action from all principals

ansible-aws-s3-bucket-allows-delete-action-from-all-principals

>

S3 bucket allows GET action from all principals

ansible-aws-s3-bucket-allows-get-action-from-all-principals

>

S3 bucket allows list action from all principals

ansible-aws-s3-bucket-allows-list-action-from-all-principals

>

S3 bucket allows put action from all principals

ansible-aws-s3-bucket-allows-put-action-from-all-principals

>

S3 bucket logging disabled

ansible-aws-s3-bucket-logging-disabled

>

S3 bucket with all permissions

ansible-aws-s3-bucket-with-all-permissions

>

S3 bucket with public access

ansible-aws-s3-bucket-with-public-access

>

S3 bucket with unsecured CORS rule

ansible-aws-s3-bucket-with-unsecured-cors-rule

>

S3 bucket without server-side encryption

ansible-aws-s3-bucket-without-server-side-encryption

>

S3 bucket without versioning

ansible-aws-s3-bucket-without-versioning

>

Secure ciphers disabled

ansible-aws-secure-ciphers-disabled

>

Security group ingress not restricted

ansible-aws-security-group-ingress-not-restricted

>

Security group with unrestricted access to SSH

ansible-aws-security-group-with-unrestricted-access-to-ssh

>

SES policy with allowed IAM actions

ansible-aws-ses-policy-with-allowed-iam-actions

>

SNS topic is publicly accessible

ansible-aws-sns-topic-is-publicly-accessible

>

SQL Analysis Services port 2383 (TCP) is publicly accessible

ansible-aws-sql-analysis-services-port-2383-is-publicly-accessible

>

SQS policy allows all actions

ansible-aws-sqs-policy-allows-all-actions

>

SQS policy with public access

ansible-aws-sqs-policy-with-public-access

>

SQS queue exposed

ansible-aws-sqs-queue-exposed

>

SQS queue with SSE disabled

ansible-aws-sqs-with-sse-disabled

>

Stack notifications disabled

ansible-aws-stack-notifications-disabled

>

Stack retention disabled

ansible-aws-stack-retention-disabled

>

Stack without template

ansible-aws-stack-without-template

>

Unknown port exposed to internet

ansible-aws-unknown-port-exposed-to-internet

>

Unrestricted security group ingress

ansible-aws-unrestricted-security-group-ingress

>

User data contains encoded private key

ansible-aws-user-data-contains-encoded-private-key

>

Vulnerable default SSL certificate

ansible-aws-vulnerable-default-ssl-certificate

>

Ansible / AWS

>

AD admin not configured for SQL server

ansible-azure-ad-admin-not-configured-for-sql-server

>

Admin user enabled for container registry

ansible-azure-admin-user-enabled-for-container-registry

>

AKS monitoring logging disabled

ansible-azure-aks-monitoring-logging-disabled

>

AKS network policy misconfigured

ansible-azure-aks-network-policy-misconfigured

>

AKS RBAC disabled

ansible-azure-aks-rbac-disabled

>

Azure Container Registry with no locks

ansible-azure-azure-container-registry-with-no-locks

>

Azure instance using basic authentication

ansible-azure-azure-instance-using-basic-authentication

>

Cosmos DB account without tags

ansible-azure-cosmosdb-account-without-tags

>

CosmosDB account IP range filter not set

ansible-azure-cosmosdb-account-ip-range-filter-not-set

>

Default Azure storage account network access is too permissive

ansible-azure-default-azure-storage-account-network-access-is-too-permissive

>

Firewall rule allows too many hosts to access Redis Cache

ansible-azure-firewall-rule-allows-too-many-hosts-to-access-redis-cache

>

Key Vault soft delete is disabled

ansible-azure-key-vault-soft-delete-is-disabled

>

Log retention is not set

ansible-azure-log-retention-is-not-set

>

Monitoring log profile without all activities

ansible-azure-monitoring-log-profile-without-all-activities

>

MySQL SSL connection disabled

ansible-azure-mysql-ssl-connection-disabled

>

PostgreSQL log checkpoints disabled

ansible-azure-postgresql-log-checkpoints-disabled

>

PostgreSQL log connections not set

ansible-azure-postgresql-log-connections-not-set

>

PostgreSQL log disconnections not set

ansible-azure-postgresql-log-disconnections-not-set

>

PostgreSQL log duration not set

ansible-azure-postgresql-log-duration-not-set

>

PostgreSQL server without connection throttling

ansible-azure-postgresql-server-without-connection-throttling

>

Public storage account

ansible-azure-public-storage-account

>

Redis cache allows non-SSL connections

ansible-azure-redis-cache-allows-non-ssl-connections

>

Redis entirely accessible

ansible-azure-redis-entirely-accessible

>

Redis publicly accessible

ansible-azure-redis-publicly-accessible

>

Role definition allows custom role creation

ansible-azure-role-definition-allows-custom-role-creation

>

Security group is not configured

ansible-azure-security-group-is-not-configured

>

Sensitive port is exposed to entire network

ansible-azure-sensitive-port-is-exposed-to-entire-network

>

Small activity log retention period

ansible-azure-small-activity-log-retention-period

>

SQL Server predictable Active Directory account name

ansible-azure-sql-server-predictable-active-directory-admin-account-name

>

SQL Server predictable admin account name

ansible-azure-sql-server-predictable-admin-account-name

>

SQLServer ingress from any IP

ansible-azure-sql-server-ingress-from-any-ip

>

SSL enforce disabled

ansible-azure-ssl-enforce-is-disabled

>

Storage account not forcing HTTPS

ansible-azure-storage-account-not-forcing-https

>

Storage account not using latest TLS encryption version

ansible-azure-storage-account-not-using-latest-tls-encryption-version

>

Storage container is publicly accessible

ansible-azure-storage-container-is-publicly-accessible

>

Trusted Microsoft services not enabled

ansible-azure-trusted-microsoft-services-not-enabled

>

Unrestricted SQL Server access

ansible-azure-unrestricted-sql-server-access

>

VM not attached to network

ansible-azure-vm-not-attached-to-network

>

WAF is disabled for Azure Application Gateway

ansible-azure-waf-is-disabled-for-azure-application-gateway

>

Web app accepting traffic other than HTTPS

ansible-azure-web-app-accepting-traffic-other-than-https

>

Ansible / Azure

>

BigQuery dataset is public

ansible-gcp-bigquery-dataset-is-public

>

Client certificate disabled

ansible-gcp-client-certificate-disabled

>

Cloud DNS without DNSSEC

ansible-gcp-cloud-dns-without-dnssec

>

Cloud SQL instance with contained database authentication on

ansible-gcp-cloud-sql-instance-with-contained-database-authentication-on

>

Cloud SQL instance with cross DB ownership chaining on

ansible-gcp-cloud-sql-instance-with-cross-db-ownership-chaining-on

>

Cloud storage anonymous or publicly accessible

ansible-gcp-cloud-storage-anonymous-or-publicly-accessible

>

Cloud storage bucket logging not enabled

ansible-gcp-cloud-storage-bucket-logging-not-enabled

>

Cloud storage bucket versioning disabled

ansible-gcp-cloud-storage-bucket-versioning-disabled

>

Cluster labels disabled

ansible-gcp-cluster-labels-disabled

>

Cluster master authentication disabled

ansible-gcp-cluster-master-authentication-disabled

>

Compute instance is publicly accessible

ansible-gcp-compute-instance-is-publicly-accessible

>

COS node image not used

ansible-gcp-cos-node-image-not-used

>

Disk encryption disabled

ansible-gcp-disk-encryption-disabled

>

DNSSEC using RSASHA1

ansible-gcp-dnssec-using-rsasha1

>

GKE basic authentication enabled

ansible-gcp-gke-basic-authentication-enabled

>

GKE legacy authorization enabled

ansible-gcp-gke-legacy-authorization-enabled

>

GKE master authorized networks disabled

ansible-gcp-gke-master-authorized-networks-disabled

>

GKE using default service account

ansible-gcp-gke-using-default-service-account

>

Google Compute network using default firewall rule

ansible-gcp-google-compute-network-using-default-firewall-rule

>

Google Compute network using firewall rule that allows all ports

ansible-gcp-google-compute-network-using-firewall-rule-allows-all-ports

>

Google Compute network using firewall rule that allows port range

ansible-gcp-google-compute-network-using-firewall-allows-port-range

>

Google Compute SSL policy weak cipher in use

ansible-gcp-google-compute-ssl-policy-weak-cipher-in-use

>

Google Compute subnetwork with Private Google Access disabled

ansible-gcp-google-compute-subnetwork-with-private-google-access-disabled

>

Google container node pool auto repair disabled

ansible-gcp-google-container-node-pool-auto-repair-disabled

>

High Google KMS crypto key rotation period

ansible-gcp-high-google-kms-crypto-key-rotation-period

>

IP aliasing disabled

ansible-gcp-ip-aliasing-disabled

>

IP forwarding enabled

ansible-gcp-ip-forwarding-enabled

>

MySQL instance with local infile on

ansible-gcp-mysql-instance-with-local-infile-on

>

Network policy disabled

ansible-gcp-network-policy-disabled

>

Node auto-upgrade disabled

ansible-gcp-node-auto-upgrade-disabled

>

OSLogin is disabled in VM instance

ansible-gcp-oslogin-is-disabled-for-vm-instance

>

PostgreSQL log connections disabled

ansible-gcp-postgresql-log-connections-disabled

>

PostgreSQL log_checkpoints flag not set to on

ansible-gcp-postgresql-log-checkpoints-flag-not-set-to-on

>

PostgreSQL logging of temporary files disabled

ansible-gcp-postgresql-logging-of-temporary-files-disabled

>

PostgreSQL misconfigured log messages flag

ansible-gcp-postgresql-misconfigured-log-messages-flag

>

PostgreSQL misconfigured logging duration flag

ansible-gcp-postgresql-misconfigured-logging-duration-flag

>

Private cluster disabled

ansible-gcp-private-cluster-disabled

>

Project-wide SSH keys are enabled in VM instances

ansible-gcp-project-wide-ssh-keys-are-enabled-in-vm-instances

>

RDP access is not restricted

ansible-gcp-rdp-access-is-not-restricted

>

Serial ports are enabled for VM instances

ansible-gcp-serial-ports-enabled-for-vm-instances

>

Shielded VM disabled

ansible-gcp-shielded-vm-disabled

>

SQL DB instance backup disabled

ansible-gcp-sql-db-instance-backup-disabled

>

SQL DB instance publicly accessible

ansible-gcp-sql-db-instance-is-publicly-accessible

>

SQL DB instance with SSL disabled

ansible-gcp-sql-db-instance-with-ssl-disabled

>

SSH access is not restricted

ansible-gcp-ssh-access-is-not-restricted

>

Stackdriver logging disabled

ansible-gcp-stackdriver-logging-disabled

>

Stackdriver monitoring disabled

ansible-gcp-stackdriver-monitoring-disabled

>

Using default service account

ansible-gcp-using-default-service-account

>

VM with full cloud access

ansible-gcp-vm-with-full-cloud-access

>

Ansible / GCP

>

Anonymous definition

cicd-github-anonymous-definition

>

Cache poisoning

cicd-github-cache-poisoning

>

Concurrency limits

cicd-github-concurrency-limits

>

Dangerous triggers

cicd-github-dangerous-triggers

>

Dependabot cooldown

cicd-github-dependabot-cooldown

>

Dependabot execution

cicd-github-dependabot-execution

>

GitHub environment file injection

cicd-github-github-env

>

Hardcoded container credentials

cicd-github-hardcoded-container-credentials

>

Misfeature

cicd-github-misfeature

>

Obfuscation

cicd-github-obfuscation

>

Overprovisioned secrets

cicd-github-overprovisioned-secrets

>

Run block injection

cicd-github-run-block-injection

>

Script block injection

cicd-github-script-block-injection

>

Secrets inherit

cicd-github-secrets-inherit

>

Secrets outside environment

cicd-github-secrets-outside-env

>

Self-hosted runner

cicd-github-self-hosted-runner

>

Superfluous actions

cicd-github-superfluous-actions

>

Unpinned actions full length commit SHA

cicd-github-unpinned-actions-full-length-commit-sha

>

Unpinned images

cicd-github-unpinned-images

>

Unredacted secrets

cicd-github-unredacted-secrets

>

Unsecured commands

cicd-github-unsecured-commands

>

Unsound condition

cicd-github-unsound-conditions

>

Unsound contains with controllable input

cicd-github-unsound-contains-with-controllable-input

>

Unsound contains without controllable input

cicd-github-unsound-contains-no-controllable-input

>

Unspecified workflows level permissions

cicd-github-unspecified-workflows-permissions

>

Use trusted publishing for authentication

cicd-github-use-trusted-publishing

>

CICD / GitHub

>

ALB is not integrated with WAF

cloudformation-aws-alb-is-not-integrated-with-waf

>

ALB listening on HTTP

cloudformation-aws-alb-listening-on-http

>

Alexa skill plaintext client secret exposed

cloudformation-aws-alexa-skill-plaintext-client-secret-exposed

>

Amazon MQ broker encryption disabled

cloudformation-aws-amazon-mq-broker-encryption-disabled

>

Amazon MQ broker is publicly accessible

cloudformation-aws-mq-broker-is-publicly-accessible

>

Amazon MQ broker logging disabled

cloudformation-aws-mq-broker-logging-disabled

>

Amplify app access token exposed

cloudformation-aws-amplify-app-access-token-exposed

>

Amplify app basic auth config password exposed

cloudformation-aws-amplify-app-basic-auth-config-password-exposed

>

Amplify app OAuth token exposed

cloudformation-aws-amplify-app-oauth-token-exposed

>

Amplify branch basic auth config password exposed

cloudformation-aws-amplify-branch-basic-auth-config-password-exposed

>

API Gateway cache cluster disabled

cloudformation-aws-api-gateway-cache-cluster-disabled

>

API Gateway cache encrypted disabled

cloudformation-aws-api-gateway-cache-encrypted-disabled

>

API Gateway deployment without access log setting

cloudformation-aws-api-gateway-deployment-without-access-log-setting

>

API Gateway deployment without usage plan associated

cloudformation-aws-api-gateway-deployment-without-api-gateway-usage-plan-associated

>

API Gateway endpoint config is not private

cloudformation-aws-api-gateway-endpoint-config-is-not-private

>

API Gateway method does not contain an API key

cloudformation-aws-api-gateway-method-does-not-contain-an-api-key

>

API Gateway stage without usage plan associated

cloudformation-aws-api-gateway-stage-without-api-gateway-usage-plan-associated

>

API Gateway V2 stage access logging settings not defined

cloudformation-aws-api-gateway-access-logging-disabled

>

API Gateway with invalid compression

cloudformation-aws-api-gateway-with-invalid-compression

>

API Gateway with open access

cloudformation-aws-api-gateway-with-open-access

>

API Gateway without configured authorizer

cloudformation-aws-api-gateway-without-configured-authorizer

>

API Gateway without security policy

cloudformation-aws-api-gateway-without-security-policy

>

API Gateway without SSL certificate

cloudformation-aws-api-gateway-without-ssl-certificate

>

API Gateway without WAF

cloudformation-aws-api-gateway-without-waf

>

API Gateway X-Ray disabled

cloudformation-aws-api-gateway-xray-disabled

>

Auto Scaling group with no associated ELB

cloudformation-aws-auto-scaling-group-with-no-associated-elb

>

Automatic minor upgrades disabled

cloudformation-aws-automatic-minor-upgrades-disabled

>

AWS DMS replication instance is publicly accessible

cloudformation-aws-amazon-dms-replication-instance-is-publicly-accessible

>

Batch job definition with privileged container properties

cloudformation-aws-batch-job-definition-with-privileged-container-properties

>

CDN configuration is missing

cloudformation-aws-cdn-configuration-is-missing

>

CloudFormation metadata contains plaintext credentials

cloudformation-aws-cloudformation-specifying-credentials-not-safe

>

CloudFront logging disabled

cloudformation-aws-cloudfront-logging-disabled

>

CloudFront viewer protocol policy allows HTTP

cloudformation-aws-cloudfront-viewer-protocol-policy-allows-http

>

CloudFront without minimum protocol TLS 1.2

cloudformation-aws-cloudfront-without-minimum-protocol-tls-1-2

>

CloudFront without WAF

cloudformation-aws-cloudfront-without-waf

>

CloudTrail log file validation disabled

cloudformation-aws-cloudtrail-log-file-validation-disabled

>

CloudTrail log files not encrypted with KMS

cloudformation-aws-cloudtrail-log-files-not-encrypted-with-kms

>

CloudTrail logging disabled

cloudformation-aws-cloudtrail-logging-disabled

>

CloudTrail multi-region disabled

cloudformation-aws-cloudtrail-multi-region-disabled

>

CloudTrail not integrated with CloudWatch

cloudformation-aws-cloudtrail-not-integrated-with-cloudwatch

>

CloudTrail SNS topic name undefined

cloudformation-aws-cloudtrail-sns-topic-name-undefined

>

CloudWatch logging disabled

cloudformation-aws-cloudwatch-logging-disabled

>

CloudWatch metrics disabled

cloudformation-aws-cloudwatch-metrics-disabled

>

CMK is unusable

cloudformation-aws-cmk-is-unusable

>

CMK rotation disabled

cloudformation-aws-cmk-rotation-disabled

>

CMK unencrypted storage

cloudformation-aws-cmk-unencrypted-storage

>

CodeBuild not encrypted

cloudformation-aws-codebuild-not-encrypted

>

Cognito user pool without MFA

cloudformation-aws-cognito-userpool-without-mfa

>

Config rule for encrypted volumes disabled

cloudformation-aws-config-rule-for-encryption-volumes-disabled

>

Configuration aggregator to all regions disabled

cloudformation-aws-config-configuration-aggregator-to-all-regions-disabled

>

Connection between CloudFront origin not encrypted

cloudformation-aws-connection-between-cloudfront-origin-not-encrypted

>

Cross-account IAM assume role policy without external ID or MFA

cloudformation-aws-cross-account-iam-assume-role-policy-without-external-id-or-mfa

>

DB security group open to large scope

cloudformation-aws-db-security-group-open-to-large-scope

>

DB security group with public scope

cloudformation-aws-db-security-group-with-public-scope

>

Default KMS key usage

cloudformation-aws-default-kms-key-usage

>

Default security groups with unrestricted traffic

cloudformation-aws-default-security-groups-with-unrestricted-traffic

>

Directory service Microsoft AD password set to plaintext or default ref

cloudformation-aws-directory-service-microsoft-ad-password-set-to-plaintext-or-default-ref

>

Directory service simple AD password exposed

cloudformation-aws-directory-service-simple-ad-password-exposed

>

DMS endpoint MongoDB settings password exposed

cloudformation-aws-dms-endpoint-mongo-db-settings-password-exposed

>

DMS endpoint password exposed

cloudformation-aws-dms-endpoint-password-exposed

>

DocDB cluster master password in plaintext

cloudformation-aws-docdb-cluster-master-password-in-plaintext

>

DocDB logging is disabled

cloudformation-aws-docdb-logging-disabled

>

DynamoDB table not encrypted

cloudformation-aws-dynamodb-table-not-encrypted

>

DynamoDB table point-in-time recovery disabled

cloudformation-aws-dynamodb-table-point-in-time-recovery-disabled

>

DynamoDB with AWS-owned CMK

cloudformation-aws-dynamodb-with-aws-owned-cmk

>

DynamoDB with non-recommended table billing mode

cloudformation-aws-dynamodb-with-table-billing-mode-not-recommended

>

EBS volume encryption disabled

cloudformation-aws-ebs-volume-encryption-disabled

>

EBS volume not attached to instances

cloudformation-aws-ebs-volume-not-attached-to-instances

>

EBS volume without KmsKeyId

cloudformation-aws-ebs-volume-without-kms-key-id

>

EC2 instance has no IAM role

cloudformation-aws-ec2-instance-has-no-iam-role

>

EC2 instance monitoring disabled

cloudformation-aws-ec2-instance-monitoring-disabled

>

EC2 instance subnet has public IP mapping on launch

cloudformation-aws-ec2-instance-subnet-has-public-ip-mapping-on-launch

>

EC2 instance using default security group

cloudformation-aws-ec2-instance-using-default-security-group

>

EC2 instance using default VPC

cloudformation-aws-ec2-instance-using-default-vpc

>

EC2 Network ACL Deny rule not blocking all traffic

cloudformation-aws-ec2-network-acl-ineffective-denied-traffic

>

EC2 network ACL duplicate rule

cloudformation-aws-ec2-network-acl-duplicate-rule

>

EC2 network ACL overlapping ports

cloudformation-aws-ec2-network-acl-overlapping-ports

>

EC2 not EBS optimized

cloudformation-aws-ec2-not-ebs-optimized

>

EC2 permissive network ACL protocols

cloudformation-aws-ec2-permissive-network-acl-protocols

>

EC2 public instance exposed through subnet

cloudformation-aws-ec2-public-instance-exposed-through-subnet

>

EC2 sensitive port is publicly exposed

cloudformation-aws-ec2-sensitive-port-is-publicly-exposed

>

ECR image tag not immutable

cloudformation-aws-ecr-image-tag-not-immutable

>

ECR repository is publicly accessible

cloudformation-aws-ecr-repository-is-publicly-accessible

>

ECS cluster not encrypted at rest

cloudformation-aws-ecs-cluster-not-encrypted-at-rest

>

ECS cluster with Container Insights disabled

cloudformation-aws-ecs-cluster-container-insights-disabled

>

ECS no load balancer attached

cloudformation-aws-ecs-no-load-balancer-attached

>

ECS service admin role is present

cloudformation-aws-ecs-service-admin-role-is-present

>

ECS service without running tasks

cloudformation-aws-ecs-service-without-running-tasks

>

ECS task definition health check missing

cloudformation-aws-ecs-task-definition-healthcheck-missing

>

ECS task definition invalid CPU or memory

cloudformation-aws-ecs-task-definition-invalid-cpu-or-memory

>

ECS task definition network mode not recommended

cloudformation-aws-ecs-task-definition-network-mode-not-recommended

>

EFS not encrypted

cloudformation-aws-efs-not-encrypted

>

EFS volume with disabled transit encryption

cloudformation-aws-efs-volume-with-disabled-transit-encryption

>

EFS without KMS

cloudformation-aws-efs-without-kms

>

EFS without tags

cloudformation-aws-efs-without-tags

>

EKS node group remote access

cloudformation-aws-eks-node-group-remote-access

>

ElastiCache nodes not created across multi-AZ

cloudformation-aws-elasticache-nodes-not-created-across-multi-az

>

ElastiCache using default port

cloudformation-aws-elasticache-using-default-port

>

ElastiCache with disabled at-rest encryption

cloudformation-aws-elasticache-with-disabled-at-rest-encryption

>

ElastiCache with disabled transit encryption

cloudformation-aws-elasticache-with-disabled-transit-encryption

>

ElastiCache without VPC

cloudformation-aws-elasticache-without-vpc

>

Elasticsearch encryption with KMS disabled

cloudformation-aws-elasticsearch-domain-encryption-with-kms-disabled

>

Elasticsearch logs disabled

cloudformation-aws-elasticsearch-logs-disabled

>

Elasticsearch not encrypted at rest

cloudformation-aws-elasticsearch-not-encrypted-at-rest

>

Elasticsearch with HTTPS disabled

cloudformation-aws-elasticsearch-with-https-disabled

>

Elasticsearch without IAM authentication

cloudformation-aws-elasticsearch-without-iam-authentication

>

Elasticsearch without slow logs

cloudformation-aws-elasticsearch-without-slow-logs

>

ELB access log disabled

cloudformation-aws-elb-access-log-disabled

>

ELB sensitive port is exposed to entire network

cloudformation-aws-elb-sensitive-port-is-exposed-to-entire-network

>

ELB using insecure protocols

cloudformation-aws-elb-using-insecure-protocols

>

ELB using weak ciphers

cloudformation-aws-elb-using-weak-ciphers

>

ELB with security group without inbound rules

cloudformation-aws-elb-with-security-group-without-inbound-rules

>

ELB with security group without outbound rules

cloudformation-aws-elb-with-security-group-without-outbound-rules

>

ELB without secure protocol

cloudformation-aws-elb-without-secure-protocol

>

ELBv2 ALB access log disabled

cloudformation-aws-elb-v2-alb-access-log-disabled

>

Empty roles for ECS cluster task definitions

cloudformation-aws-empty-roles-for-ecs-cluster-task-definitions

>

EMR cluster without security configuration

cloudformation-aws-emr-cluster-without-security-configuration

>

EMR security configuration encryption disabled

cloudformation-aws-emr-security-configuration-encryptions-enabled

>

EMR without VPC

cloudformation-aws-emr-wihout-vpc

>

Fully open ingress

cloudformation-aws-fully-open-ingress

>

GameLift fleet EC2 inbound permissions with port range

cloudformation-aws-gamelift-fleet-ec2-inbound-permissions-with-port-range

>

Geo restriction disabled

cloudformation-aws-geo-restriction-disabled

>

GitHub repository set to public

cloudformation-aws-github-repository-set-to-public

>

GuardDuty detector disabled

cloudformation-aws-guardduty-detector-disabled

>

Hardcoded AWS access key in Lambda

cloudformation-aws-hardcoded-aws-access-key-in-lambda

>

High access key rotation period

cloudformation-aws-access-key-not-rotated-within-90-days

>

HTTP port open to internet

cloudformation-aws-http-port-open

>

IAM Access Analyzer not enabled

cloudformation-aws-iam-access-analyzer-not-enabled

>

IAM database auth not enabled

cloudformation-aws-iam-database-auth-not-enabled

>

IAM group inline policies

cloudformation-aws-iam-groups-inline-policies

>

IAM group without users

cloudformation-aws-iam-group-without-users

>

IAM managed policy applied to a user

cloudformation-aws-iam-managed-policy-applied-to-a-user

>

IAM password without minimum length

cloudformation-aws-iam-password-without-minimum-length

>

IAM policies attached to a user

cloudformation-aws-iam-policies-attached-to-user

>

IAM policies with full privileges

cloudformation-aws-iam-policies-with-full-privileges

>

IAM policies without groups

cloudformation-aws-iam-policies-without-groups

>

IAM policy grants AssumeRole permission across all services

cloudformation-aws-iam-policy-grants-assumerole-permission-across-all-services

>

IAM policy grants full permissions

cloudformation-aws-iam-policy-grants-full-permissions

>

IAM policy on user

cloudformation-aws-iam-policy-on-user

>

IAM role allows all principals to assume

cloudformation-aws-iam-role-allows-all-principals-to-assume

>

IAM user has too many access keys

cloudformation-aws-iam-user-too-many-access-keys

>

IAM user LoginProfile password is in plaintext

cloudformation-aws-iam-user-login-profile-password-is-in-plaintext

>

IAM user with no group

cloudformation-aws-iam-user-with-no-group

>

IAM user without password reset

cloudformation-aws-user-iam-missing-password-reset-required

>

Inline policies are attached to an ECS service

cloudformation-aws-inline-policies-are-attached-to-ecs-service

>

Instance with no VPC

cloudformation-aws-instance-with-no-vpc

>

IoT policy allows a wildcard resource

cloudformation-aws-iot-policy-allows-wildcard-resource

>

IoT policy allows action as a wildcard

cloudformation-aws-iot-policy-allows-action-as-wildcard

>

Kinesis SSE not configured

cloudformation-aws-kinesis-sse-not-configured

>

KMS allows a wildcard principal

cloudformation-aws-kms-allows-wildcard-principal

>

KMS key rotation disabled

cloudformation-aws-kms-enable-key-rotation-disabled

>

KMS key with a vulnerable policy

cloudformation-aws-kms-key-with-full-permissions

>

Lambda function without dead-letter queue

cloudformation-aws-lambda-function-without-dead-letter-queue

>

Lambda function without tags

cloudformation-aws-lambda-function-without-tags

>

Lambda functions with full privileges

cloudformation-aws-lambda-functions-with-full-privileges

>

Lambda functions without unique IAM roles

cloudformation-aws-lambda-functions-without-unique-iam-roles

>

Lambda functions without X-Ray tracing

cloudformation-aws-lambda-functions-without-x-ray-tracing

>

Lambda permission misconfigured

cloudformation-aws-lambda-permission-misconfigured

>

Lambda permission principal is a wildcard

cloudformation-aws-lambda-permission-principal-is-wildcard

>

Low RDS backup retention period

cloudformation-aws-low-rds-backup-retention-period

>

MSK broker is publicly accessible

cloudformation-aws-msk-broker-is-publicly-accessible

>

MSK cluster encryption disabled

cloudformation-aws-msk-cluster-encryption-disabled

>

MSK cluster logging disabled

cloudformation-aws-msk-cluster-logging-disabled

>

Neptune cluster with IAM database authentication disabled

cloudformation-aws-neptune-cluster-with-iam-database-authentication-disabled

>

Neptune database cluster encryption disabled

cloudformation-aws-neptune-database-cluster-encryption-disabled

>

Permissive Web ACL default action

cloudformation-aws-webacl-allow-defaultaction

>

Public Lambda function via API Gateway

cloudformation-aws-public-lambda-via-api-gateway

>

RDS associated with a public subnet

cloudformation-aws-rds-associated-with-public-subnet

>

RDS DB instance publicly accessible

cloudformation-aws-rds-db-instance-publicly-accessible

>

RDS DB instance with deletion protection disabled

cloudformation-aws-rds-db-instance-with-deletion-protection-disabled

>

RDS Multi-AZ deployment disabled

cloudformation-aws-rds-multi-az-deployment-disabled

>

RDS storage encryption disabled

cloudformation-aws-rds-storage-encryption-disabled

>

RDS storage not encrypted

cloudformation-aws-rds-storage-not-encrypted

>

RDS using default port

cloudformation-aws-rds-using-default-port

>

RDS with backup disabled

cloudformation-aws-rds-with-backup-disabled

>

Redshift cluster logging disabled

cloudformation-aws-redshift-cluster-logging-disabled

>

Redshift cluster without a KMS CMK

cloudformation-aws-redshift-cluster-without-kms-cmk

>

Redshift not encrypted

cloudformation-aws-redshift-not-encrypted

>

Redshift publicly accessible

cloudformation-aws-redshift-publicly-accessible

>

Redshift using default port

cloudformation-aws-redshift-using-default-port

>

Refresh token is exposed

cloudformation-aws-refresh-token-is-exposed

>

Remote Desktop port open to the internet

cloudformation-aws-remote-desktop-port-open-to-internet

>

Root account has active access keys

cloudformation-aws-root-account-has-active-access-keys

>

Route table with default routing

cloudformation-aws-routertable-with-default-routing

>

Route53 record undefined

cloudformation-aws-route53-record-undefined

>

S3 bucket access to any principal

cloudformation-aws-s3-bucket-access-to-any-principal

>

S3 bucket ACL allows read or write to all users

cloudformation-aws-s3-bucket-acl-allows-read-or-write-to-all-users

>

S3 bucket ACL allows read to all users

cloudformation-aws-s3-bucket-acl-allows-read-to-all-users

>

S3 bucket ACL allows read to any authenticated user

cloudformation-aws-s3-bucket-acl-allows-read-to-any-authenticated-user

>

S3 bucket allows delete action from all principals

cloudformation-aws-s3-bucket-allows-delete-actions-from-all-principals

>

S3 bucket allows get action from all principals

cloudformation-aws-s3-bucket-allows-get-actions-from-all-principals

>

S3 bucket allows list action from all principals

cloudformation-aws-s3-bucket-allows-list-actions-from-all-principals

>

S3 bucket allows public ACL

cloudformation-aws-s3-bucket-allows-public-acl

>

S3 bucket allows public policy

cloudformation-aws-s3-bucket-with-public-policy

>

S3 bucket allows put action from all principals

cloudformation-aws-s3-bucket-allows-put-actions-from-all-principals

>

S3 bucket allows restore actions from all principals

cloudformation-aws-s3-bucket-allows-restore-actions-from-all-principals

>

S3 bucket CloudTrail logging disabled

cloudformation-aws-s3-bucket-cloudtrail-logging-disabled

>

S3 bucket logging disabled

cloudformation-aws-s3-bucket-logging-disabled

>

S3 bucket should have bucket policy

cloudformation-aws-s3-bucket-should-have-bucket-policy

>

S3 bucket with all permissions

cloudformation-aws-s3-bucket-with-all-permissions

>

S3 bucket with unsecured CORS rule

cloudformation-aws-s3-bucket-with-unsecured-cors-rule

>

S3 bucket without ignore public ACL

cloudformation-aws-s3-bucket-without-ignore-public-acl

>

S3 bucket without restriction of public bucket

cloudformation-aws-s3-bucket-without-restriction-of-public-bucket

>

S3 bucket without server-side encryption

cloudformation-aws-s3-bucket-without-server-side-encryption

>

S3 bucket without SSL in write actions

cloudformation-aws-s3-bucket-without-ssl-in-write-actions

>

S3 bucket without versioning

cloudformation-aws-s3-bucket-without-versioning

>

S3 static website host enabled

cloudformation-aws-s3-static-website-host-enabled

>

SageMaker data encryption disabled

cloudformation-aws-sagemaker-data-encryption-disabled

>

SageMaker enabling internet access

cloudformation-aws-sagemaker-enabling-internet-access

>

SageMaker endpoint config should specify KmsKeyId attribute

cloudformation-aws-sagemaker-endpoint-config-should-specify-kms-key-id-attribute

>

SageMaker notebook not placed in VPC

cloudformation-aws-sagemaker-notebook-not-placed-in-vpc

>

SDB domain declared as a resource

cloudformation-aws-sdb-domain-declared-as-a-resource

>

Secrets manager should specify KmsKeyId

cloudformation-aws-secrets-manager-should-specify-kms-key-id

>

Secure ciphers disabled

cloudformation-aws-secure-ciphers-disabled

>

Security group egress CIDR open to world

cloudformation-aws-security-group-egress-cidr-open-to-world

>

Security group egress with all protocols

cloudformation-aws-security-group-egress-with-all-protocols

>

Security group egress with port range

cloudformation-aws-security-group-egress-with-port-range

>

Security group ingress has CIDR not recommended

cloudformation-aws-security-group-ingress-has-cidr-not-recommended

>

Security group ingress with all protocols

cloudformation-aws-security-group-ingress-with-all-protocols

>

Security group ingress with port range

cloudformation-aws-security-group-ingress-with-port-range

>

Security group rule without description

cloudformation-aws-security-group-rule-without-description

>

Security group unrestricted access to RDP

cloudformation-aws-security-groups-unrestricted-access-to-rdp

>

Security group with unrestricted access to SSH

cloudformation-aws-security-groups-with-unrestricted-access-to-ssh

>

Security groups allows unrestricted outbound traffic

cloudformation-aws-security-groups-allows-unrestricted-outbound-traffic

>

Security groups with exposed admin ports

cloudformation-aws-security-groups-with-exhibited-admin-ports

>

Security groups with meta IP

cloudformation-aws-security-groups-with-meta-ip

>

Security groups without VPC attached

cloudformation-aws-security-groups-without-vpc-attached

>

Serverless API access logging setting undefined

cloudformation-aws-serverless-api-access-logging-setting-undefined

>

Serverless API cache cluster disabled

cloudformation-aws-serverless-api-cache-cluster-disabled

>

Serverless API endpoint config not private

cloudformation-aws-serverless-api-endpoint-config-not-private

>

Serverless API without content encoding

cloudformation-aws-serverless-api-without-content-encoding

>

Serverless API X-Ray tracing disabled

cloudformation-aws-serverless-api-xray-tracing-disabled

>

Serverless function environment variables not encrypted

cloudformation-aws-serverless-function-environment-variables-not-encrypted

>

Serverless function without dead-letter queue

cloudformation-aws-serverless-function-without-dead-letter-queue

>

Serverless function without tags

cloudformation-aws-serverless-function-without-tags

>

Serverless function without unique IAM role

cloudformation-aws-serverless-function-without-unique-iam-role

>

Serverless function without X-Ray tracing

cloudformation-aws-serverless-function-without-x-ray-tracing

>

Shield Advanced not in use

cloudformation-aws-shield-advanced-not-in-use

>

SNS topic is publicly accessible

cloudformation-aws-sns-topic-is-publicly-accessible

>

SNS topic publicity has Allow and NotAction simultaneously

cloudformation-aws-sns-topic-publicity-has-allow-and-not-action-simultaneously

>

SNS topic without KmsMasterKeyId

cloudformation-aws-sns-topic-without-kms-master-key-id

>

SQS policy with public access

cloudformation-aws-sqs-policy-with-public-access

>

SQS with SSE disabled

cloudformation-aws-sqs-with-sse-disabled

>

Stack notifications disabled

cloudformation-aws-stack-notifications-disabled

>

Stack retention disabled

cloudformation-aws-stack-retention-disabled

>

Support has no role associated

cloudformation-aws-support-has-no-role-associated

>

TCP UDP protocol network ACL entry allows all ports

cloudformation-aws-tcp-or-udp-protocol-network-acl-entry-allows-all-ports

>

Unknown port exposed to internet

cloudformation-aws-unknown-port-exposed-to-internet

>

Unrestricted security group ingress

cloudformation-aws-unrestricted-security-group-ingress

>

Unscanned ECR image

cloudformation-aws-unscanned-ecr-image

>

User data contains encoded private key

cloudformation-aws-user-data-contains-encoded-private-key

>

VPC attached with too many gateways

cloudformation-aws-vpc-attached-with-too-many-gateways

>

VPC Flow Logs disabled

cloudformation-aws-vpc-flowlogs-disabled

>

VPC without attached subnet

cloudformation-aws-vpc-without-attached-subnet

>

VPC without Network Firewall

cloudformation-aws-vpc-without-network-firewall

>

Vulnerable default SSL certificate

cloudformation-aws-vulnerable-default-ssl-certificate

>

Wildcard in ACM certificate domain name

cloudformation-aws-wildcard-in-acm-certificate-domain-name

>

Workspace without encryption

cloudformation-aws-workspace-without-encryption

>

CloudFormation / AWS

>

ADD instead of COPY

dockerfile-add-instead-of-copy

>

apk add using local cache path

dockerfile-apk-add-using-local-cache-path

>

apt-get install lists were not deleted

dockerfile-apt-get-install-lists-were-not-deleted

>

apt-get install pin version not defined

dockerfile-apt-get-install-pin-version-not-defined

>

apt-get missing flags to avoid manual input

dockerfile-apt-get-missing-flags-to-avoid-manual-input

>

apt-get not avoiding additional packages

dockerfile-apt-get-not-avoiding-additional-packages

>

Avoid chmod 777

dockerfile-avoid-chmod-777

>

Avoid HTTP

dockerfile-avoid-http

>

Changing default shell using RUN command

dockerfile-changing-default-shell-using-run-command

>

chown flag exists

dockerfile-chown-flag-exists

>

COPY --from references current FROM alias

dockerfile-copy-from-references-current-from-alias

>

COPY with more than two arguments not ending with a slash

dockerfile-copy-with-more-than-two-arguments-not-ending-with-slash

>

curl or wget instead of ADD

dockerfile-curl-or-wget-instead-of-add

>

Dockerfile should specify base image

dockerfile-should-specify-base-image

>

ENV refers to itself

dockerfile-env-no-refer-envvar

>

Exposing port 22 (SSH)

dockerfile-exposing-port-22

>

First instruction must be ARG or FROM

dockerfile-first-instruction-should-be-arg-or-from

>

gem install without version

dockerfile-gem-install-without-version

>

Healthcheck instruction missing

dockerfile-healthcheck-instruction-missing

>

Image version not explicit

dockerfile-image-version-not-explicit

>

Image version using latest

dockerfile-image-version-using-latest

>

Last user is root

dockerfile-last-user-is-root

>

MAINTAINER instruction being used

dockerfile-maintainer-instruction-being-used

>

Missing dnf clean all

dockerfile-missing-dnf-clean-all

>

Missing flag from dnf install

dockerfile-missing-flag-from-dnf-install

>

Missing user instruction

dockerfile-missing-user-instruction

>

Missing version specification in dnf install

dockerfile-missing-version-specification-in-dnf-install

>

Missing zypper clean

dockerfile-missing-zypper-clean

>

Missing Zypper non-interactive switch

dockerfile-missing-zypper-non-interactive-switch

>

Multiple CMD instructions listed

dockerfile-multiple-cmd-instructions-listed

>

Multiple ENTRYPOINT instructions listed

dockerfile-multiple-entrypoint-instructions-listed

>

Multiple HEALTHCHECK instructions

dockerfile-do-not-use-multiple-healthcheck

>

Multiple RUN, ADD, COPY instructions listed

dockerfile-multiple-run-add-copy-instructions-listed

>

Not using JSON for CMD and ENTRYPOINT arguments

dockerfile-not-using-json-in-cmd-and-entrypoint-arguments

>

npm install command without pinned version

dockerfile-npm-install-without-pinned-version

>

ONBUILD cannot trigger FROM or MAINTAINER

dockerfile-from-or-maintainer-cannot-be-triggered-within-onbuild

>

Package update without install in same RUN

dockerfile-update-instruction-alone

>

pip install keeping cached packages

dockerfile-pip-install-keeping-cached-packages

>

RUN instruction using cd instead of WORKDIR

dockerfile-run-command-cd-instead-of-workdir

>

Run using apt

dockerfile-run-using-apt

>

Run using sudo

dockerfile-run-using-sudo

>

Run using wget and curl

dockerfile-run-using-wget-and-curl

>

Run utilities and POSIX commands

dockerfile-run-utilities-and-posix-commands

>

Run yarn clean after yarn install

dockerfile-run-yarn-clean-after-yarn-install

>

Same alias in different FROM statements

dockerfile-same-alias-in-different-froms

>

Shell running a pipe without the pipefail flag

dockerfile-shell-running-a-pipe-without-pipefail-flag

>

UNIX ports out of range

dockerfile-unix-ports-out-of-range

>

Unpinned package version in apk add

dockerfile-unpinned-package-version-in-apk-add

>

Unpinned package version in pip install

dockerfile-unpinned-package-version-in-pip-install

>

Use only allowed registry in FROM

dockerfile-use-only-an-allowed-registry-in-the-from-image

>

Use recommended flags with useradd

dockerfile-use-recommended-flags-with-useradd

>

Using --platform flag with FROM command

dockerfile-using-platform-with-from

>

Using unnamed build stages

dockerfile-using-unnamed-build-stages

>

WORKDIR path not absolute

dockerfile-workdir-path-not-absolute

>

yum clean all missing

dockerfile-yum-clean-all-missing

>

yum install allows manual input

dockerfile-yum-install-allows-manual-input

>

yum install without version

dockerfile-yum-install-without-version

>

Zypper install without explicit package version

dockerfile-zypper-install-without-version

>

Dockerfile

>

Always admit admission control plugin set

kubernetes-always-admit-admission-control-plugin-set

>

Always pull images admission control plugin not set

kubernetes-always-pull-images-admission-control-plugin-not-set

>

Anonymous auth is not set to false

kubernetes-anonymous-auth-is-not-set-to-false

>

Audit log maxage not properly set

kubernetes-audit-log-maxage-not-properly-set

>

Audit log maxbackup not properly set

kubernetes-audit-log-maxbackup-not-properly-set

>

Audit log maxsize not properly set

kubernetes-audit-log-maxsize-not-properly-set

>

Audit log path not set

kubernetes-audit-log-path-not-set

>

Audit policy does not cover key security concerns

kubernetes-audit-policy-not-cover-key-security-concerns

>

Audit policy file not defined

kubernetes-audit-policy-file-not-defined

>

Authorization mode node not set

kubernetes-authorization-mode-node-not-set

>

Authorization mode RBAC not set

kubernetes-authorization-mode-rbac-not-set

>

Authorization mode set to always allow

kubernetes-authorization-mode-set-to-always-allow

>

Auto TLS set to true

kubernetes-auto-tls-set-to-true

>

Basic auth file is set

kubernetes-basic-auth-file-is-set

>

Bind address not properly set

kubernetes-bind-address-not-properly-set

>

Certificate authority is not unique

kubernetes-not-unique-certificate-authority

>

Client certificate authentication not set up properly

kubernetes-client-certificate-authentication-not-setup-properly

>

Cluster admin rolebinding with superuser permissions

kubernetes-cluster-admin-role-binding-with-super-user-permissions

>

Cluster allows unsafe sysctls

kubernetes-cluster-allows-unsafe-sysctls

>

CNI plugin does not support network policies

kubernetes-cni-plugin-does-not-support-network-policies

>

Container is privileged

kubernetes-container-is-privileged

>

Container running as root

kubernetes-containers-running-as-root

>

Container with low UID

kubernetes-containers-run-with-low-uid

>

Container with unmasked /proc access

kubernetes-container-runs-unmasked

>

Containers missing drop capabilities

kubernetes-no-drop-capabilities-for-containers

>

Containers with added capabilities

kubernetes-containers-with-added-capabilities

>

Containers with sys admin capabilities

kubernetes-containers-with-sys-admin-capabilities

>

CPU limits not set

kubernetes-cpu-limits-not-set

>

CPU requests not set

kubernetes-cpu-requests-not-set

>

CronJob deadline not configured

kubernetes-cronjob-deadline-not-configured

>

Dashboard is enabled

kubernetes-dashboard-is-enabled

>

Deployment without podAntiAffinity

kubernetes-deployment-has-no-pod-anti-affinity

>

Deployment without PodDisruptionBudget

kubernetes-deployment-without-pod-disruption-budget

>

Docker daemon socket is exposed to containers

kubernetes-docker-daemon-socket-is-exposed-to-containers

>

Encryption provider config is not defined

kubernetes-encryption-provider-config-is-not-defined

>

Encryption provider not properly configured

kubernetes-encryption-provider-not-properly-configured

>

Ensure administrative boundaries between resources

kubernetes-ensure-administrative-boundaries-between-resources

>

etcd client certificate authentication set to false

kubernetes-etcd-client-certificate-authentication-set-to-false

>

etcd client certificate file not defined

kubernetes-etcd-client-certificate-file-not-defined

>

etcd peer client certificate authentication set to false

kubernetes-etcd-peer-client-certificate-authentication-set-to-false

>

etcd peer TLS certificate files not properly set

kubernetes-etcd-peer-tls-certificate-files-not-properly-set

>

etcd TLS certificate files not properly set

kubernetes-etcd-tls-certificate-files-not-properly-set

>

etcd TLS certificate not properly configured

kubernetes-etcd-tls-certificate-not-properly-configured

>

Event rate limit admission control plugin not set

kubernetes-event-rate-limit-admission-control-plugin-not-set

>

HPA targeted deployments with configured replica count

kubernetes-hpa-targeted-deployments-with-configured-replica-count

>

HPA targets invalid object

kubernetes-hpa-targets-invalid-object

>

Image policy webhook admission control plugin not set

kubernetes-image-policy-webhook-admission-control-plugin-not-set

>

Image pull policy of the container is not set to always

kubernetes-image-pull-policy-of-container-is-not-always

>

Image without digest

kubernetes-image-without-digest

>

Incorrect volume claim access mode ReadWriteOnce

kubernetes-incorrect-volume-claim-access-mode-read-write-once

>

Ingress controller exposes workload

kubernetes-ingress-controller-exposes-workload

>

Insecure bind address set

kubernetes-insecure-bind-address-set

>

Insecure port not properly set

kubernetes-insecure-port-not-properly-set

>

Invalid image tag

kubernetes-invalid-image

>

Invalid metadata label

kubernetes-metadata-label-is-invalid

>

Kubelet certificate authority not set

kubernetes-kubelet-certificate-authority-not-set

>

Kubelet client certificate or key not set

kubernetes-kubelet-client-certificate-or-key-not-set

>

Kubelet client periodic certificate switch disabled

kubernetes-kubelet-client-periodic-certificate-switch-disabled

>

Kubelet event QPS not properly set

kubernetes-kubelet-event-qps-not-properly-set

>

Kubelet hostname override is set

kubernetes-kubelet-hostname-override-is-set

>

Kubelet HTTPS set to false

kubernetes-kubelet-https-set-to-false

>

Kubelet not managing IP tables

kubernetes-kubelet-not-managing-ip-tables

>

Kubelet protect-kernel-defaults set to false

kubernetes-kubelet-protect-kernel-defaults-set-to-false

>

Kubelet read-only port is not set to zero

kubernetes-kubelet-read-only-port-is-not-set-to-zero

>

Kubelet streaming connection timeout disabled

kubernetes-kubelet-streaming-connection-timeout-disabled

>

Liveness probe is not defined

kubernetes-liveness-probe-is-not-defined

>

Memory limits not defined

kubernetes-memory-limits-not-defined

>

Memory requests not defined

kubernetes-memory-requests-not-defined

>

Missing AppArmor profile

kubernetes-missing-app-armor-config

>

Namespace lifecycle admission control plugin disabled

kubernetes-namespace-lifecycle-admission-control-plugin-disabled

>

NET_RAW capabilities disabled for PSP

kubernetes-net-raw-capabilities-disabled-for-psp

>

NET_RAW capabilities not dropped

kubernetes-net-raw-capabilities-not-being-dropped

>

Network policy without Pod target

kubernetes-network-policy-is-not-targeting-any-pod

>

Node restriction admission control plugin not set

kubernetes-node-restriction-admission-control-plugin-not-set

>

Non kube-system pod with host mount

kubernetes-non-kube-system-pod-with-host-mount

>

Object is using a deprecated API version

kubernetes-object-is-using-a-deprecated-api-version

>

Peer auto TLS set to true

kubernetes-peer-auto-tls-set-to-true

>

Permissive access to create pods

kubernetes-permissive-access-to-create-pods

>

Pod misconfigured network policy

kubernetes-pod-misconfigured-network-policy

>

Pod or container without LimitRange

kubernetes-pod-or-container-without-limit-range

>

Pod or container without ResourceQuota

kubernetes-pod-or-container-without-resource-quota

>

Pod or container without security context

kubernetes-pod-or-container-without-security-context

>

Pod security policy admission control plugin not set

kubernetes-pod-security-policy-admission-control-plugin-not-set

>

PodSecurityPolicy allows host network sharing

kubernetes-psp-containers-share-host-network-namespace

>

Privilege escalation allowed

kubernetes-privilege-escalation-allowed

>

Profiling not set to false

kubernetes-profiling-not-set-to-false

>

PSP allows privilege escalation

kubernetes-psp-allows-privilege-escalation

>

PSP allows sharing host IPC

kubernetes-psp-allows-sharing-host-ipc

>

PSP allows sharing host PID

kubernetes-psp-allows-sharing-host-pid

>

PSP set to privileged

kubernetes-psp-set-to-privileged

>

PSP with added capabilities

kubernetes-psp-with-added-capabilities

>

PSP with unrestricted access to host path

kubernetes-psp-with-unrestricted-access-to-host-path

>

RBAC roles allow privilege escalation

kubernetes-rbac-roles-allow-privilege-escalation

>

RBAC roles with attach permission

kubernetes-rbac-roles-with-attach-permission

>

RBAC roles with exec permission

kubernetes-rbac-roles-with-exec-permission

>

RBAC roles with impersonate permission

kubernetes-rbac-roles-with-impersonate-permission

>

RBAC roles with port-forwarding permission

kubernetes-rbac-roles-with-portforwarding-permissions

>

RBAC roles with read secrets permissions

kubernetes-rbac-roles-with-read-secrets-permissions

>

RBAC wildcard in rule

kubernetes-rbac-wildcard-in-rule

>

Readiness probe is not configured

kubernetes-readiness-probe-is-not-configured

>

Request timeout not properly set

kubernetes-request-timeout-not-properly-set

>

Role binding to default service account

kubernetes-role-binding-to-default-service-account

>

Root CA file not defined

kubernetes-root-ca-file-not-defined

>

Root container not mounted as read-only

kubernetes-root-container-not-mounted-as-read-only

>

Root containers admitted

kubernetes-root-containers-admitted

>

Rotate Kubelet server certificate not active

kubernetes-rotate-kubelet-server-certificate-not-active

>

Seccomp profile is not configured

kubernetes-seccomp-profile-is-not-configured

>

Secrets used as environment variables

kubernetes-secrets-as-environment-variables

>

Secure port set to zero

kubernetes-secure-port-set-to-zero

>

Security context deny admission control plugin not set

kubernetes-security-context-deny-admission-control-plugin-not-set

>

Service account admission control plugin disabled

kubernetes-service-account-admission-control-plugin-disabled

>

Service account key file not properly set

kubernetes-service-account-key-file-not-properly-set

>

Service account lookup set to false

kubernetes-service-account-lookup-set-to-false

>

Service account name undefined or empty

kubernetes-service-account-name-undefined-or-empty

>

Service account private key file not defined

kubernetes-service-account-private-key-file-not-defined

>

Service account token auto-mount not disabled

kubernetes-service-account-token-automount-not-disabled

>

Service does not target a Pod

kubernetes-service-does-not-target-pod

>

Service type is NodePort

kubernetes-service-type-is-nodeport

>

Service with external load balancer

kubernetes-service-with-external-load-balancer

>

ServiceAccount allows access to secrets

kubernetes-service-account-allows-access-secrets

>

Shared host IPC namespace

kubernetes-shared-host-ipc-namespace

>

Shared host network namespace

kubernetes-shared-host-network-namespace

>

Shared host PID namespace

kubernetes-shared-host-pid-namespace

>

Shared service account

kubernetes-shared-service-account

>

StatefulSet requests storage

kubernetes-statefulset-requests-storage

>

StatefulSet without podAntiAffinity

kubernetes-statefulset-has-no-pod-anti-affinity

>

StatefulSet without PodDisruptionBudget

kubernetes-statefulset-without-pod-disruption-budget

>

StatefulSet without service name

kubernetes-statefulset-without-service-name

>

Terminated pod garbage collector threshold not properly set

kubernetes-terminated-pod-garbage-collector-threshold-not-properly-set

>

Tiller (Helm v2) deployed

kubernetes-tiller-is-deployed

>

Tiller Deployment accessible within cluster

kubernetes-tiller-deployment-is-accessible-from-within-the-cluster

>

Tiller Service present

kubernetes-tiller-service-is-not-deleted

>

TLS connection certificate not set up

kubernetes-tls-connection-certificate-not-setup

>

Token auth file is set

kubernetes-token-auth-file-is-set

>

Unrestricted capabilities in PodSecurityPolicy

kubernetes-not-limited-capabilities-for-pod-security-policy

>

Use service account credentials not set to true

kubernetes-use-service-account-credentials-not-set-to-true

>

Using Kubernetes native secret management

kubernetes-using-kubernetes-native-secret-management

>

Using unrecommended namespace

kubernetes-using-unrecommended-namespace

>

Volume mount with OS directory write permissions

kubernetes-volume-mount-with-os-directory-write-permissions

>

Weak TLS cipher suites

kubernetes-weak-tls-cipher-suites

>

Workload host port not specified

kubernetes-workload-host-port-not-specified

>

Workload mounting with sensitive OS directory

kubernetes-workload-mounting-with-sensitive-os-directory

>

Kubernetes

>

Generic Git module without revision

terraform-generic-git-module-without-revision

>

Output without description

terraform-output-without-description

>

Variable without description

terraform-variable-without-description

>

Variable without type

terraform-variable-without-type

>

Terraform

>

Action trail logging for all regions disabled

terraform-alicloud-action-trail-logging-all-regions-disabled

>

ActionTrail trail OSS bucket is publicly accessible

terraform-alicloud-actiontrail-trail-oss-bucket-is-publicly-accessible

>

ALB listening on HTTP

terraform-alicloud-alb-listening-on-http

>

API Gateway API protocol not HTTPS

terraform-alicloud-api-gateway-api-protocol-not-https

>

CMK is unusable

terraform-alicloud-cmk-is-unusable

>

CS Kubernetes node pool auto repair disabled

terraform-alicloud-cs-kubernetes-node-pool-auto-repair-disabled

>

Disk encryption disabled

terraform-alicloud-disk-encryption-disabled

>

ECS data disk KMS key ID undefined

terraform-alicloud-ecs-data-disk-kms-key-id-undefined

>

High KMS key rotation period

terraform-alicloud-high-kms-key-rotation-period

>

Kubernetes cluster without Terway as CNI network plugin

terraform-alicloud-kubernetes-cluster-without-terway-as-cni-network-plugin

>

Launch template is not encrypted

terraform-alicloud-launch-template-is-not-encrypted

>

Log retention is not greater than 90 days

terraform-alicloud-log-retention-is-not-greater-than-90-days

>

NAS file system not encrypted

terraform-alicloud-nas-file-system-not-encrypted

>

NAS file system without KMS

terraform-alicloud-nas-file-system-without-kms

>

No ROS stack policy

terraform-alicloud-no-ros-stack-policy

>

OSS bucket allows all actions from all principals

terraform-alicloud-oss-bucket-allows-all-actions-from-all-principals

>

OSS bucket allows delete action from all principals

terraform-alicloud-oss-bucket-allows-delete-from-all-principals

>

OSS bucket allows list action from all principals

terraform-alicloud-oss-bucket-allows-list-action-from-all-principals

>

OSS bucket allows put action from all principals

terraform-alicloud-oss-bucket-allows-put-action-from-all-principals

>

OSS bucket encryption using CMK disabled

terraform-alicloud-oss-bucket-cmk-encryption-disabled

>

OSS bucket has static website

terraform-alicloud-oss-bucket-has-static-website

>

OSS bucket IP restriction disabled

terraform-alicloud-oss-bucket-ip-restriction-disabled

>

OSS bucket lifecycle rule disabled

terraform-alicloud-oss-bucket-lifecycle-disabled

>

OSS bucket logging disabled

terraform-alicloud-oss-bucket-logging-disabled

>

OSS bucket public access enabled

terraform-alicloud-oss-bucket-public-access-enabled

>

OSS bucket transfer acceleration disabled

terraform-alicloud-oss-bucket-transfer-acceleration-disabled

>

OSS bucket versioning disabled

terraform-alicloud-oss-bucket-versioning-disabled

>

OSS buckets secure transport disabled

terraform-alicloud-oss-buckets-securetransport-disabled

>

Public security group rule all ports or protocols

terraform-alicloud-public-security-group-rule-all-ports-or-protocols

>

Public security group rule sensitive port

terraform-alicloud-public-security-group-rule-sensitive-port

>

Public security group rule unknown port

terraform-alicloud-public-security-group-rule-unknown-port

>

RAM account password policy does not enforce minimum password length

terraform-alicloud-ram-account-password-policy-not-required-minimum-length

>

RAM account password policy does not require numbers

terraform-alicloud-ram-account-password-policy-not-required-numbers

>

RAM account password policy does not require symbols

terraform-alicloud-ram-account-password-policy-not-required-symbols

>

RAM account password policy max login attempts not recommended

terraform-alicloud-ram-account-password-policy-max-login-attempts-unrecommended

>

RAM account password policy max password age not recommended

terraform-alicloud-ram-account-password-policy-max-password-age-unrecommended

>

RAM account password policy not require at least one lowercase character

terraform-alicloud-ram-password-security-policy-not-require-at-least-one-lowercase-character

>

RAM account password policy not require at least one uppercase character

terraform-alicloud-ram-password-security-policy-not-require-at-least-one-uppercase-character

>

RAM account password policy without reuse prevention

terraform-alicloud-ram-account-password-policy-without-reuse-prevention

>

RAM policy admin access not attached to users groups roles

terraform-alicloud-ram-policy-admin-access-not-attached-to-users-groups-roles

>

RAM policy attached to user

terraform-alicloud-ram-policy-attached-to-user

>

RAM security preference does not enforce MFA login

terraform-alicloud-ram-security-preference-not-enforce-mfa

>

RDS DB instance publicly accessible

terraform-alicloud-rds-instance-address-publicly-accessible

>

RDS DB instance publicly accessible

terraform-alicloud-rds-instance-publicly-accessible

>

RDS instance events not logged

terraform-alicloud-rds-instance-events-not-logged

>

RDS instance log connections disabled

terraform-alicloud-rds-instance-log-connections-disabled

>

RDS instance log disconnections disabled

terraform-alicloud-rds-instance-log-disconnections-disabled

>

RDS instance log duration disabled

terraform-alicloud-rds-instance-log-duration-disabled

>

RDS instance retention period not recommended

terraform-alicloud-rds-instance-retention-not-recommended

>

RDS instance SSL action disabled

terraform-alicloud-rds-instance-ssl-action-disabled

>

RDS instance TDE status disabled

terraform-alicloud-rds-instance-tde-status-disabled

>

ROS stack notifications disabled

terraform-alicloud-ros-stack-notifications-disabled

>

ROS stack retention disabled

terraform-alicloud-ros-stack-retention-disabled

>

ROS stack without template

terraform-alicloud-ros-stack-without-template

>

SLB policy with insecure TLS version in use

terraform-alicloud-slb-policy-with-insecure-tls-version-in-use

>

VPC flow logs disabled

terraform-alicloud-vpc-flow-logs-disabled

>

Terraform / Alicloud

>

ALB deletion protection disabled

terraform-aws-alb-deletion-protection-disabled

>

ALB is not integrated with WAF

terraform-aws-alb-is-not-integrated-with-waf

>

ALB listening on HTTP

terraform-aws-alb-listening-on-http

>

ALB not dropping invalid headers

terraform-aws-alb-not-dropping-invalid-headers

>

Amazon DMS replication instance is publicly accessible

terraform-aws-amazon-dms-replication-instance-is-publicly-accessible

>

AmazonMQ broker encryption disabled

terraform-aws-amazon-mq-broker-encryption-disabled

>

AMI most recent without owner or filter

terraform-aws-ami-owner-missing

>

AMI not encrypted

terraform-aws-ami-not-encrypted

>

AMI shared with multiple accounts

terraform-aws-ami-shared-with-multiple-accounts

>

API Gateway access logging disabled

terraform-aws-api-gateway-access-logging-disabled

>

API Gateway deployment without access log setting

terraform-aws-api-gateway-deployment-without-access-log-setting

>

API Gateway deployment without API Gateway usage plan associated

terraform-aws-api-gateway-deployment-without-api-gateway-usage-plan-associated

>

API Gateway endpoint config is not private

terraform-aws-api-gateway-endpoint-config-is-not-private

>

API Gateway method does not contain an API key

terraform-aws-api-gateway-method-does-not-contain-an-api-key

>

API Gateway method settings cache not encrypted

terraform-aws-api-gateway-method-settings-cache-not-encrypted

>

API Gateway stage without API Gateway usage plan associated

terraform-aws-api-gateway-stage-without-api-gateway-usage-plan-associated

>

API Gateway with CloudWatch logging disabled

terraform-aws-api-gateway-with-cloudwatch-logging-disabled

>

API Gateway with invalid compression

terraform-aws-api-gateway-with-invalid-compression

>

API Gateway with open access

terraform-aws-api-gateway-with-open-access

>

API Gateway without configured authorizer

terraform-aws-api-gateway-without-configured-authorizer

>

API Gateway without security policy

terraform-aws-api-gateway-without-security-policy

>

API Gateway without SSL certificate

terraform-aws-api-gateway-without-ssl-certificate

>

API Gateway without WAF

terraform-aws-api-gateway-without-waf

>

API Gateway X-Ray disabled

terraform-aws-api-gateway-xray-disabled

>

Athena database not encrypted

terraform-aws-athena-database-not-encrypted

>

Athena workgroup not encrypted

terraform-aws-athena-workgroup-not-encrypted

>

Authentication without MFA

terraform-aws-authentication-without-mfa

>

Auto scaling group with no associated ELB

terraform-aws-auto-scaling-group-with-no-associated-elb

>

Automatic minor upgrades disabled

terraform-aws-automatic-minor-upgrades-disabled

>

Autoscaling groups supply tags

terraform-aws-autoscaling-groups-supply-tags

>

AWS password policy with unchangeable passwords

terraform-aws-aws-password-policy-with-unchangeable-passwords

>

Batch job definition with privileged container properties

terraform-aws-batch-job-definition-with-privileged-container-properties

>

CA certificate identifier is outdated

terraform-aws-ca-certificate-identifier-is-outdated

>

CDN configuration is missing

terraform-aws-cdn-configuration-is-missing

>

Certificate has expired

terraform-aws-certificate-has-expired

>

Certificate RSA key bytes lower than 256

terraform-aws-certificate-rsa-key-bytes-lower-than-256

>

CloudFront logging disabled

terraform-aws-cloudfront-logging-disabled

>

Cloudfront viewer protocol policy allows HTTP

terraform-aws-cloudfront-viewer-protocol-policy-allows-http

>

CloudFront without minimum protocol TLS 1.2

terraform-aws-cloudfront-without-minimum-protocol-tls-1-2

>

CloudFront without WAF

terraform-aws-cloudfront-without-waf

>

CloudTrail log file validation disabled

terraform-aws-cloudtrail-log-file-validation-disabled

>

CloudTrail log files not encrypted with KMS

terraform-aws-cloudtrail-log-files-not-encrypted-with-kms

>

CloudTrail log files S3 bucket is publicly accessible

terraform-aws-cloudtrail-log-files-s3-bucket-is-publicly-accessible

>

CloudTrail log files S3 bucket with logging disabled

terraform-aws-cloudtrail-log-files-s3-bucket-with-logging-disabled

>

CloudTrail logging disabled

terraform-aws-cloudtrail-logging-disabled

>

CloudTrail multi region disabled

terraform-aws-cloudtrail-multi-region-disabled

>

CloudTrail not integrated with CloudWatch

terraform-aws-cloudtrail-not-integrated-with-cloudwatch

>

CloudTrail SNS topic name undefined

terraform-aws-cloudtrail-sns-topic-name-undefined

>

CloudWatch AWS Config configuration changes alarm missing

terraform-aws-cloudwatch-aws-config-configuration-changes-alarm-missing

>

CloudWatch changes to NACL alarm missing

terraform-aws-cloudwatch-changes-to-nacl-alarm-missing

>

Cloudwatch CloudTrail configuration changes alarm missing

terraform-aws-cloudwatch-cloudtrail-configuration-changes-alarm-missing

>

CloudWatch console sign-in without MFA alarm missing

terraform-aws-cloudwatch-management-console-sign-in-without-mfa-alarm-missing

>

CloudWatch disabling or scheduled deletion of customer created CMK alarm missing

terraform-aws-cloudwatch-disabling-or-scheduled-deletion-of-customer-created-cmk-alarm-missing

>

CloudWatch IAM policy changes alarm missing

terraform-aws-cloudwatch-iam-policy-changes-alarm-missing

>

CloudWatch log group without KMS

terraform-aws-cloudwatch-log-group-not-encrypted

>

CloudWatch logging disabled

terraform-aws-cloudwatch-logging-disabled

>

CloudWatch logs destination with vulnerable policy

terraform-aws-cloudwatch-logs-destination-with-vulnerable-policy

>

CloudWatch management console auth failed alarm missing

terraform-aws-cloudwatch-management-console-auth-failed-alarm-missing

>

CloudWatch metrics disabled

terraform-aws-cloudwatch-metrics-disabled

>

CloudWatch network gateways changes alarm missing

terraform-aws-cloudwatch-network-gateways-changes-alarm-missing

>

CloudWatch root account use missing

terraform-aws-cloudwatch-root-account-use-alarm-missing

>

CloudWatch route table changes alarm missing

terraform-aws-cloudwatch-route-table-changes-alarm-missing

>

CloudWatch S3 policy change alarm missing

terraform-aws-cloudwatch-s3-policy-change-alarm-missing

>

Cloudwatch security group changes alarm missing

terraform-aws-cloudwatch-security-group-changes-alarm-missing

>

CloudWatch unauthorized access alarm missing

terraform-aws-cloudwatch-unauthorized-access-defined-alarm-missing

>

CloudWatch VPC changes alarm missing

terraform-aws-cloudwatch-vpc-changes-alarm-missing

>

CloudWatch without retention period specified

terraform-aws-cloudwatch-without-retention-period-specified

>

CMK is unusable

terraform-aws-cmk-is-unusable

>

CMK rotation disabled

terraform-aws-cmk-rotation-disabled

>

CodeBuild project encrypted with AWS managed key

terraform-aws-codebuild-project-encrypted-with-aws-managed-key

>

Cognito user pool without MFA

terraform-aws-cognito-userpool-without-mfa

>

Config rule for encrypted volumes disabled

terraform-aws-config-rule-for-encrypted-volumes-is-disabled

>

Configuration aggregator to all regions disabled

terraform-aws-config-configuration-aggregator-to-all-regions-disabled

>

Cross-account IAM assume role policy without external id or MFA

terraform-aws-cross-account-iam-assume-role-policy-without-external-id-or-mfa

>

DAX cluster not encrypted

terraform-aws-dax-cluster-not-encrypted

>

DB instance storage not encrypted

terraform-aws-db-instance-storage-not-encrypted

>

DB security group has public interface

terraform-aws-db-security-group-has-public-interface

>

DB security group open to large scope

terraform-aws-db-security-group-open-to-large-scope

>

DB security group with public scope

terraform-aws-db-security-group-with-public-scope

>

DB snapshot is public

terraform-aws-db-snapshot-public

>

Default security groups with unrestricted traffic

terraform-aws-default-security-groups-with-unrestricted-traffic

>

Default VPC exists

terraform-aws-default-vpc-exists

>

DMS endpoints without SSL

terraform-aws-dms-endpoint-no-ssl-configured

>

DocumentDB cluster encrypted with AWS managed key

terraform-aws-docdb-cluster-encrypted-with-aws-managed-key

>

DocumentDB cluster not encrypted

terraform-aws-docdb-cluster-not-encrypted

>

DocumentDB cluster without KMS

terraform-aws-docdb-cluster-without-kms

>

DocumentDB logging is disabled

terraform-aws-docdb-logging-disabled

>

DynamoDB table not encrypted

terraform-aws-dynamodb-table-not-encrypted

>

DynamoDB table Point-in-Time Recovery disabled

terraform-aws-dynamodb-table-point-in-time-recovery-disabled

>

Dynamodb VPC endpoint without route table association

terraform-aws-dynamodb-vpc-endpoint-without-route-table-association

>

EBS default encryption disabled

terraform-aws-ebs-default-encryption-disabled

>

EBS volume encryption disabled

terraform-aws-ebs-volume-encryption-disabled

>

EBS volume snapshot not encrypted

terraform-aws-ebs-volume-snapshot-not-encrypted

>

EC2 instance has public IP

terraform-aws-ec2-instance-has-public-ip

>

EC2 instance monitoring disabled

terraform-aws-ec2-instance-monitoring-disabled

>

EC2 instance using API keys

terraform-aws-ec2-instance-using-api-keys

>

EC2 instance using default security group

terraform-aws-ec2-instance-using-default-security-group

>

EC2 instance using default VPC

terraform-aws-ec2-instance-using-default-vpc

>

EC2 not EBS optimized

terraform-aws-ec2-not-ebs-optimized

>

ECR image tag not immutable

terraform-aws-ecr-image-tag-not-immutable

>

ECR repository is publicly accessible

terraform-aws-ecr-repository-is-publicly-accessible

>

ECR repository not encrypted with CMK

terraform-aws-ecr-repository-not-encrypted

>

ECR repository without policy

terraform-aws-ecr-repository-without-policy

>

ECS cluster with container insights disabled

terraform-aws-ecs-cluster-container-insights-disabled

>

ECS service admin role is present

terraform-aws-ecs-service-admin-role-is-present

>

ECS service without running tasks

terraform-aws-ecs-service-without-running-tasks

>

ECS task definition network mode not recommended

terraform-aws-ecs-task-definition-network-mode-not-recommended

>

ECS task definition volume not encrypted

terraform-aws-ecs-task-definition-volume-not-encrypted

>

EFS not encrypted

terraform-aws-efs-not-encrypted

>

EFS with vulnerable policy

terraform-aws-efs-with-vulnerable-policy

>

EFS without KMS

terraform-aws-efs-without-kms

>

EKS cluster encryption disabled

terraform-aws-eks-cluster-encryption-disabled

>

EKS cluster has public access

terraform-aws-eks-cluster-has-public-access

>

EKS cluster has public access CIDRs

terraform-aws-eks-cluster-has-public-access-cidrs

>

EKS cluster logging is not enabled

terraform-aws-eks-cluster-log-disabled

>

EKS node group remote access disabled

terraform-aws-eks-node-group-remote-access-disabled

>

ElastiCache nodes not created across multi AZ

terraform-aws-elasticache-nodes-not-created-across-multi-az

>

ElastiCache Redis cluster without backup

terraform-aws-elasticache-redis-cluster-without-backup

>

ElastiCache replication group not encrypted at rest

terraform-aws-elasticache-replication-group-not-encrypted-at-rest

>

ElastiCache replication group not encrypted at transit

terraform-aws-elasticache-replication-group-not-encrypted-at-transit

>

ElastiCache using default port

terraform-aws-elasticache-using-default-port

>

ElastiCache without VPC

terraform-aws-elasticache-without-vpc

>

Elasticsearch domain not encrypted node to node

terraform-aws-elasticsearch-domain-not-encrypted-node-to-node

>

Elasticsearch domain with vulnerable policy

terraform-aws-elasticsearch-domain-with-vulnerable-policy

>

Elasticsearch encryption with KMS disabled

terraform-aws-elasticsearch-encryption-with-kms-is-disabled

>

Elasticsearch log disabled

terraform-aws-elasticsearch-logs-disabled

>

Elasticsearch not encrypted at rest

terraform-aws-elasticsearch-not-encrypted-at-rest

>

Elasticsearch uses default security group

terraform-aws-elasticsearch-using-default-security-group

>

Elasticsearch with HTTPS disabled

terraform-aws-elasticsearch-with-https-disabled

>

Elasticsearch without IAM authentication

terraform-aws-elasticsearch-without-iam-authentication

>

Elasticsearch without slow logs

terraform-aws-elasticsearch-without-slow-logs

>

ELB access log disabled

terraform-aws-elb-access-logging-disabled

>

ELB using insecure protocols

terraform-aws-elb-using-insecure-protocols

>

ELB using weak ciphers

terraform-aws-elb-using-weak-ciphers

>

EMR without VPC

terraform-aws-emr-without-vpc

>

Fine-grained access control disabled for OpenSearch/Elasticsearch

terraform-aws-elasticsearch-no-finegrain-access-control

>

Global Accelerator flow logs disabled

terraform-aws-global-accelerator-flow-logs-disabled

>

Glue Data Catalog encryption disabled

terraform-aws-glue-data-catalog-encryption-disabled

>

Glue security configuration encryption disabled

terraform-aws-glue-security-configuration-encryption-disabled

>

Glue with vulnerable policy

terraform-aws-glue-with-vulnerable-policy

>

Group with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole'

terraform-aws-group-with-privilege-escalation-by-actions-iam-passrole-and-cloudformation-createstack

>

Group with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'

terraform-aws-group-with-privilege-escalation-by-actions-iam-passrole-and-ec2-runinstances

>

Group with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole'

terraform-aws-group-with-privilege-escalation-by-actions-iam-passrole-and-glue-createdevendpoint

>

Group with privilege escalation by actions 'glue:UpdateDevEndpoint'

terraform-aws-group-with-privilege-escalation-by-actions-glue-updatedevendpoint

>

Group with privilege escalation by actions 'iam:AddUserToGroup'

terraform-aws-group-with-privilege-escalation-by-actions-iam-addusertogroup

>

Group with privilege escalation by actions 'iam:AttachGroupPolicy'

terraform-aws-group-with-privilege-escalation-by-actions-iam-attachgrouppolicy

>

Group with privilege escalation by actions 'iam:AttachRolePolicy'

terraform-aws-group-with-privilege-escalation-by-actions-iam-attachrolepolicy

>

Group with privilege escalation by actions 'iam:AttachUserPolicy'

terraform-aws-group-with-privilege-escalation-by-actions-iam-attachuserpolicy

>

Group with privilege escalation by actions 'iam:CreateAccessKey'

terraform-aws-group-with-privilege-escalation-by-actions-iam-createaccesskey

>

Group with privilege escalation by actions 'iam:CreateLoginProfile'

terraform-aws-group-with-privilege-escalation-by-actions-iam-createloginprofile

>

Group with privilege escalation by actions 'iam:CreatePolicyVersion'

terraform-aws-group-with-privilege-escalation-by-actions-iam-createpolicyversion

>

Group with privilege escalation by actions 'iam:PutGroupPolicy'

terraform-aws-group-with-privilege-escalation-by-actions-iam-putgrouppolicy

>

Group with privilege escalation by actions 'iam:PutRolePolicy'

terraform-aws-group-with-privilege-escalation-by-actions-iam-putrolepolicy

>

Group with privilege escalation by actions 'iam:PutUserPolicy'

terraform-aws-group-with-privilege-escalation-by-actions-iam-putuserpolicy

>

Group with privilege escalation by actions 'iam:SetDefaultPolicyVersion'

terraform-aws-group-with-privilege-escalation-by-actions-iam-setdefaultpolicyversion

>

Group with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole'

terraform-aws-group-with-privilege-escalation-by-actions-iam-updateassumerolepolicy-and-sts-assumerole

>

Group with privilege escalation by actions 'iam:UpdateLoginProfile'

terraform-aws-group-with-privilege-escalation-by-actions-iam-updateloginprofile

>

Group with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction'

terraform-aws-group-with-privilege-escalation-by-actions-iam-passrole-and-lambda-createfunction-and-lambda-invokefunction

>

Group with privilege escalation by actions 'lambda:UpdateFunctionCode'

terraform-aws-group-with-privilege-escalation-by-actions-lambda-updatefunctioncode

>

GuardDuty detector disabled

terraform-aws-guardduty-detector-disabled

>

HTTP port open to internet

terraform-aws-http-port-open

>

IAM access key is exposed

terraform-aws-iam-access-key-is-exposed

>

IAM database auth not enabled

terraform-aws-iam-database-auth-not-enabled

>

IAM group without users

terraform-aws-iam-group-without-users

>

IAM password policy does not require lowercase letter

terraform-aws-iam-password-does-not-require-lowercase

>

IAM password policy does not require numbers

terraform-aws-iam-password-does-not-require-number

>

IAM password policy does not require symbol

terraform-aws-iam-password-does-not-require-symbol

>

IAM password policy does not require uppercase letter

terraform-aws-iam-password-does-not-require-uppercase

>

IAM password without minimum length

terraform-aws-iam-password-without-minimum-length

>

IAM policies attached to user

terraform-aws-iam-policies-attached-to-user

>

IAM policies with full privileges

terraform-aws-iam-policies-with-full-privileges

>

IAM policy grants 'AssumeRole' permission across all services

terraform-aws-iam-policy-grants-assumerole-permission-across-all-services

>

IAM policy grants full permissions

terraform-aws-iam-policy-grants-full-permissions

>

IAM role allows all principals to assume

terraform-aws-iam-role-allows-all-principals-to-assume

>

IAM role policy passrole allows all

terraform-aws-iam-role-policy-passrole-allows-all

>

IAM role with full privileges

terraform-aws-iam-role-with-full-privileges

>

IAM user has too many access keys

terraform-aws-iam-user-too-many-access-keys

>

IAM user policy without MFA

terraform-aws-iam-user-policy-without-mfa

>

IAM user with access to console

terraform-aws-iam-user-with-access-to-console

>

IMDSv1 enabled

terraform-aws-imdsv1-is-enabled

>

Instance with no VPC

terraform-aws-instance-with-no-vpc

>

Kinesis not encrypted with KMS

terraform-aws-kinesis-not-encrypted-with-kms

>

Kinesis SSE not configured

terraform-aws-kinesis-sse-not-configured

>

KMS key with no deletion window

terraform-aws-kms-key-with-no-deletion-window

>

KMS key with vulnerable policy

terraform-aws-kms-key-with-full-permissions

>

Lambda function publicly accessible

terraform-aws-lambda-function-publicly-accessible

>

Lambda function with privileged role

terraform-aws-lambda-function-with-privileged-role

>

Lambda functions without X-Ray tracing

terraform-aws-lambda-functions-without-x-ray-tracing

>

Lambda IAM InvokeFunction misconfigured

terraform-aws-lambda-iam-invokefunction-misconfigured

>

Lambda permission misconfigured

terraform-aws-lambda-permission-misconfigured

>

Lambda permission principal is wildcard

terraform-aws-lambda-permission-principal-is-wildcard

>

Lambda with vulnerable policy

terraform-aws-lambda-with-vulnerable-policy

>

Launch configuration is not encrypted

terraform-aws-launch-configuration-is-not-encrypted

>

Misconfigured password policy expiration

terraform-aws-misconfigured-password-policy-expiration

>

Missing CloudWatch alarm for AWS Organizations changes

terraform-aws-cloudwatch-aws-organizations-changes-missing-alarm

>

Missing cluster log types

terraform-aws-missing-cluster-log-types

>

MQ broker is publicly accessible

terraform-aws-mq-broker-is-publicly-accessible

>

MQ broker logging disabled

terraform-aws-mq-broker-logging-disabled

>

MSK broker is publicly accessible

terraform-aws-msk-broker-is-publicly-accessible

>

MSK cluster encryption disabled

terraform-aws-msk-cluster-encryption-disabled

>

MSK cluster logging disabled

terraform-aws-msk-cluster-logging-disabled

>

Neptune cluster instance is publicly accessible

terraform-aws-neptune-cluster-instance-is-publicly-accessible

>

Neptune cluster snapshot not encrypted

terraform-aws-neptune-snapshots-not-encrypted

>

Neptune cluster with IAM database authentication disabled

terraform-aws-neptune-cluster-with-iam-database-authentication-disabled

>

Neptune database cluster encryption disabled

terraform-aws-neptune-database-cluster-encryption-disabled

>

Neptune logging is disabled

terraform-aws-neptune-logging-disabled

>

Network ACL with unrestricted access to RDP

terraform-aws-network-acl-with-unrestricted-access-to-rdp

>

Network ACL with unrestricted access to SSH

terraform-aws-network-acl-with-unrestricted-access-to-ssh

>

No password policy enabled

terraform-aws-no-password-policy-enabled

>

No stack policy

terraform-aws-no-stack-policy

>

Password without reuse prevention

terraform-aws-password-without-reuse-prevention

>

Policy without principal

terraform-aws-policy-without-principal

>

Public and private EC2 share role

terraform-aws-public-and-private-ec2-share-role

>

Public Lambda via API Gateway

terraform-aws-public-lambda-via-api-gateway

>

RDS associated with public subnet

terraform-aws-rds-associated-with-public-subnet

>

RDS cluster with backup disabled

terraform-aws-rds-cluster-with-backup-disabled

>

RDS database cluster not encrypted

terraform-aws-rds-database-cluster-not-encrypted

>

RDS DB instance publicly accessible

terraform-aws-rds-db-instance-publicly-accessible

>

RDS storage not encrypted

terraform-aws-rds-storage-not-encrypted

>

RDS using default port

terraform-aws-rds-using-default-port

>

RDS with backup disabled

terraform-aws-rds-with-backup-disabled

>

RDS without logging

terraform-aws-rds-without-logging

>

Redis disabled

terraform-aws-redis-disabled

>

Redis not compliant

terraform-aws-redis-not-compliant

>

Redshift cluster logging disabled

terraform-aws-redshift-cluster-logging-disabled

>

Redshift cluster without VPC

terraform-aws-redshift-cluster-without-vpc

>

Redshift not encrypted

terraform-aws-redshift-not-encrypted

>

Redshift publicly accessible

terraform-aws-redshift-publicly-accessible

>

Redshift using default port

terraform-aws-redshift-using-default-port

>

Remote Desktop port open to internet

terraform-aws-remote-desktop-port-open-to-internet

>

Resource not using tags

terraform-aws-resource-not-using-tags

>

REST API with vulnerable policy

terraform-aws-rest-api-with-vulnerable-policy

>

Role with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole'

terraform-aws-role-with-privilege-escalation-by-actions-iam-passrole-and-cloudformation-createstack

>

Role with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'

terraform-aws-role-with-privilege-escalation-by-actions-iam-passrole-and-ec2-runinstances

>

Role with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole'

terraform-aws-role-with-privilege-escalation-by-actions-iam-passrole-and-glue-createdevendpoint

>

Role with privilege escalation by actions 'glue:UpdateDevEndpoint'

terraform-aws-role-with-privilege-escalation-by-actions-glue-updatedevendpoint

>

Role with privilege escalation by actions 'iam:AddUserToGroup'

terraform-aws-role-with-privilege-escalation-by-actions-iam-addusertogroup

>

Role with privilege escalation by actions 'iam:AttachGroupPolicy'

terraform-aws-role-with-privilege-escalation-by-actions-iam-attachgrouppolicy

>

Role with privilege escalation by actions 'iam:AttachRolePolicy'

terraform-aws-role-with-privilege-escalation-by-actions-iam-attachrolepolicy

>

Role with privilege escalation by actions 'iam:AttachUserPolicy'

terraform-aws-role-with-privilege-escalation-by-actions-iam-attachuserpolicy

>

Role with privilege escalation by actions 'iam:CreateAccessKey'

terraform-aws-role-with-privilege-escalation-by-actions-iam-createaccesskey

>

Role with privilege escalation by actions 'iam:CreateLoginProfile'

terraform-aws-role-with-privilege-escalation-by-actions-iam-createloginprofile

>

Role with privilege escalation by actions 'iam:CreatePolicyVersion'

terraform-aws-role-with-privilege-escalation-by-actions-iam-createpolicyversion

>

Role with privilege escalation by actions 'iam:PutGroupPolicy'

terraform-aws-role-with-privilege-escalation-by-actions-iam-putgrouppolicy

>

Role with privilege escalation by actions 'iam:PutRolePolicy'

terraform-aws-role-with-privilege-escalation-by-actions-iam-putrolepolicy

>

Role with privilege escalation by actions 'iam:PutUserPolicy'

terraform-aws-role-with-privilege-escalation-by-actions-iam-putuserpolicy

>

Role with privilege escalation by actions 'iam:SetDefaultPolicyVersion'

terraform-aws-role-with-privilege-escalation-by-actions-iam-setdefaultpolicyversion

>

Role with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole'

terraform-aws-role-with-privilege-escalation-by-actions-iam-updateassumerolepolicy-and-sts-assumerole

>

Role with privilege escalation by actions 'iam:UpdateLoginProfile'

terraform-aws-role-with-privilege-escalation-by-actions-iam-updateloginprofile

>

Role with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction'

terraform-aws-role-with-privilege-escalation-by-actions-iam-passrole-and-lambda-createfunction-lambda-invokefunction

>

Role with privilege escalation by actions 'lambda:UpdateFunctionCode'

terraform-aws-role-with-privilege-escalation-by-actions-lambda-updatefunctioncode

>

Root account has active access keys

terraform-aws-root-account-has-active-access-keys

>

Route53 record undefined

terraform-aws-route53-record-undefined

>

S3 bucket access to any principal

terraform-aws-s3-bucket-access-to-any-principal

>

S3 bucket ACL allows read or write to all users

terraform-aws-s3-bucket-acl-allows-read-or-write-to-all-users

>

S3 bucket ACL allows read to any authenticated user

terraform-aws-s3-bucket-acl-allows-read-to-any-authenticated-user

>

S3 bucket ACL grants WRITE_ACP permission

terraform-aws-s3-bucket-acl-grants-write-acp-permission

>

S3 bucket allows authenticated users access

terraform-aws-s3-bucket-allows-access-to-all-authenticated-users

>

S3 bucket allows delete action from all principals

terraform-aws-s3-bucket-allows-delete-action-from-all-principals

>

S3 bucket allows get action from all principals

terraform-aws-s3-bucket-allows-get-action-from-all-principals

>

S3 bucket allows list action from all principals

terraform-aws-s3-bucket-allows-list-action-from-all-principals

>

S3 bucket allows public ACL

terraform-aws-s3-bucket-allows-public-acl

>

S3 bucket allows public policy

terraform-aws-s3-bucket-with-public-policy

>

S3 bucket allows put action from all principals

terraform-aws-s3-bucket-allows-put-action-from-all-principals

>

S3 bucket logging disabled

terraform-aws-s3-bucket-logging-disabled

>

S3 bucket object not encrypted

terraform-aws-s3-bucket-object-not-encrypted

>

S3 bucket object-level CloudTrail logging disabled

terraform-aws-s3-bucket-object-level-cloudtrail-logging-disabled

>

S3 bucket policy accepts HTTP requests

terraform-aws-s3-bucket-policy-accepts-http-requests

>

S3 bucket public ACL overridden by public access block

terraform-aws-s3-bucket-public-acl-overridden-by-public-access-block

>

S3 bucket with all permissions

terraform-aws-s3-bucket-with-all-permissions

>

S3 bucket with unsecured CORS rule

terraform-aws-s3-bucket-with-unsecured-cors-rule

>

S3 bucket without enabled MFA delete

terraform-aws-s3-bucket-without-enabled-mfa-delete

>

S3 bucket without ignore public ACL

terraform-aws-s3-bucket-without-ignore-public-acl

>

S3 bucket without restriction of public bucket

terraform-aws-s3-bucket-without-restriction-of-public-bucket

>

S3 bucket without versioning

terraform-aws-s3-bucket-without-versioning

>

S3 static website host enabled

terraform-aws-s3-static-website-host-enabled

>

SageMaker endpoint configuration encryption disabled

terraform-aws-sagemaker-endpoint-configuration-encryption-disabled

>

SageMaker notebook instance without KMS

terraform-aws-sagemaker-notebook-instance-without-kms

>

SageMaker notebook internet access enabled

terraform-aws-sagemaker-direct-internet-access-enabled

>

Secrets Manager secret encrypted with AWS-managed key

terraform-aws-secretsmanager-secret-encrypted-with-aws-managed-key

>

Secrets Manager secret without KMS

terraform-aws-secretsmanager-secret-without-kms

>

Secrets Manager with vulnerable policy

terraform-aws-secrets-manager-with-vulnerable-policy

>

Secure ciphers disabled

terraform-aws-secure-ciphers-disabled

>

Security group not used

terraform-aws-security-groups-not-used

>

Security group rule without description

terraform-aws-security-group-rules-without-description

>

Security group rule without description

terraform-aws-security-group-without-description

>

Security group with unrestricted access to SSH

terraform-aws-security-group-with-unrestricted-access-to-ssh

>

Sensitive port is exposed to entire network

terraform-aws-sensitive-port-is-exposed-to-entire-network

>

Sensitive port is exposed to small public network

terraform-aws-sensitive-port-is-exposed-to-small-public-network

>

Sensitive port is exposed to wide private network

terraform-aws-sensitive-port-is-exposed-to-wide-private-network

>

Service control policies disabled

terraform-aws-service-control-policies-disabled

>

SES policy with allowed IAM actions

terraform-aws-ses-policy-with-allowed-iam-actions

>

Shield Advanced not in use

terraform-aws-shield-advanced-not-in-use

>

SNS topic encrypted with AWS managed key

terraform-aws-sns-topic-encrypted-with-aws-managed-key

>

SNS topic is publicly accessible

terraform-aws-sns-topic-is-publicly-accessible

>

SNS topic not encrypted

terraform-aws-sns-topic-not-encrypted

>

SNS topic publicity has allow and NotAction simultaneously

terraform-aws-sns-topic-publicity-has-allow-and-not-action-simultaneously

>

SQL analysis services port 2383 (TCP) is publicly accessible

terraform-aws-sql-analysis-services-port-2383-is-publicly-accessible

>

SQS policy allows all actions

terraform-aws-sqs-policy-allows-all-actions

>

SQS policy with public access

terraform-aws-sqs-policy-with-public-access

>

SQS queue exposed

terraform-aws-sqs-queue-exposed

>

SQS VPC endpoint without DNS resolution

terraform-aws-sqs-vpc-endpoint-without-dns-resolution

>

SQS with SSE disabled

terraform-aws-sqs-with-sse-disabled

>

SSM session transit encryption disabled

terraform-aws-ssm-session-transit-encryption-disabled

>

SSO identity user unsafe creation

terraform-aws-sso-identity-user-unsafe-creation

>

SSO permission with inadequate user session duration

terraform-aws-sso-permission-with-inadequate-user-session-duration

>

SSO policy with full privileges

terraform-aws-sso-policy-with-full-privileges

>

Stack notifications disabled

terraform-aws-stack-notifications-disabled

>

Stack retention disabled

terraform-aws-stack-retention-disabled

>

Stack without template

terraform-aws-stack-without-template

>

Team tag missing on AWS resource

terraform-aws-team-tag-not-present

>

Unknown port exposed to internet

terraform-aws-unknown-port-exposed-to-internet

>

Unrestricted security group ingress

terraform-aws-unrestricted-security-group-ingress

>

Unscanned ECR image

terraform-aws-unscanned-ecr-image

>

User data contains encoded private key

terraform-aws-user-data-contains-encoded-private-key

>

User with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole'

terraform-aws-user-with-privilege-escalation-by-actions-iam-passrole-and-cloudformation-createstack

>

User with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'

terraform-aws-user-with-privilege-escalation-by-actions-iam-passrole-and-ec2-runinstances

>

User with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole'

terraform-aws-user-with-privilege-escalation-by-actions-iam-passrole-and-glue-createdevendpoint

>

User with privilege escalation by actions 'glue:UpdateDevEndpoint'

terraform-aws-user-with-privilege-escalation-by-actions-glue-updatedevendpoint

>

User with privilege escalation by actions 'iam:AddUserToGroup'

terraform-aws-user-with-privilege-escalation-by-actions-iam-addusertogroup

>

User with privilege escalation by actions 'iam:AttachGroupPolicy'

terraform-aws-user-with-privilege-escalation-by-actions-iam-attachgrouppolicy

>

User with privilege escalation by actions 'iam:AttachRolePolicy'

terraform-aws-user-with-privilege-escalation-by-actions-iam-attachrolepolicy

>

User with privilege escalation by actions 'iam:AttachUserPolicy'

terraform-aws-user-with-privilege-escalation-by-actions-iam-attachuserpolicy

>

User with privilege escalation by actions 'iam:CreateAccessKey'

terraform-aws-user-with-privilege-escalation-by-actions-iam-createaccesskey

>

User with privilege escalation by actions 'iam:CreateLoginProfile'

terraform-aws-user-with-privilege-escalation-by-actions-iam-createloginprofile

>

User with privilege escalation by actions 'iam:CreatePolicyVersion'

terraform-aws-user-with-privilege-escalation-by-actions-iam-createpolicyversion

>

User with privilege escalation by actions 'iam:PutGroupPolicy'

terraform-aws-user-with-privilege-escalation-by-actions-iam-putgrouppolicy

>

User with privilege escalation by actions 'iam:PutRolePolicy'

terraform-aws-user-with-privilege-escalation-by-actions-iam-putrolepolicy

>

User with privilege escalation by actions 'iam:PutUserPolicy'

terraform-aws-user-with-privilege-escalation-by-actions-iam-putuserpolicy

>

User with privilege escalation by actions 'iam:SetDefaultPolicyVersion'

terraform-aws-user-with-privilege-escalation-by-actions-iam-setdefaultpolicyversion

>

User with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole'

terraform-aws-user-with-privilege-escalation-by-actions-iam-updateassumerolepolicy-and-sts-assumerole

>

User with privilege escalation by actions 'iam:UpdateLoginProfile'

terraform-aws-user-with-privilege-escalation-by-actions-iam-updateloginprofile

>

User with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction'

terraform-aws-user-with-privilege-escalation-by-actions-iam-passrole-and-lambda-createfunction-and-lambda-invokefunction

>

User with privilege escalation by actions 'lambda:UpdateFunctionCode'

terraform-aws-user-with-privilege-escalation-by-actions-lambda-updatefunctioncode

>

VPC default security group accepts all traffic

terraform-aws-vpc-default-security-group-accepts-all-traffic

>

VPC Flow Logs disabled

terraform-aws-vpc-flowlogs-disabled

>

VPC peering route table with unrestricted CIDR

terraform-aws-vpc-peering-route-table-with-unrestricted-cidr

>

VPC subnet assigns public IP

terraform-aws-vpc-subnet-assigns-public-ip

>

VPC without Network Firewall

terraform-aws-vpc-without-network-firewall

>

Vulnerable default SSL certificate

terraform-aws-vulnerable-default-ssl-certificate

>

Workspaces workspace volume not encrypted

terraform-aws-workspaces-workspace-volume-not-encrypted

>

Terraform / AWS

>

AD admin not configured for SQL server

terraform-azure-ad-admin-not-configured-for-sql-server

>

Admin user enabled for container registry

terraform-azure-admin-user-enabled-for-container-registry

>

AKS disk encryption set ID undefined

terraform-azure-aks-disk-encryption-set-id-undefined

>

AKS network policy misconfigured

terraform-azure-aks-network-policy-misconfigured

>

AKS private cluster disabled

terraform-azure-aks-private-cluster-disabled

>

AKS RBAC disabled

terraform-azure-aks-rbac-disabled

>

App Service authentication disabled

terraform-azure-app-service-authentication-disabled

>

App Service FTPS enforce disabled

terraform-azure-app-service-ftps-enforce-disabled

>

App Service HTTP2 disabled

terraform-azure-app-service-http2-disabled

>

App Service managed identity disabled

terraform-azure-app-service-managed-identity-disabled

>

App Service not using latest TLS encryption version

terraform-azure-app-service-not-using-latest-tls-encryption-version

>

App Service without latest PHP version

terraform-azure-app-service-without-latest-php-version

>

App Service without latest Python version

terraform-azure-app-service-without-latest-python-version

>

Azure Active Directory authentication

terraform-azure-azure-active-directory-authentication

>

Azure App Service client certificate disabled

terraform-azure-azure-app-service-client-certificate-disabled

>

Azure Cognitive Search public network access enabled

terraform-azure-azure-cognitive-search-public-network-access-enabled

>

Azure Container Registry with no locks

terraform-azure-azure-container-registry-with-no-locks

>

Azure Front Door WAF disabled

terraform-azure-azure-front-door-waf-disabled

>

Azure instance using basic authentication

terraform-azure-azure-instance-using-basic-authentication

>

Azure Policy Add-on Disabled in AKS Cluster

terraform-azure-aks-uses-azure-policies-addon-disabled

>

Cosmos DB account without tags

terraform-azure-cosmos-db-account-without-tags

>

CosmosDB account IP range filter not set

terraform-azure-cosmosdb-account-ip-range-filter-not-set

>

Dashboard is enabled

terraform-azure-dashboard-is-enabled

>

Default Azure storage account network access is too permissive

terraform-azure-default-azure-storage-account-network-access-is-too-permissive

>

Email alerts disabled

terraform-azure-email-alerts-disabled

>

Encryption on managed disk disabled

terraform-azure-encryption-on-managed-disk-disabled

>

Ensure Azure MariaDB server is using latest TLS (1.2)

terraform-azure-mariadb-not-using-latest-tls

>

Ensure MySQL is using the latest version of TLS encryption

terraform-azure-mysql-not-using-latest-tls

>

Ensure that Azure cloud resource has a team tag

terraform-azure-team-tag-not-present

>

Ensure that PostgreSQL server disables public network access

terraform-azure-postgres-sql-server-enables-public-access

>

Ensure that UDP services are restricted from the Internet

terraform-azure-udp-services-not-restricted-from-internet

>

Ensure web app is not remotely debuggable

terraform-azure-remote-debugging-enabled-app-service

>

Firewall rule allows too many hosts to access Redis Cache

terraform-azure-firewall-rule-allows-too-many-hosts-to-access-redis-cache

>

Function App authentication disabled

terraform-azure-function-app-authentication-disabled

>

Function App client certificates not required

terraform-azure-function-app-client-certificates-unrequired

>

Function App FTPS enforce disabled

terraform-azure-function-app-ftps-enforce-disabled

>

Function App HTTP2 disabled

terraform-azure-function-app-http2-disabled

>

Function App managed identity disabled

terraform-azure-function-app-managed-identity-disabled

>

Function App not using latest TLS encryption version

terraform-azure-function-app-not-using-latest-tls-encryption-version

>

Geo redundancy is disabled

terraform-azure-geo-redundancy-is-disabled

>

Key expiration not set

terraform-azure-key-expiration-not-set

>

Key Vault secrets content type undefined

terraform-azure-key-vault-secrets-content-type-undefined

>

Log retention is not set

terraform-azure-log-retention-is-not-set

>

MariaDB server geo-redundant backup disabled

terraform-azure-mariadb-server-georedundant-backup-disabled

>

MariaDB server public network access enabled

terraform-azure-mariadb-public-network-access-enabled

>

MSSQL server auditing disabled

terraform-azure-mssql-server-auditing-disabled

>

MSSQL server public network access enabled

terraform-azure-mssql-server-public-network-access-enabled

>

MySQL server public access enabled

terraform-azure-mysql-server-public-access-enabled

>

MySQL SSL connection disabled

terraform-azure-mysql-ssl-connection-disabled

>

Network interfaces IP forwarding enabled

terraform-azure-network-interfaces-ip-forwarding-enabled

>

Network interfaces with public IP

terraform-azure-network-interfaces-with-public-ip

>

Network watcher flow disabled

terraform-azure-network-watcher-flow-disabled

>

PostgreSQL log checkpoints disabled

terraform-azure-postgresql-log-checkpoints-disabled

>

PostgreSQL log connections not set

terraform-azure-postgresql-log-connections-not-set

>

PostgreSQL log disconnections not set

terraform-azure-postgresql-log-disconnections-not-set

>

PostgreSQL log duration not set

terraform-azure-postgresql-log-duration-not-set

>

PostgreSQL server infrastructure encryption disabled

terraform-azure-postgresql-server-infrastructure-encryption-disabled

>

PostgreSQL Server threat detection policy disabled

terraform-azure-postgresql-server-threat-detection-policy-disabled

>

PostgreSQL server without connection throttling

terraform-azure-postgresql-server-without-connection-throttling

>

Public storage account

terraform-azure-public-storage-account

>

RDP is exposed to the internet

terraform-azure-rdp-is-exposed-to-the-internet

>

Redis cache allows non SSL connections

terraform-azure-redis-cache-allows-non-ssl-connections

>

Redis entirely accessible

terraform-azure-redis-entirely-accessible

>

Redis not updated regularly

terraform-azure-redis-not-updated-regularly

>

Redis publicly accessible

terraform-azure-redis-publicly-accessible

>

Role assignment not limit guest user permissions

terraform-azure-role-assignment-not-limit-guest-users-permissions

>

Role definition allows custom role creation

terraform-azure-role-definition-allows-custom-role-creation

>

Secret expiration not set

terraform-azure-secret-expiration-not-set

>

Security center pricing tier is not standard

terraform-azure-security-center-pricing-tier-is-not-standard

>

Security contact email

terraform-azure-security-contact-email

>

Security group is not configured

terraform-azure-security-group-is-not-configured

>

Sensitive port is exposed to entire network

terraform-azure-sensitive-port-is-exposed-to-entire-network

>

Sensitive port is exposed to small public network

terraform-azure-sensitive-port-is-exposed-to-small-public-network

>

Sensitive port is exposed to wide private network

terraform-azure-sensitive-port-is-exposed-to-wide-private-network

>

Small activity log retention period

terraform-azure-small-activity-log-retention-period

>

Small flow logs retention period

terraform-azure-small-flow-logs-retention-period

>

Small MSSQL audit retention period

terraform-azure-small-mssql-audit-retention-period

>

Small MSSQL server audit retention

terraform-azure-small-msql-server-audit-retention

>

Small PostgreSQL DB server log retention period

terraform-azure-small-postgresql-db-server-log-retention-period

>

SQL database audit disabled

terraform-azure-sql-database-audit-disabled

>

SQL server alert email disabled

terraform-azure-sql-server-alert-email-disabled

>

SQL server auditing disabled

terraform-azure-sql-server-auditing-disabled

>

SQL server predictable Active Directory admin account name

terraform-azure-sql-server-predictable-active-directory-admin-account-name

>

SQL server predictable admin account name

terraform-azure-sql-server-predictable-admin-account-name

>

Sqlserver ingress from any IP

terraform-azure-sql-server-ingress-from-any-ip

>

SSH is exposed to the Internet

terraform-azure-ssh-is-exposed-to-the-internet

>

SSL enforce disabled

terraform-azure-ssl-enforce-is-disabled

>

ssl_enforcement_enabled is not set to ENABLED for MySQL database server

terraform-azure-mysql-enforce-ssl-connection-disabled

>

ssl_enforcement_enabled is not set to ENABLED for PostgreSQL database server

terraform-azure-postgres-enforce-ssl-connection-disabled

>

Storage account not forcing HTTPS

terraform-azure-storage-account-not-forcing-https

>

Storage account not using latest TLS encryption version

terraform-azure-storage-account-not-using-latest-tls-encryption-version

>

Storage container is publicly accessible

terraform-azure-storage-container-is-publicly-accessible

>

Storage share file allows all ACL permissions

terraform-azure-storage-share-file-allows-all-acl-permissions

>

Storage table allows all ACL permissions

terraform-azure-storage-table-allows-all-acl-permissions

>

Trusted Microsoft services not enabled

terraform-azure-trusted-microsoft-services-not-enabled

>

Unrestricted SQL server access

terraform-azure-unrestricted-sql-server-access

>

Vault auditing disabled

terraform-azure-vault-auditing-disabled

>

Virtual network with DDoS protection plan disabled

terraform-azure-virtual-network-with-ddos-protection-plan-disabled

>

VM not attached to network

terraform-azure-vm-not-attached-to-network

>

WAF is disabled for Azure application gateway

terraform-azure-waf-is-disabled-for-azure-application-gateway

>

Web app accepting traffic other than HTTPS

terraform-azure-web-app-accepting-traffic-other-than-https

>

Terraform / Azure

>

Check Databricks cluster AWS attribute best practices

terraform-databricks-cluster-aws-attributes

>

Check Databricks cluster Azure attribute best practices

terraform-databricks-cluster-azure-attributes

>

Check Databricks cluster GCP attribute best practices

terraform-databricks-cluster-gcp-attributes

>

Databricks autoscale configuration incomplete

terraform-databricks-autoscale-badly-setup

>

Databricks cluster or job with no or insecure permissions

terraform-databricks-databricks-permissions

>

Databricks cluster uses non-LTS Spark version

terraform-databricks-use-lts-spark-version

>

Databricks group without user or instance profile

terraform-databricks-group-without-user-or-instance-profile

>

Indefinitely Databricks OBO token lifetime

terraform-databricks-indefinitely-obo-token

>

Indefinitely Databricks token lifetime

terraform-databricks-indefinitely-token

>

Job's task is legacy (spark_submit_task)

terraform-databricks-use-spark-submit-task

>

Unrestricted Databricks ACL

terraform-databricks-unrestricted-acl

>

Terraform / Databricks

>

Artifact Registry repo is public

terraform-gcp-artifact-registry-repository-is-public

>

BigQuery dataset is public

terraform-gcp-bigquery-dataset-is-public

>

BigQuery table is public

terraform-gcp-bigquery-table-is-public

>

Cloud DNS without DNSSEC

terraform-gcp-cloud-dns-without-dnssec

>

Cloud KMS key ring is anonymously or publicly accessible

terraform-gcp-cloud-kms-key-rings-are-public

>

Cloud Run service is public

terraform-gcp-cloud-run-service-is-public

>

Cloud Storage bucket is publicly accessible

terraform-gcp-cloud-storage-bucket-is-publicly-accessible

>

Cloud Storage bucket logging not enabled

terraform-gcp-cloud-storage-bucket-logging-not-enabled

>

Cloud Storage bucket versioning disabled

terraform-gcp-cloud-storage-bucket-versioning-disabled

>

Cloud Storage is anonymous or publicly accessible

terraform-gcp-cloud-storage-anonymous-or-publicly-accessible

>

Cluster labels disabled

terraform-gcp-cluster-labels-disabled

>

Container Registry repo is public

terraform-gcp-container-registry-repository-is-public

>

COS node image not used

terraform-gcp-cos-node-image-not-used

>

Dataproc clusters has public IPs

terraform-gcp-dataproc-cluster-has-public-ip

>

Dataproc clusters publicly accessible

terraform-gcp-dataproc-clusters-is-public

>

Disk encryption disabled

terraform-gcp-disk-encryption-disabled

>

DNSSEC using RSASHA1

terraform-gcp-dnssec-using-rsasha1

>

Ensure legacy networks do not exist for a project

terraform-gcp-legacy-networks-exist-for-project

>

Ensure SQL database instance has skip show database flag

terraform-gcp-sql-database-instance-does-not-have-skip-show-database

>

GKE control plane is public

terraform-gcp-gke-control-plane-is-public

>

GKE legacy authorization enabled

terraform-gcp-gke-legacy-authorization-enabled

>

GKE using default service account

terraform-gcp-gke-using-default-service-account

>

Google Compute firewall ingress allows unrestricted FTP access

terraform-gcp-firewall-ingress-allows-unrestricted-ftp-access

>

Google Compute firewall ingress allows unrestricted MySQL access

terraform-gcp-firewall-ingress-allows-unrestricted-mysql-access

>

Google Compute network using default firewall rule

terraform-gcp-google-compute-network-using-default-firewall-rule

>

Google Compute network using firewall rule that allows all ports

terraform-gcp-google-compute-network-using-firewall-rule-allows-all-ports

>

Google Compute network using firewall rule that allows port range

terraform-gcp-google-compute-network-using-firewall-rule-allows-port-range

>

Google Compute SSL policy weak cipher in use

terraform-gcp-google-compute-ssl-policy-weak-cipher-in-use

>

Google Compute subnetwork logging disabled

terraform-gcp-google-compute-subnetwork-logging-disabled

>

Google Compute subnetwork with private Google access disabled

terraform-gcp-google-compute-subnetwork-with-private-google-access-disabled

>

Google Container node pool auto repair disabled

terraform-gcp-google-container-node-pool-auto-repair-disabled

>

Google project auto create network disabled

terraform-gcp-google-project-auto-create-network-disabled

>

Google project IAM binding service account has token creator or account user role

terraform-gcp-google-project-iam-binding-service-account-has-token-creator-or-account-user-role

>

Google project IAM member service account has admin role

terraform-gcp-google-project-iam-member-service-account-has-admin-role

>

Google project IAM member service account has token creator or account user role

terraform-gcp-google-project-iam-member-service-account-has-token-creator-or-account-user-role

>

Google Storage bucket level access disabled

terraform-gcp-google-storage-bucket-level-access-disabled

>

High Google KMS crypto key rotation period

terraform-gcp-high-google-kms-crypto-key-rotation-period

>

IAM audit not properly configured

terraform-gcp-iam-audit-not-properly-configured

>

IP aliasing disabled

terraform-gcp-ip-aliasing-disabled

>

IP forwarding enabled

terraform-gcp-ip-forwarding-enabled

>

KMS admin and CryptoKey roles in use

terraform-gcp-kms-admin-and-crypto-key-roles-in-use

>

KMS CryptoKey is publicly accessible

terraform-gcp-kms-crypto-key-publicly-accessible

>

Legacy client certificate auth enabled

terraform-gcp-legacy-client-certificate-auth-enabled

>

Network policy disabled

terraform-gcp-network-policy-disabled

>

Node auto upgrade disabled

terraform-gcp-node-auto-upgrade-disabled

>

Not proper email account in use

terraform-gcp-not-proper-email-account-in-use

>

OSLogin disabled

terraform-gcp-os-login-disabled

>

OSLogin is disabled for VM instance

terraform-gcp-os-login-is-disabled-for-vm-instance

>

Outdated GKE version

terraform-gcp-outdated-gke-version

>

Pod security policy disabled

terraform-gcp-pod-security-policy-disabled

>

Private cluster disabled

terraform-gcp-private-cluster-disabled

>

Project-wide SSH keys are enabled in VM instances

terraform-gcp-project-wide-ssh-keys-are-enabled-in-vm-instances

>

Pub/Sub Topics are anonymously or publicly accessible

terraform-gcp-pubsub-topic-is-public

>

RDP access is not restricted

terraform-gcp-rdp-access-is-not-restricted

>

Serial ports are enabled for VM instances

terraform-gcp-vm-serial-ports-are-enabled-for-vm-instances

>

Service account with improper privileges

terraform-gcp-service-account-with-improper-privileges

>

Shielded GKE nodes disabled

terraform-gcp-shielded-gke-nodes-disabled

>

Shielded VM disabled

terraform-gcp-shielded-vm-disabled

>

SQL DB instance backup disabled

terraform-gcp-sql-db-instance-backup-disabled

>

SQL DB instance publicly accessible

terraform-gcp-sql-db-instance-is-publicly-accessible

>

SQL DB instance with SSL disabled

terraform-gcp-sql-db-instance-with-ssl-disabled

>

SQL Server cross DB ownership chaining enabled

terraform-gcp-sql-database-has-cross-db-ownership-chaining

>

SSH access is not restricted

terraform-gcp-ssh-access-is-not-restricted

>

Stackdriver Logging disabled

terraform-gcp-stackdriver-logging-disabled

>

Stackdriver Monitoring disabled

terraform-gcp-stackdriver-monitoring-disabled

>

Team label missing on GCP resource

terraform-gcp-team-label-not-present

>

There are non GCP-managed service account keys for a service account

terraform-gcp-service-has-non-gcp-managed-service-account-keys

>

User with IAM role

terraform-gcp-user-with-iam-role

>

Using default service account

terraform-gcp-using-default-service-account

>

VM with full cloud access

terraform-gcp-vm-with-full-cloud-access

>

Terraform / GCP

>

Github organization webhook with SSL disabled

terraform-github-organization-webhook-with-ssl-disabled

>

GitHub repository set to public

terraform-github-repository-set-to-public

>

Terraform / GitHub

>

Cluster admin rolebinding with superuser permissions

terraform-kubernetes-cluster-admin-role-binding-with-super-user-permissions

>

Cluster allows unsafe sysctls

terraform-kubernetes-cluster-allows-unsafe-sysctls

>

Container host PID is true

terraform-kubernetes-container-host-pid-is-true

>

Container is privileged

terraform-kubernetes-container-is-privileged

>

Container resources limits undefined

terraform-kubernetes-container-resources-limits-undefined

>

Container runs unmasked

terraform-kubernetes-container-runs-unmasked

>

Containers with added capabilities

terraform-kubernetes-container-with-added-capabilities

>

Containers with sys admin capabilities

terraform-kubernetes-containers-with-sys-admin-capabilities

>

CPU limits not set

terraform-kubernetes-cpu-limits-not-set

>

CPU requests not set

terraform-kubernetes-cpu-requests-not-set

>

CronJob deadline not configured

terraform-kubernetes-cronjob-deadline-not-configured

>

Default service account in use

terraform-kubernetes-default-service-account-in-use

>

Deployment has no podAntiAffinity

terraform-kubernetes-deployment-has-no-pod-anti-affinity

>

Deployment without PodDisruptionBudget

terraform-kubernetes-deployment-without-pod-disruption-budget

>

Docker daemon socket is exposed to containers

terraform-kubernetes-docker-daemon-socket-is-exposed-to-containers

>

HPA targets invalid object

terraform-kubernetes-hpa-targets-invalid-object

>

Image pull policy of the container is not set to always

terraform-kubernetes-image-pull-policy-of-container-is-not-always

>

Image without digest

terraform-kubernetes-image-without-digest

>

Incorrect volume claim access mode ReadWriteOnce

terraform-kubernetes-incorrect-volume-claim-access-mode-read-write-once

>

Ingress controller exposes workload

terraform-kubernetes-ingress-controller-exposes-workload

>

Invalid image

terraform-kubernetes-invalid-image

>

Liveness probe is not defined

terraform-kubernetes-liveness-probe-is-not-defined

>

Memory limits not defined

terraform-kubernetes-memory-limits-not-defined

>

Memory requests not defined

terraform-kubernetes-memory-requests-not-defined

>

Metadata label is invalid

terraform-kubernetes-metadata-label-is-invalid

>

Missing AppArmor config

terraform-kubernetes-missing-app-armor-config

>

NET_RAW capabilities disabled for PSP

terraform-kubernetes-net-raw-capabilities-disabled-for-psp

>

NET_RAW capabilities not being dropped

terraform-kubernetes-net-raw-capabilities-not-being-dropped

>

Network policy is not targeting any pod

terraform-kubernetes-network-policy-is-not-targeting-any-pod

>

No drop capabilities for containers

terraform-kubernetes-no-drop-capabilities-for-containers

>

Non kube system pod with host mount

terraform-kubernetes-non-kube-system-pod-with-host-mount

>

Permissive access to create pods

terraform-kubernetes-permissive-access-to-create-pods

>

Pod or container without security context

terraform-kubernetes-pod-or-container-without-security-context

>

Privilege escalation allowed

terraform-kubernetes-privilege-escalation-allowed

>

PSP allows containers to share the host network namespace

terraform-kubernetes-psp-allows-containers-to-share-the-host-network-namespace

>

PSP allows privilege escalation

terraform-kubernetes-psp-allows-privilege-escalation

>

PSP allows sharing host IPC

terraform-kubernetes-psp-allows-sharing-host-ipc

>

PSP set to privileged

terraform-kubernetes-psp-set-to-privileged

>

PSP with added capabilities

terraform-kubernetes-psp-with-added-capabilities

>

RBAC roles with read secrets permissions

terraform-kubernetes-rbac-roles-with-read-secrets-permissions

>

Readiness probe is not configured

terraform-kubernetes-readiness-probe-is-not-configured

>

Role binding to default service account

terraform-kubernetes-role-binding-to-default-service-account

>

Root container not mounted as read-only

terraform-kubernetes-root-container-not-mounted-as-read-only

>

Root containers admitted

terraform-kubernetes-root-containers-admitted

>

Seccomp profile is not configured

terraform-kubernetes-seccomp-profile-is-not-configured

>

Secrets as environment variables

terraform-kubernetes-secrets-as-environment-variables

>

Service account allows access secrets

terraform-kubernetes-service-account-allows-access-secrets

>

Service account name undefined or empty

terraform-kubernetes-service-account-name-undefined-or-empty

>

Service account token automount not disabled

terraform-kubernetes-service-account-token-automount-not-disabled

>

Service type is NodePort

terraform-kubernetes-service-type-is-nodeport

>

Service with external load balancer

terraform-kubernetes-service-with-external-load-balancer

>

Shared host IPC namespace

terraform-kubernetes-shared-host-ipc-namespace

>

Shared host network namespace

terraform-kubernetes-shared-host-network-namespace

>

Shared service account

terraform-kubernetes-shared-service-account

>

StatefulSet requests storage

terraform-kubernetes-statefulset-requests-storage

>

StatefulSet without PodDisruptionBudget

terraform-kubernetes-statefulset-without-pod-disruption-budget

>

StatefulSet without service name

terraform-kubernetes-statefulset-without-service-name

>

Tiller (Helm v2) is deployed

terraform-kubernetes-tiller-is-deployed

>

Using default namespace

terraform-kubernetes-using-default-namespace

>

Volume mount with OS directory write permissions

terraform-kubernetes-volume-mount-with-os-directory-write-permissions

>

Workload host port not specified

terraform-kubernetes-workload-host-port-not-specified

>

Workload mounting with sensitive OS directory

terraform-kubernetes-workload-mounting-with-sensitive-os-directory

>

Terraform / Kubernetes

>

NIFCLOUD computing has common private network

terraform-nifcloud-computing-instance-has-common-private

>

NIFCLOUD computing has public ingress security group rule

terraform-nifcloud-computing-instance-has-public-ingress-sgr

>

NIFCLOUD computing undefined description to security group

terraform-nifcloud-computing-security-group-description-undefined

>

NIFCLOUD computing undefined description to security group rule

terraform-nifcloud-computing-security-group-rule-description-undefined

>

NIFCLOUD computing undefined security group to instance

terraform-nifcloud-computing-instance-security-group-undefined

>

NIFCLOUD DNS has verified record

terraform-nifcloud-dns-has-verified-record

>

NIFCLOUD ELB has common private network

terraform-nifcloud-elb-has-common-private

>

NIFCLOUD ELB listener using HTTP protocol

terraform-nifcloud-elb-listener-use-http

>

NIFCLOUD ELB using HTTP protocol

terraform-nifcloud-elb-use-http

>

NIFCLOUD LB listener using HTTP port

terraform-nifcloud-load-balancer-listener-use-http

>

NIFCLOUD LB using HTTP port

terraform-nifcloud-load-balancer-use-http

>

NIFCLOUD LB using insecure TLS policy ID

terraform-nifcloud-load-balancer-use-insecure-tls-policy-id

>

NIFCLOUD LB using insecure TLS policy name

terraform-nifcloud-load-balancer-use-insecure-tls-policy-name

>

NIFCLOUD NAS has common private network

terraform-nifcloud-nas-instance-has-common-private

>

NIFCLOUD NAS has public ingress NAS security group rule

terraform-nifcloud-nas-security-group-has-public-ingress-sgr

>

NIFCLOUD NAS undefined description to NAS security group

terraform-nifcloud-nas-security-group-description-undefined

>

NIFCLOUD RDB backup retention period below 7 days

terraform-nifcloud-db-does-not-have-long-backup-retention

>

NIFCLOUD RDB has common private network

terraform-nifcloud-db-instance-has-common-private

>

NIFCLOUD RDB has public DB access

terraform-nifcloud-db-has-public-access

>

NIFCLOUD RDB has public DB ingress security group rule

terraform-nifcloud-db-security-group-has-public-ingress-sgr

>

NIFCLOUD RDB undefined description to DB security group

terraform-nifcloud-db-security-group-description-undefined

>

NIFCLOUD router has common private network

terraform-nifcloud-router-has-common-private

>

NIFCLOUD router undefined security group

terraform-nifcloud-router-security-group-undefined

>

NIFCLOUD VPN gateway undefined security group

terraform-nifcloud-vpn-gateway-security-group-undefined

>

Terraform / Nifcloud

>

CDB instance internet service enabled

terraform-tencentcloud-cdb-instance-internet-service-enabled

>

CDB instance internet using default intranet port

terraform-tencentcloud-cdb-instance-using-default-intranet-port

>

CDB instance without backup policy

terraform-tencentcloud-cdb-instance-without-backup-policy

>

CLB instance log setting disabled

terraform-tencentcloud-clb-instance-log-setting-disabled

>

CLB listener using insecure protocols

terraform-tencentcloud-clb-listener-using-insecure-protocols

>

CVM instance disable monitor service

terraform-tencentcloud-cvm-instance-disable-monitor-service

>

CVM instance has public IP

terraform-tencentcloud-cvm-instance-has-public-ip

>

CVM instance using default security group

terraform-tencentcloud-cvm-instance-using-default-security-group

>

CVM instance using default VPC

terraform-tencentcloud-cvm-instance-using-default-vpc

>

CVM instance using user data

terraform-tencentcloud-cvm-instance-using-user-data

>

Disk encryption disabled

terraform-tencentcloud-disk-encryption-disabled

>

Security group rule set accepts all traffic

terraform-tencentcloud-security-group-rule-set-accepts-all-traffic

>

TKE cluster encryption protection disabled

terraform-tencentcloud-tke-cluster-encryption-protection-disabled

>

TKE cluster has public access

terraform-tencentcloud-tke-cluster-has-public-access

>

TKE cluster log agent is not enabled

terraform-tencentcloud-tke-cluster-log-disabled

>

VPC flow logs disabled

terraform-tencentcloud-vpc-flow-log-disabled

>

Terraform / TencentCloud

>