Infrastructure as Code (IaC) セキュリティ は、デプロイ前に Infrastructure as Code ファイルの誤構成やセキュリティリスクを特定し、クラウド環境が安全でコンプライアンスを維持できるように支援します。

参考資料

お役に立つドキュメント、リンクや記事:

IaC セキュリティのセットアップドキュメント IaC セキュリティの構成ドキュメント

Allow unsafe lookups enabled in defaults

ansible-allow-unsafe-lookups-enabled-in-defaults

>

Ansible Tower exposed to the internet

ansible-ansible-tower-exposed-to-internet

>

Communication over HTTP

ansible-communication-over-http

>

Communication over HTTP in defaults

ansible-communication-over-http-in-defaults

>

Insecure relative path resolution

ansible-insecure-relative-path-resolution

>

Logging of sensitive data

ansible-logging-of-sensitive-data

>

Logging of sensitive data in defaults

ansible-logging-of-sensitive-data-in-defaults

>

Privilege escalation using become plugin

ansible-privilege-escalation-using-become-plugin

>

Privilege escalation using become plugin in defaults

ansible-privilege-escalation-using-become-plugin-in-defaults

>

Risky file permissions

ansible-risky-file-permissions

>

Unpinned package version

ansible-unpinned-package-version

>

Ansible

>

ALB listening on HTTP

ansible-aws-alb-listening-on-http

>

AMI not encrypted

ansible-aws-ami-not-encrypted

>

AMI shared with multiple accounts

ansible-aws-ami-shared-with-multiple-accounts

>

API Gateway endpoint config is not private

ansible-aws-api-gateway-endpoint-config-is-not-private

>

API Gateway with CloudWatch Logs disabled

ansible-aws-api-gateway-with-cloudwatch-logging-disabled

>

API Gateway without configured authorizer

ansible-aws-api-gateway-without-configured-authorizer

>

API Gateway without SSL certificate

ansible-aws-api-gateway-without-ssl-certificate

>

API Gateway without WAF

ansible-aws-api-gateway-without-waf

>

API Gateway X-Ray disabled

ansible-aws-api-gateway-xray-disabled

>

Authentication without MFA

ansible-aws-authentication-without-mfa

>

Auto Scaling Group with no associated ELB

ansible-aws-auto-scaling-group-with-no-associated-elb

>

Automatic minor upgrades disabled

ansible-aws-automatic-minor-upgrades-disabled

>

AWS password policy with unchangeable passwords

ansible-aws-aws-password-policy-with-unchangeable-passwords

>

Batch job definition with privileged container properties

ansible-aws-batch-job-definition-with-privileged-container-properties

>

CA certificate identifier is outdated

ansible-aws-ca-certificate-identifier-is-outdated

>

CDN configuration is missing

ansible-aws-cdn-configuration-is-missing

>

Certificate has expired

ansible-aws-certificate-has-expired

>

Certificate RSA key bytes lower than 256

ansible-aws-certificate-rsa-key-bytes-lower-than-256

>

CloudFront logging disabled

ansible-aws-cloudfront-logging-disabled

>

CloudFront viewer protocol policy allows HTTP

ansible-aws-viewer-protocol-policy-allows-http

>

CloudFront without minimum protocol TLS 1.2

ansible-aws-cloudfront-without-minimum-protocol-tls-1-2

>

CloudFront without WAF

ansible-aws-cloudfront-without-waf

>

CloudTrail log file validation disabled

ansible-aws-cloudtrail-log-file-validation-disabled

>

CloudTrail log files not encrypted with KMS

ansible-aws-cloudtrail-log-files-not-encrypted-with-kms

>

CloudTrail logging disabled

ansible-aws-cloudtrail-logging-disabled

>

CloudTrail multi-region is disabled

ansible-aws-cloudtrail-multi-region-disabled

>

CloudTrail not integrated with CloudWatch

ansible-aws-cloudtrail-not-integrated-with-cloudwatch

>

CloudTrail SNS topic name undefined

ansible-aws-cloudtrail-sns-topic-name-undefined

>

CloudWatch without retention period specified

ansible-aws-cloudwatch-without-retention-period-specified

>

CMK is unusable

ansible-aws-cmk-is-unusable

>

CMK rotation disabled

ansible-aws-cmk-rotation-disabled

>

CodeBuild project is not encrypted

ansible-aws-codebuild-not-encrypted

>

Config rule for encrypted volumes disabled

ansible-aws-config-rule-for-encrypted-volumes-is-disabled

>

Configuration aggregator to all regions disabled

ansible-aws-config-configuration-aggregator-to-all-regions-disabled

>

Cross-account IAM assume role policy without ExternalId or MFA

ansible-aws-cross-account-iam-assume-role-policy-without-external-id-or-mfa

>

DB instance storage not encrypted

ansible-aws-db-instance-storage-not-encrypted

>

DB security group open to large scope

ansible-aws-db-security-group-open-to-large-scope

>

DB security group with public scope

ansible-aws-db-security-group-with-public-scope

>

Default security groups with unrestricted traffic

ansible-aws-default-security-groups-with-unrestricted-traffic

>

EBS volume encryption disabled

ansible-aws-ebs-volume-encryption-disabled

>

EC2 instance has public IP

ansible-aws-ec2-instance-has-public-ip

>

EC2 instance is not EBS optimized

ansible-aws-ec2-not-ebs-optimized

>

EC2 instance using default security group

ansible-aws-ec2-instance-using-default-security-group

>

EC2 instance using default VPC

ansible-aws-ec2-instance-using-default-vpc

>

EC2 security group allows public access

ansible-aws-ec2-group-has-public-interface

>

ECR image tag not immutable

ansible-aws-ecr-image-tag-not-immutable

>

ECR repository is publicly accessible

ansible-aws-ecr-repository-is-publicly-accessible

>

ECS service admin role is present

ansible-aws-ecs-service-admin-role-is-present

>

ECS service without running tasks

ansible-aws-ecs-service-without-running-tasks

>

ECS services should not be assigned public IP addresses

ansible-aws-ecs-services-assigned-with-public-ip-address

>

ECS task definition network mode not recommended

ansible-aws-ecs-task-definition-network-mode-not-recommended

>

EFS not encrypted

ansible-aws-efs-not-encrypted

>

EFS without KMS

ansible-aws-efs-without-kms

>

EFS without tags

ansible-aws-efs-without-tags

>

ElastiCache using default port

ansible-aws-elasticache-using-default-port

>

ElastiCache without VPC

ansible-aws-elasticache-without-vpc

>

Elasticsearch with HTTPS disabled

ansible-aws-elasticsearch-with-https-disabled

>

ELB using insecure protocols

ansible-aws-elb-using-insecure-protocols

>

ELB using weak ciphers

ansible-aws-elb-using-weak-ciphers

>

Hardcoded AWS access key

ansible-aws-hardcoded-aws-access-key

>

Hardcoded AWS access key in Lambda

ansible-aws-hardcoded-aws-access-key-in-lambda

>

HTTP port open to internet

ansible-aws-http-port-open-to-internet

>

IAM access key is exposed

ansible-aws-iam-access-key-is-exposed

>

IAM database authentication is not enabled

ansible-aws-iam-database-auth-not-enabled

>

IAM group without users

ansible-aws-iam-group-without-users

>

IAM password without minimum length

ansible-aws-iam-password-without-minimum-length

>

IAM policies attached to user

ansible-aws-iam-policies-attached-to-user

>

IAM policies with full privileges

ansible-aws-iam-policies-with-full-privileges

>

IAM policy grants 'AssumeRole' permission across all services

ansible-aws-iam-policy-grants-assumerole-permission-across-all-services

>

IAM policy grants full permissions

ansible-aws-iam-policy-grants-full-permissions

>

IAM role allows all principals to assume

ansible-aws-iam-role-allows-all-principals-to-assume

>

Instance uses metadata service IMDSv1

ansible-aws-instance-uses-metadata-service-imdsv1

>

Instance with no VPC

ansible-aws-instance-with-no-vpc

>

Kinesis not encrypted with KMS

ansible-aws-kinesis-not-encrypted-with-kms

>

KMS key with vulnerable policy

ansible-aws-kms-key-with-full-permissions

>

Lambda function without tags

ansible-aws-lambda-function-without-tags

>

Lambda functions without X-Ray tracing

ansible-aws-lambda-functions-without-x-ray-tracing

>

Lambda permission misconfigured

ansible-aws-lambda-permission-misconfigured

>

Lambda permission principal is wildcard

ansible-aws-lambda-permission-principal-is-wildcard

>

Launch configuration is not encrypted

ansible-aws-launch-configuration-is-not-encrypted

>

Misconfigured password policy expiration

ansible-aws-misconfigured-password-policy-expiration

>

No stack policy

ansible-aws-no-stack-policy

>

Password without reuse prevention

ansible-aws-password-without-reuse-prevention

>

Public Lambda via API Gateway

ansible-aws-public-lambda-via-api-gateway

>

Public port with wide port range

ansible-aws-public-port-wide

>

RDS DB instance is not publicly accessible

ansible-aws-rds-db-instance-publicly-accessible

>

RDS instance associated with a public subnet

ansible-aws-rds-associated-with-public-subnet

>

RDS instance uses a default port

ansible-aws-rds-using-default-port

>

RDS instance with backup disabled

ansible-aws-rds-with-backup-disabled

>

Redis not compliant

ansible-aws-redis-not-compliant

>

Redshift cluster is not encrypted

ansible-aws-redshift-not-encrypted

>

Redshift publicly accessible

ansible-aws-redshift-publicly-accessible

>

Redshift using default port

ansible-aws-redshift-using-default-port

>

Remote desktop port open to internet

ansible-aws-remote-desktop-port-open

>

Root account has active access keys

ansible-aws-root-account-has-active-access-keys

>

Route 53 record undefined

ansible-aws-route53-record-undefined

>

S3 bucket access to any principal

ansible-aws-s3-bucket-access-to-any-principal

>

S3 bucket ACL allows read access to all users

ansible-aws-s3-bucket-acl-allows-read-to-all-users

>

S3 bucket ACL allows read access to any authenticated user

ansible-aws-s3-bucket-acl-allows-read-to-any-authenticated-user

>

S3 bucket allows delete action from all principals

ansible-aws-s3-bucket-allows-delete-action-from-all-principals

>

S3 bucket allows GET action from all principals

ansible-aws-s3-bucket-allows-get-action-from-all-principals

>

S3 bucket allows list action from all principals

ansible-aws-s3-bucket-allows-list-action-from-all-principals

>

S3 bucket allows put action from all principals

ansible-aws-s3-bucket-allows-put-action-from-all-principals

>

S3 bucket logging disabled

ansible-aws-s3-bucket-logging-disabled

>

S3 bucket with all permissions

ansible-aws-s3-bucket-with-all-permissions

>

S3 bucket with public access

ansible-aws-s3-bucket-with-public-access

>

S3 bucket with unsecured CORS rule

ansible-aws-s3-bucket-with-unsecured-cors-rule

>

S3 bucket without server-side encryption

ansible-aws-s3-bucket-without-server-side-encryption

>

S3 bucket without versioning

ansible-aws-s3-bucket-without-versioning

>

Secure ciphers disabled

ansible-aws-secure-ciphers-disabled

>

Security group ingress not restricted

ansible-aws-security-group-ingress-not-restricted

>

Security group with unrestricted access to SSH

ansible-aws-security-group-with-unrestricted-access-to-ssh

>

SES policy with allowed IAM actions

ansible-aws-ses-policy-with-allowed-iam-actions

>

SNS topic is publicly accessible

ansible-aws-sns-topic-is-publicly-accessible

>

SQL Analysis Services port 2383 (TCP) is publicly accessible

ansible-aws-sql-analysis-services-port-2383-is-publicly-accessible

>

SQS policy allows all actions

ansible-aws-sqs-policy-allows-all-actions

>

SQS policy with public access

ansible-aws-sqs-policy-with-public-access

>

SQS queue exposed

ansible-aws-sqs-queue-exposed

>

SQS queue with SSE disabled

ansible-aws-sqs-with-sse-disabled

>

Stack notifications disabled

ansible-aws-stack-notifications-disabled

>

Stack retention disabled

ansible-aws-stack-retention-disabled

>

Stack without template

ansible-aws-stack-without-template

>

Unknown port exposed to internet

ansible-aws-unknown-port-exposed-to-internet

>

Unrestricted security group ingress

ansible-aws-unrestricted-security-group-ingress

>

User data contains encoded private key

ansible-aws-user-data-contains-encoded-private-key

>

Vulnerable default SSL certificate

ansible-aws-vulnerable-default-ssl-certificate

>

Ansible / AWS

>

AD admin not configured for SQL server

ansible-azure-ad-admin-not-configured-for-sql-server

>

Admin user enabled for container registry

ansible-azure-admin-user-enabled-for-container-registry

>

AKS monitoring logging disabled

ansible-azure-aks-monitoring-logging-disabled

>

AKS network policy misconfigured

ansible-azure-aks-network-policy-misconfigured

>

AKS RBAC disabled

ansible-azure-aks-rbac-disabled

>

Azure Container Registry with no locks

ansible-azure-azure-container-registry-with-no-locks

>

Azure instance using basic authentication

ansible-azure-azure-instance-using-basic-authentication

>

Cosmos DB account without tags

ansible-azure-cosmosdb-account-without-tags

>

CosmosDB account IP range filter not set

ansible-azure-cosmosdb-account-ip-range-filter-not-set

>

Default Azure storage account network access is too permissive

ansible-azure-default-azure-storage-account-network-access-is-too-permissive

>

Firewall rule allows too many hosts to access Redis Cache

ansible-azure-firewall-rule-allows-too-many-hosts-to-access-redis-cache

>

Key Vault soft delete is disabled

ansible-azure-key-vault-soft-delete-is-disabled

>

Log retention is not set

ansible-azure-log-retention-is-not-set

>

Monitoring log profile without all activities

ansible-azure-monitoring-log-profile-without-all-activities

>

MySQL SSL connection disabled

ansible-azure-mysql-ssl-connection-disabled

>

PostgreSQL log checkpoints disabled

ansible-azure-postgresql-log-checkpoints-disabled

>

PostgreSQL log connections not set

ansible-azure-postgresql-log-connections-not-set

>

PostgreSQL log disconnections not set

ansible-azure-postgresql-log-disconnections-not-set

>

PostgreSQL log duration not set

ansible-azure-postgresql-log-duration-not-set

>

PostgreSQL server without connection throttling

ansible-azure-postgresql-server-without-connection-throttling

>

Public storage account

ansible-azure-public-storage-account

>

Redis cache allows non-SSL connections

ansible-azure-redis-cache-allows-non-ssl-connections

>

Redis entirely accessible

ansible-azure-redis-entirely-accessible

>

Redis publicly accessible

ansible-azure-redis-publicly-accessible

>

Role definition allows custom role creation

ansible-azure-role-definition-allows-custom-role-creation

>

Security group is not configured

ansible-azure-security-group-is-not-configured

>

Sensitive port is exposed to entire network

ansible-azure-sensitive-port-is-exposed-to-entire-network

>

Small activity log retention period

ansible-azure-small-activity-log-retention-period

>

SQL Server predictable Active Directory account name

ansible-azure-sql-server-predictable-active-directory-admin-account-name

>

SQL Server predictable admin account name

ansible-azure-sql-server-predictable-admin-account-name

>

SQLServer ingress from any IP

ansible-azure-sql-server-ingress-from-any-ip

>

SSL enforce disabled

ansible-azure-ssl-enforce-is-disabled

>

Storage account not forcing HTTPS

ansible-azure-storage-account-not-forcing-https

>

Storage account not using latest TLS encryption version

ansible-azure-storage-account-not-using-latest-tls-encryption-version

>

Storage container is publicly accessible

ansible-azure-storage-container-is-publicly-accessible

>

Trusted Microsoft services not enabled

ansible-azure-trusted-microsoft-services-not-enabled

>

Unrestricted SQL Server access

ansible-azure-unrestricted-sql-server-access

>

VM not attached to network

ansible-azure-vm-not-attached-to-network

>

WAF is disabled for Azure Application Gateway

ansible-azure-waf-is-disabled-for-azure-application-gateway

>

Web app accepting traffic other than HTTPS

ansible-azure-web-app-accepting-traffic-other-than-https

>

Ansible / Azure

>

BigQuery dataset is public

ansible-gcp-bigquery-dataset-is-public

>

Client certificate disabled

ansible-gcp-client-certificate-disabled

>

Cloud DNS without DNSSEC

ansible-gcp-cloud-dns-without-dnssec

>

Cloud SQL instance with contained database authentication on

ansible-gcp-cloud-sql-instance-with-contained-database-authentication-on

>

Cloud SQL instance with cross DB ownership chaining on

ansible-gcp-cloud-sql-instance-with-cross-db-ownership-chaining-on

>

Cloud storage anonymous or publicly accessible

ansible-gcp-cloud-storage-anonymous-or-publicly-accessible

>

Cloud storage bucket logging not enabled

ansible-gcp-cloud-storage-bucket-logging-not-enabled

>

Cloud storage bucket versioning disabled

ansible-gcp-cloud-storage-bucket-versioning-disabled

>

Cluster labels disabled

ansible-gcp-cluster-labels-disabled

>

Cluster master authentication disabled

ansible-gcp-cluster-master-authentication-disabled

>

Compute instance is publicly accessible

ansible-gcp-compute-instance-is-publicly-accessible

>

COS node image not used

ansible-gcp-cos-node-image-not-used

>

Disk encryption disabled

ansible-gcp-disk-encryption-disabled

>

DNSSEC using RSASHA1

ansible-gcp-dnssec-using-rsasha1

>

GKE basic authentication enabled

ansible-gcp-gke-basic-authentication-enabled

>

GKE legacy authorization enabled

ansible-gcp-gke-legacy-authorization-enabled

>

GKE master authorized networks disabled

ansible-gcp-gke-master-authorized-networks-disabled

>

GKE using default service account

ansible-gcp-gke-using-default-service-account

>

Google Compute network using default firewall rule

ansible-gcp-google-compute-network-using-default-firewall-rule

>

Google Compute network using firewall rule that allows all ports

ansible-gcp-google-compute-network-using-firewall-rule-allows-all-ports

>

Google Compute network using firewall rule that allows port range

ansible-gcp-google-compute-network-using-firewall-allows-port-range

>

Google Compute SSL policy weak cipher in use

ansible-gcp-google-compute-ssl-policy-weak-cipher-in-use

>

Google Compute subnetwork with Private Google Access disabled

ansible-gcp-google-compute-subnetwork-with-private-google-access-disabled

>

Google container node pool auto repair disabled

ansible-gcp-google-container-node-pool-auto-repair-disabled

>

High Google KMS crypto key rotation period

ansible-gcp-high-google-kms-crypto-key-rotation-period

>

IP aliasing disabled

ansible-gcp-ip-aliasing-disabled

>

IP forwarding enabled

ansible-gcp-ip-forwarding-enabled

>

MySQL instance with local infile on

ansible-gcp-mysql-instance-with-local-infile-on

>

Network policy disabled

ansible-gcp-network-policy-disabled

>

Node auto-upgrade disabled

ansible-gcp-node-auto-upgrade-disabled

>

OSLogin is disabled in VM instance

ansible-gcp-oslogin-is-disabled-for-vm-instance

>

PostgreSQL log connections disabled

ansible-gcp-postgresql-log-connections-disabled

>

PostgreSQL log_checkpoints flag not set to on

ansible-gcp-postgresql-log-checkpoints-flag-not-set-to-on

>

PostgreSQL logging of temporary files disabled

ansible-gcp-postgresql-logging-of-temporary-files-disabled

>

PostgreSQL misconfigured log messages flag

ansible-gcp-postgresql-misconfigured-log-messages-flag

>

PostgreSQL misconfigured logging duration flag

ansible-gcp-postgresql-misconfigured-logging-duration-flag

>

Private cluster disabled

ansible-gcp-private-cluster-disabled

>

Project-wide SSH keys are enabled in VM instances

ansible-gcp-project-wide-ssh-keys-are-enabled-in-vm-instances

>

RDP access is not restricted

ansible-gcp-rdp-access-is-not-restricted

>

Serial ports are enabled for VM instances

ansible-gcp-serial-ports-enabled-for-vm-instances

>

Shielded VM disabled

ansible-gcp-shielded-vm-disabled

>

SQL DB instance backup disabled

ansible-gcp-sql-db-instance-backup-disabled

>

SQL DB instance publicly accessible

ansible-gcp-sql-db-instance-is-publicly-accessible

>

SQL DB instance with SSL disabled

ansible-gcp-sql-db-instance-with-ssl-disabled

>

SSH access is not restricted

ansible-gcp-ssh-access-is-not-restricted

>

Stackdriver logging disabled

ansible-gcp-stackdriver-logging-disabled

>

Stackdriver monitoring disabled

ansible-gcp-stackdriver-monitoring-disabled

>

Using default service account

ansible-gcp-using-default-service-account

>

VM with full cloud access

ansible-gcp-vm-with-full-cloud-access

>

Ansible / GCP

>

Anonymous definition

cicd-github-anonymous-definition

>

Cache poisoning

cicd-github-cache-poisoning

>

Concurrency limits

cicd-github-concurrency-limits

>

Dangerous triggers

cicd-github-dangerous-triggers

>

Dependabot cooldown

cicd-github-dependabot-cooldown

>

Dependabot execution

cicd-github-dependabot-execution

>

GitHub environment file injection

cicd-github-github-env

>

Hardcoded container credentials

cicd-github-hardcoded-container-credentials

>

Misfeature

cicd-github-misfeature

>

Obfuscation

cicd-github-obfuscation

>

Overprovisioned secrets

cicd-github-overprovisioned-secrets

>

Run block injection

cicd-github-run-block-injection

>

Script block injection

cicd-github-script-block-injection

>

Secrets inherit

cicd-github-secrets-inherit

>

Secrets outside environment

cicd-github-secrets-outside-env

>

Self-hosted runner

cicd-github-self-hosted-runner

>

Superfluous actions

cicd-github-superfluous-actions

>

Unpinned actions full length commit SHA

cicd-github-unpinned-actions-full-length-commit-sha

>

Unpinned images

cicd-github-unpinned-images

>

Unredacted secrets

cicd-github-unredacted-secrets

>

Unsecured commands

cicd-github-unsecured-commands

>

Unsound condition

cicd-github-unsound-conditions

>

Unsound contains with controllable input

cicd-github-unsound-contains-with-controllable-input

>

Unsound contains without controllable input

cicd-github-unsound-contains-no-controllable-input

>

Unspecified workflows level permissions

cicd-github-unspecified-workflows-permissions

>

Use trusted publishing for authentication

cicd-github-use-trusted-publishing

>

CICD / GitHub

>

ALB is not integrated with WAF

cloudformation-aws-alb-is-not-integrated-with-waf

>

ALB listening on HTTP

cloudformation-aws-alb-listening-on-http

>

Alexa skill plaintext client secret exposed

cloudformation-aws-alexa-skill-plaintext-client-secret-exposed

>

Amazon MQ broker encryption disabled

cloudformation-aws-amazon-mq-broker-encryption-disabled

>

Amazon MQ broker is publicly accessible

cloudformation-aws-mq-broker-is-publicly-accessible

>

Amazon MQ broker logging disabled

cloudformation-aws-mq-broker-logging-disabled

>

Amplify app access token exposed

cloudformation-aws-amplify-app-access-token-exposed

>

Amplify app basic auth config password exposed

cloudformation-aws-amplify-app-basic-auth-config-password-exposed

>

Amplify app OAuth token exposed

cloudformation-aws-amplify-app-oauth-token-exposed

>

Amplify branch basic auth config password exposed

cloudformation-aws-amplify-branch-basic-auth-config-password-exposed

>

API Gateway cache cluster disabled

cloudformation-aws-api-gateway-cache-cluster-disabled

>

API Gateway cache encrypted disabled

cloudformation-aws-api-gateway-cache-encrypted-disabled

>

API Gateway deployment without access log setting

cloudformation-aws-api-gateway-deployment-without-access-log-setting

>

API Gateway deployment without usage plan associated

cloudformation-aws-api-gateway-deployment-without-api-gateway-usage-plan-associated

>

API Gateway endpoint config is not private

cloudformation-aws-api-gateway-endpoint-config-is-not-private

>

API Gateway method does not contain an API key

cloudformation-aws-api-gateway-method-does-not-contain-an-api-key

>

API Gateway stage without usage plan associated

cloudformation-aws-api-gateway-stage-without-api-gateway-usage-plan-associated

>

API Gateway V2 stage access logging settings not defined

cloudformation-aws-api-gateway-access-logging-disabled

>

API Gateway with invalid compression

cloudformation-aws-api-gateway-with-invalid-compression

>

API Gateway with open access

cloudformation-aws-api-gateway-with-open-access

>

API Gateway without configured authorizer

cloudformation-aws-api-gateway-without-configured-authorizer

>

API Gateway without security policy

cloudformation-aws-api-gateway-without-security-policy

>

API Gateway without SSL certificate

cloudformation-aws-api-gateway-without-ssl-certificate

>

API Gateway without WAF

cloudformation-aws-api-gateway-without-waf

>

API Gateway X-Ray disabled

cloudformation-aws-api-gateway-xray-disabled

>

Auto Scaling group with no associated ELB

cloudformation-aws-auto-scaling-group-with-no-associated-elb

>

Automatic minor upgrades disabled

cloudformation-aws-automatic-minor-upgrades-disabled

>

AWS DMS replication instance is publicly accessible

cloudformation-aws-amazon-dms-replication-instance-is-publicly-accessible

>

Batch job definition with privileged container properties

cloudformation-aws-batch-job-definition-with-privileged-container-properties

>

CDN configuration is missing

cloudformation-aws-cdn-configuration-is-missing

>

CloudFormation metadata contains plaintext credentials

cloudformation-aws-cloudformation-specifying-credentials-not-safe

>

CloudFront logging disabled

cloudformation-aws-cloudfront-logging-disabled

>

CloudFront viewer protocol policy allows HTTP

cloudformation-aws-cloudfront-viewer-protocol-policy-allows-http

>

CloudFront without minimum protocol TLS 1.2

cloudformation-aws-cloudfront-without-minimum-protocol-tls-1-2

>

CloudFront without WAF

cloudformation-aws-cloudfront-without-waf

>

CloudTrail log file validation disabled

cloudformation-aws-cloudtrail-log-file-validation-disabled

>

CloudTrail log files not encrypted with KMS

cloudformation-aws-cloudtrail-log-files-not-encrypted-with-kms

>

CloudTrail logging disabled

cloudformation-aws-cloudtrail-logging-disabled

>

CloudTrail multi-region disabled

cloudformation-aws-cloudtrail-multi-region-disabled

>

CloudTrail not integrated with CloudWatch

cloudformation-aws-cloudtrail-not-integrated-with-cloudwatch

>

CloudTrail SNS topic name undefined

cloudformation-aws-cloudtrail-sns-topic-name-undefined

>

CloudWatch logging disabled

cloudformation-aws-cloudwatch-logging-disabled

>

CloudWatch metrics disabled

cloudformation-aws-cloudwatch-metrics-disabled

>

CMK is unusable

cloudformation-aws-cmk-is-unusable

>

CMK rotation disabled

cloudformation-aws-cmk-rotation-disabled

>

CMK unencrypted storage

cloudformation-aws-cmk-unencrypted-storage

>

CodeBuild not encrypted

cloudformation-aws-codebuild-not-encrypted

>

Cognito user pool without MFA

cloudformation-aws-cognito-userpool-without-mfa

>

Config rule for encrypted volumes disabled

cloudformation-aws-config-rule-for-encryption-volumes-disabled

>

Configuration aggregator to all regions disabled

cloudformation-aws-config-configuration-aggregator-to-all-regions-disabled

>

Connection between CloudFront origin not encrypted

cloudformation-aws-connection-between-cloudfront-origin-not-encrypted

>

Cross-account IAM assume role policy without external ID or MFA

cloudformation-aws-cross-account-iam-assume-role-policy-without-external-id-or-mfa

>

DB security group open to large scope

cloudformation-aws-db-security-group-open-to-large-scope

>

DB security group with public scope

cloudformation-aws-db-security-group-with-public-scope

>

Default KMS key usage

cloudformation-aws-default-kms-key-usage

>

Default security groups with unrestricted traffic

cloudformation-aws-default-security-groups-with-unrestricted-traffic

>

Directory service Microsoft AD password set to plaintext or default ref

cloudformation-aws-directory-service-microsoft-ad-password-set-to-plaintext-or-default-ref

>

Directory service simple AD password exposed

cloudformation-aws-directory-service-simple-ad-password-exposed

>

DMS endpoint MongoDB settings password exposed

cloudformation-aws-dms-endpoint-mongo-db-settings-password-exposed

>

DMS endpoint password exposed

cloudformation-aws-dms-endpoint-password-exposed

>

DocDB cluster master password in plaintext

cloudformation-aws-docdb-cluster-master-password-in-plaintext

>

DocDB logging is disabled

cloudformation-aws-docdb-logging-disabled

>

DynamoDB table not encrypted

cloudformation-aws-dynamodb-table-not-encrypted

>

DynamoDB table point-in-time recovery disabled

cloudformation-aws-dynamodb-table-point-in-time-recovery-disabled

>

DynamoDB with AWS-owned CMK

cloudformation-aws-dynamodb-with-aws-owned-cmk

>

DynamoDB with non-recommended table billing mode

cloudformation-aws-dynamodb-with-table-billing-mode-not-recommended

>

EBS volume encryption disabled

cloudformation-aws-ebs-volume-encryption-disabled

>

EBS volume not attached to instances

cloudformation-aws-ebs-volume-not-attached-to-instances

>

EBS volume without KmsKeyId

cloudformation-aws-ebs-volume-without-kms-key-id

>

EC2 instance has no IAM role

cloudformation-aws-ec2-instance-has-no-iam-role

>

EC2 instance monitoring disabled

cloudformation-aws-ec2-instance-monitoring-disabled

>

EC2 instance subnet has public IP mapping on launch

cloudformation-aws-ec2-instance-subnet-has-public-ip-mapping-on-launch

>

EC2 instance using default security group

cloudformation-aws-ec2-instance-using-default-security-group

>

EC2 instance using default VPC

cloudformation-aws-ec2-instance-using-default-vpc

>

EC2 Network ACL Deny rule not blocking all traffic

cloudformation-aws-ec2-network-acl-ineffective-denied-traffic

>

EC2 network ACL duplicate rule

cloudformation-aws-ec2-network-acl-duplicate-rule

>

EC2 network ACL overlapping ports

cloudformation-aws-ec2-network-acl-overlapping-ports

>

EC2 not EBS optimized

cloudformation-aws-ec2-not-ebs-optimized

>

EC2 permissive network ACL protocols

cloudformation-aws-ec2-permissive-network-acl-protocols

>

EC2 public instance exposed through subnet

cloudformation-aws-ec2-public-instance-exposed-through-subnet

>

EC2 sensitive port is publicly exposed

cloudformation-aws-ec2-sensitive-port-is-publicly-exposed

>

ECR image tag not immutable

cloudformation-aws-ecr-image-tag-not-immutable

>

ECR repository is publicly accessible

cloudformation-aws-ecr-repository-is-publicly-accessible

>

ECS cluster not encrypted at rest

cloudformation-aws-ecs-cluster-not-encrypted-at-rest

>

ECS cluster with Container Insights disabled

cloudformation-aws-ecs-cluster-container-insights-disabled

>

ECS no load balancer attached

cloudformation-aws-ecs-no-load-balancer-attached

>

ECS service admin role is present

cloudformation-aws-ecs-service-admin-role-is-present

>

ECS service without running tasks

cloudformation-aws-ecs-service-without-running-tasks

>

ECS task definition health check missing

cloudformation-aws-ecs-task-definition-healthcheck-missing

>

ECS task definition invalid CPU or memory

cloudformation-aws-ecs-task-definition-invalid-cpu-or-memory

>

ECS task definition network mode not recommended

cloudformation-aws-ecs-task-definition-network-mode-not-recommended

>

EFS not encrypted

cloudformation-aws-efs-not-encrypted

>

EFS volume with disabled transit encryption

cloudformation-aws-efs-volume-with-disabled-transit-encryption

>

EFS without KMS

cloudformation-aws-efs-without-kms

>

EFS without tags

cloudformation-aws-efs-without-tags

>

EKS node group remote access

cloudformation-aws-eks-node-group-remote-access

>

ElastiCache nodes not created across multi-AZ

cloudformation-aws-elasticache-nodes-not-created-across-multi-az

>

ElastiCache using default port

cloudformation-aws-elasticache-using-default-port

>

ElastiCache with disabled at-rest encryption

cloudformation-aws-elasticache-with-disabled-at-rest-encryption

>

ElastiCache with disabled transit encryption

cloudformation-aws-elasticache-with-disabled-transit-encryption

>

ElastiCache without VPC

cloudformation-aws-elasticache-without-vpc

>

Elasticsearch encryption with KMS disabled

cloudformation-aws-elasticsearch-domain-encryption-with-kms-disabled

>

Elasticsearch logs disabled

cloudformation-aws-elasticsearch-logs-disabled

>

Elasticsearch not encrypted at rest

cloudformation-aws-elasticsearch-not-encrypted-at-rest

>

Elasticsearch with HTTPS disabled

cloudformation-aws-elasticsearch-with-https-disabled

>

Elasticsearch without IAM authentication

cloudformation-aws-elasticsearch-without-iam-authentication

>

Elasticsearch without slow logs

cloudformation-aws-elasticsearch-without-slow-logs

>

ELB access log disabled

cloudformation-aws-elb-access-log-disabled

>

ELB sensitive port is exposed to entire network

cloudformation-aws-elb-sensitive-port-is-exposed-to-entire-network

>

ELB using insecure protocols

cloudformation-aws-elb-using-insecure-protocols

>

ELB using weak ciphers

cloudformation-aws-elb-using-weak-ciphers

>

ELB with security group without inbound rules

cloudformation-aws-elb-with-security-group-without-inbound-rules

>

ELB with security group without outbound rules

cloudformation-aws-elb-with-security-group-without-outbound-rules

>

ELB without secure protocol

cloudformation-aws-elb-without-secure-protocol

>

ELBv2 ALB access log disabled

cloudformation-aws-elb-v2-alb-access-log-disabled

>

Empty roles for ECS cluster task definitions

cloudformation-aws-empty-roles-for-ecs-cluster-task-definitions

>

EMR cluster without security configuration

cloudformation-aws-emr-cluster-without-security-configuration

>

EMR security configuration encryption disabled

cloudformation-aws-emr-security-configuration-encryptions-enabled

>

EMR without VPC

cloudformation-aws-emr-wihout-vpc

>

Fully open ingress

cloudformation-aws-fully-open-ingress

>

GameLift fleet EC2 inbound permissions with port range

cloudformation-aws-gamelift-fleet-ec2-inbound-permissions-with-port-range

>

Geo restriction disabled

cloudformation-aws-geo-restriction-disabled

>

GitHub repository set to public

cloudformation-aws-github-repository-set-to-public

>

GuardDuty detector disabled

cloudformation-aws-guardduty-detector-disabled

>

Hardcoded AWS access key in Lambda

cloudformation-aws-hardcoded-aws-access-key-in-lambda

>

High access key rotation period

cloudformation-aws-access-key-not-rotated-within-90-days

>

HTTP port open to internet

cloudformation-aws-http-port-open

>

IAM Access Analyzer not enabled

cloudformation-aws-iam-access-analyzer-not-enabled

>

IAM database auth not enabled

cloudformation-aws-iam-database-auth-not-enabled

>

IAM group inline policies

cloudformation-aws-iam-groups-inline-policies

>

IAM group without users

cloudformation-aws-iam-group-without-users

>

IAM managed policy applied to a user

cloudformation-aws-iam-managed-policy-applied-to-a-user

>

IAM password without minimum length

cloudformation-aws-iam-password-without-minimum-length

>

IAM policies attached to a user

cloudformation-aws-iam-policies-attached-to-user

>

IAM policies with full privileges

cloudformation-aws-iam-policies-with-full-privileges

>

IAM policies without groups

cloudformation-aws-iam-policies-without-groups

>

IAM policy grants AssumeRole permission across all services

cloudformation-aws-iam-policy-grants-assumerole-permission-across-all-services

>

IAM policy grants full permissions

cloudformation-aws-iam-policy-grants-full-permissions

>

IAM policy on user

cloudformation-aws-iam-policy-on-user

>

IAM role allows all principals to assume

cloudformation-aws-iam-role-allows-all-principals-to-assume

>

IAM user has too many access keys

cloudformation-aws-iam-user-too-many-access-keys

>

IAM user LoginProfile password is in plaintext

cloudformation-aws-iam-user-login-profile-password-is-in-plaintext

>

IAM user with no group

cloudformation-aws-iam-user-with-no-group

>

IAM user without password reset

cloudformation-aws-user-iam-missing-password-reset-required

>

Inline policies are attached to an ECS service

cloudformation-aws-inline-policies-are-attached-to-ecs-service

>

Instance with no VPC

cloudformation-aws-instance-with-no-vpc

>

IoT policy allows a wildcard resource

cloudformation-aws-iot-policy-allows-wildcard-resource

>

IoT policy allows action as a wildcard

cloudformation-aws-iot-policy-allows-action-as-wildcard

>

Kinesis SSE not configured

cloudformation-aws-kinesis-sse-not-configured

>

KMS allows a wildcard principal

cloudformation-aws-kms-allows-wildcard-principal

>

KMS key rotation disabled

cloudformation-aws-kms-enable-key-rotation-disabled

>

KMS key with a vulnerable policy

cloudformation-aws-kms-key-with-full-permissions

>

Lambda function without dead-letter queue

cloudformation-aws-lambda-function-without-dead-letter-queue

>

Lambda function without tags

cloudformation-aws-lambda-function-without-tags

>

Lambda functions with full privileges

cloudformation-aws-lambda-functions-with-full-privileges

>

Lambda functions without unique IAM roles

cloudformation-aws-lambda-functions-without-unique-iam-roles

>

Lambda functions without X-Ray tracing

cloudformation-aws-lambda-functions-without-x-ray-tracing

>

Lambda permission misconfigured

cloudformation-aws-lambda-permission-misconfigured

>

Lambda permission principal is a wildcard

cloudformation-aws-lambda-permission-principal-is-wildcard

>

Low RDS backup retention period

cloudformation-aws-low-rds-backup-retention-period

>

MSK broker is publicly accessible

cloudformation-aws-msk-broker-is-publicly-accessible

>

MSK cluster encryption disabled

cloudformation-aws-msk-cluster-encryption-disabled

>

MSK cluster logging disabled

cloudformation-aws-msk-cluster-logging-disabled

>

Neptune cluster with IAM database authentication disabled

cloudformation-aws-neptune-cluster-with-iam-database-authentication-disabled

>

Neptune database cluster encryption disabled

cloudformation-aws-neptune-database-cluster-encryption-disabled

>

Permissive Web ACL default action

cloudformation-aws-webacl-allow-defaultaction

>

Public Lambda function via API Gateway

cloudformation-aws-public-lambda-via-api-gateway

>

RDS associated with a public subnet

cloudformation-aws-rds-associated-with-public-subnet

>

RDS DB instance publicly accessible

cloudformation-aws-rds-db-instance-publicly-accessible

>

RDS DB instance with deletion protection disabled

cloudformation-aws-rds-db-instance-with-deletion-protection-disabled

>

RDS Multi-AZ deployment disabled

cloudformation-aws-rds-multi-az-deployment-disabled

>

RDS storage encryption disabled

cloudformation-aws-rds-storage-encryption-disabled

>

RDS storage not encrypted

cloudformation-aws-rds-storage-not-encrypted

>

RDS using default port

cloudformation-aws-rds-using-default-port

>

RDS with backup disabled

cloudformation-aws-rds-with-backup-disabled

>

Redshift cluster logging disabled

cloudformation-aws-redshift-cluster-logging-disabled

>

Redshift cluster without a KMS CMK

cloudformation-aws-redshift-cluster-without-kms-cmk

>

Redshift not encrypted

cloudformation-aws-redshift-not-encrypted

>

Redshift publicly accessible

cloudformation-aws-redshift-publicly-accessible

>

Redshift using default port

cloudformation-aws-redshift-using-default-port

>

Refresh token is exposed

cloudformation-aws-refresh-token-is-exposed

>

Remote Desktop port open to the internet

cloudformation-aws-remote-desktop-port-open-to-internet

>

Root account has active access keys

cloudformation-aws-root-account-has-active-access-keys

>

Route table with default routing

cloudformation-aws-routertable-with-default-routing

>

Route53 record undefined

cloudformation-aws-route53-record-undefined

>

S3 bucket access to any principal

cloudformation-aws-s3-bucket-access-to-any-principal

>

S3 bucket ACL allows read or write to all users

cloudformation-aws-s3-bucket-acl-allows-read-or-write-to-all-users

>

S3 bucket ACL allows read to all users

cloudformation-aws-s3-bucket-acl-allows-read-to-all-users

>

S3 bucket ACL allows read to any authenticated user

cloudformation-aws-s3-bucket-acl-allows-read-to-any-authenticated-user

>

S3 bucket allows delete action from all principals

cloudformation-aws-s3-bucket-allows-delete-actions-from-all-principals

>

S3 bucket allows get action from all principals

cloudformation-aws-s3-bucket-allows-get-actions-from-all-principals

>

S3 bucket allows list action from all principals

cloudformation-aws-s3-bucket-allows-list-actions-from-all-principals

>

S3 bucket allows public ACL

cloudformation-aws-s3-bucket-allows-public-acl

>

S3 bucket allows public policy

cloudformation-aws-s3-bucket-with-public-policy

>

S3 bucket allows put action from all principals

cloudformation-aws-s3-bucket-allows-put-actions-from-all-principals

>

S3 bucket allows restore actions from all principals

cloudformation-aws-s3-bucket-allows-restore-actions-from-all-principals

>

S3 bucket CloudTrail logging disabled

cloudformation-aws-s3-bucket-cloudtrail-logging-disabled

>

S3 bucket logging disabled

cloudformation-aws-s3-bucket-logging-disabled

>

S3 bucket should have bucket policy

cloudformation-aws-s3-bucket-should-have-bucket-policy

>

S3 bucket with all permissions

cloudformation-aws-s3-bucket-with-all-permissions

>

S3 bucket with unsecured CORS rule

cloudformation-aws-s3-bucket-with-unsecured-cors-rule

>

S3 bucket without ignore public ACL

cloudformation-aws-s3-bucket-without-ignore-public-acl

>

S3 bucket without restriction of public bucket

cloudformation-aws-s3-bucket-without-restriction-of-public-bucket

>

S3 bucket without server-side encryption

cloudformation-aws-s3-bucket-without-server-side-encryption

>

S3 bucket without SSL in write actions

cloudformation-aws-s3-bucket-without-ssl-in-write-actions

>

S3 bucket without versioning

cloudformation-aws-s3-bucket-without-versioning

>

S3 static website host enabled

cloudformation-aws-s3-static-website-host-enabled

>

SageMaker data encryption disabled

cloudformation-aws-sagemaker-data-encryption-disabled

>

SageMaker enabling internet access

cloudformation-aws-sagemaker-enabling-internet-access

>

SageMaker endpoint config should specify KmsKeyId attribute

cloudformation-aws-sagemaker-endpoint-config-should-specify-kms-key-id-attribute

>

SageMaker notebook not placed in VPC

cloudformation-aws-sagemaker-notebook-not-placed-in-vpc

>

SDB domain declared as a resource

cloudformation-aws-sdb-domain-declared-as-a-resource

>

Secrets manager should specify KmsKeyId

cloudformation-aws-secrets-manager-should-specify-kms-key-id

>

Secure ciphers disabled

cloudformation-aws-secure-ciphers-disabled

>

Security group egress CIDR open to world

cloudformation-aws-security-group-egress-cidr-open-to-world

>

Security group egress with all protocols

cloudformation-aws-security-group-egress-with-all-protocols

>

Security group egress with port range

cloudformation-aws-security-group-egress-with-port-range

>

Security group ingress has CIDR not recommended

cloudformation-aws-security-group-ingress-has-cidr-not-recommended

>

Security group ingress with all protocols

cloudformation-aws-security-group-ingress-with-all-protocols

>

Security group ingress with port range

cloudformation-aws-security-group-ingress-with-port-range

>

Security group rule without description

cloudformation-aws-security-group-rule-without-description

>

Security group unrestricted access to RDP

cloudformation-aws-security-groups-unrestricted-access-to-rdp

>

Security group with unrestricted access to SSH

cloudformation-aws-security-groups-with-unrestricted-access-to-ssh

>

Security groups allows unrestricted outbound traffic

cloudformation-aws-security-groups-allows-unrestricted-outbound-traffic

>

Security groups with exposed admin ports

cloudformation-aws-security-groups-with-exhibited-admin-ports

>

Security groups with meta IP

cloudformation-aws-security-groups-with-meta-ip

>

Security groups without VPC attached

cloudformation-aws-security-groups-without-vpc-attached

>

Serverless API access logging setting undefined

cloudformation-aws-serverless-api-access-logging-setting-undefined

>

Serverless API cache cluster disabled

cloudformation-aws-serverless-api-cache-cluster-disabled

>

Serverless API endpoint config not private

cloudformation-aws-serverless-api-endpoint-config-not-private

>

Serverless API without content encoding

cloudformation-aws-serverless-api-without-content-encoding

>

Serverless API X-Ray tracing disabled

cloudformation-aws-serverless-api-xray-tracing-disabled

>

Serverless function environment variables not encrypted

cloudformation-aws-serverless-function-environment-variables-not-encrypted

>

Serverless function without dead-letter queue

cloudformation-aws-serverless-function-without-dead-letter-queue

>

Serverless function without tags

cloudformation-aws-serverless-function-without-tags

>

Serverless function without unique IAM role

cloudformation-aws-serverless-function-without-unique-iam-role

>

Serverless function without X-Ray tracing

cloudformation-aws-serverless-function-without-x-ray-tracing

>

Shield Advanced not in use

cloudformation-aws-shield-advanced-not-in-use

>

SNS topic is publicly accessible

cloudformation-aws-sns-topic-is-publicly-accessible

>

SNS topic publicity has Allow and NotAction simultaneously

cloudformation-aws-sns-topic-publicity-has-allow-and-not-action-simultaneously

>

SNS topic without KmsMasterKeyId

cloudformation-aws-sns-topic-without-kms-master-key-id

>

SQS policy with public access

cloudformation-aws-sqs-policy-with-public-access

>

SQS with SSE disabled

cloudformation-aws-sqs-with-sse-disabled

>

Stack notifications disabled

cloudformation-aws-stack-notifications-disabled

>

Stack retention disabled

cloudformation-aws-stack-retention-disabled

>

Support has no role associated

cloudformation-aws-support-has-no-role-associated

>

TCP UDP protocol network ACL entry allows all ports

cloudformation-aws-tcp-or-udp-protocol-network-acl-entry-allows-all-ports

>

Unknown port exposed to internet

cloudformation-aws-unknown-port-exposed-to-internet

>

Unrestricted security group ingress

cloudformation-aws-unrestricted-security-group-ingress

>

Unscanned ECR image

cloudformation-aws-unscanned-ecr-image

>

User data contains encoded private key

cloudformation-aws-user-data-contains-encoded-private-key

>

VPC attached with too many gateways

cloudformation-aws-vpc-attached-with-too-many-gateways

>

VPC Flow Logs disabled

cloudformation-aws-vpc-flowlogs-disabled

>

VPC without attached subnet

cloudformation-aws-vpc-without-attached-subnet

>

VPC without Network Firewall

cloudformation-aws-vpc-without-network-firewall

>

Vulnerable default SSL certificate

cloudformation-aws-vulnerable-default-ssl-certificate

>

Wildcard in ACM certificate domain name

cloudformation-aws-wildcard-in-acm-certificate-domain-name

>

Workspace without encryption

cloudformation-aws-workspace-without-encryption

>

CloudFormation / AWS

>

ADD instead of COPY

dockerfile-add-instead-of-copy

>

apk add using local cache path

dockerfile-apk-add-using-local-cache-path

>

apt-get install lists were not deleted

dockerfile-apt-get-install-lists-were-not-deleted

>

apt-get install pin version not defined

dockerfile-apt-get-install-pin-version-not-defined

>

apt-get missing flags to avoid manual input

dockerfile-apt-get-missing-flags-to-avoid-manual-input

>

apt-get not avoiding additional packages

dockerfile-apt-get-not-avoiding-additional-packages

>

Avoid chmod 777

dockerfile-avoid-chmod-777

>

Avoid HTTP

dockerfile-avoid-http

>

Changing default shell using RUN command

dockerfile-changing-default-shell-using-run-command

>

chown flag exists

dockerfile-chown-flag-exists

>

COPY --from references current FROM alias

dockerfile-copy-from-references-current-from-alias

>

COPY with more than two arguments not ending with a slash

dockerfile-copy-with-more-than-two-arguments-not-ending-with-slash

>

curl or wget instead of ADD

dockerfile-curl-or-wget-instead-of-add

>

Dockerfile should specify base image

dockerfile-should-specify-base-image

>

ENV refers to itself

dockerfile-env-no-refer-envvar

>

Exposing port 22 (SSH)

dockerfile-exposing-port-22

>

First instruction must be ARG or FROM

dockerfile-first-instruction-should-be-arg-or-from

>

gem install without version

dockerfile-gem-install-without-version

>

Healthcheck instruction missing

dockerfile-healthcheck-instruction-missing

>

Image version not explicit

dockerfile-image-version-not-explicit

>

Image version using latest

dockerfile-image-version-using-latest

>

Last user is root

dockerfile-last-user-is-root

>

MAINTAINER instruction being used

dockerfile-maintainer-instruction-being-used

>

Missing dnf clean all

dockerfile-missing-dnf-clean-all

>

Missing flag from dnf install

dockerfile-missing-flag-from-dnf-install

>

Missing user instruction

dockerfile-missing-user-instruction

>

Missing version specification in dnf install

dockerfile-missing-version-specification-in-dnf-install

>

Missing zypper clean

dockerfile-missing-zypper-clean

>

Missing Zypper non-interactive switch

dockerfile-missing-zypper-non-interactive-switch

>

Multiple CMD instructions listed

dockerfile-multiple-cmd-instructions-listed

>

Multiple ENTRYPOINT instructions listed

dockerfile-multiple-entrypoint-instructions-listed

>

Multiple HEALTHCHECK instructions

dockerfile-do-not-use-multiple-healthcheck

>

Multiple RUN, ADD, COPY instructions listed

dockerfile-multiple-run-add-copy-instructions-listed

>

Not using JSON for CMD and ENTRYPOINT arguments

dockerfile-not-using-json-in-cmd-and-entrypoint-arguments

>

npm install command without pinned version

dockerfile-npm-install-without-pinned-version

>

ONBUILD cannot trigger FROM or MAINTAINER

dockerfile-from-or-maintainer-cannot-be-triggered-within-onbuild

>

Package update without install in same RUN

dockerfile-update-instruction-alone

>

pip install keeping cached packages

dockerfile-pip-install-keeping-cached-packages

>

RUN instruction using cd instead of WORKDIR

dockerfile-run-command-cd-instead-of-workdir

>

Run using apt

dockerfile-run-using-apt

>

Run using sudo

dockerfile-run-using-sudo

>

Run using wget and curl

dockerfile-run-using-wget-and-curl

>

Run utilities and POSIX commands

dockerfile-run-utilities-and-posix-commands

>

Run yarn clean after yarn install

dockerfile-run-yarn-clean-after-yarn-install

>

Same alias in different FROM statements

dockerfile-same-alias-in-different-froms

>

Shell running a pipe without the pipefail flag

dockerfile-shell-running-a-pipe-without-pipefail-flag

>

UNIX ports out of range

dockerfile-unix-ports-out-of-range

>

Unpinned package version in apk add

dockerfile-unpinned-package-version-in-apk-add

>

Unpinned package version in pip install

dockerfile-unpinned-package-version-in-pip-install

>

Use only allowed registry in FROM

dockerfile-use-only-an-allowed-registry-in-the-from-image

>

Use recommended flags with useradd

dockerfile-use-recommended-flags-with-useradd

>

Using --platform flag with FROM command

dockerfile-using-platform-with-from

>

Using unnamed build stages

dockerfile-using-unnamed-build-stages

>

WORKDIR path not absolute

dockerfile-workdir-path-not-absolute

>

yum clean all missing

dockerfile-yum-clean-all-missing

>

yum install allows manual input

dockerfile-yum-install-allows-manual-input

>

yum install without version

dockerfile-yum-install-without-version

>

Zypper install without explicit package version

dockerfile-zypper-install-without-version

>

Dockerfile

>

Always admit admission control plugin set

kubernetes-always-admit-admission-control-plugin-set

>

Always pull images admission control plugin not set

kubernetes-always-pull-images-admission-control-plugin-not-set

>

Anonymous auth is not set to false

kubernetes-anonymous-auth-is-not-set-to-false

>

Audit log maxage not properly set

kubernetes-audit-log-maxage-not-properly-set

>

Audit log maxbackup not properly set

kubernetes-audit-log-maxbackup-not-properly-set

>

Audit log maxsize not properly set

kubernetes-audit-log-maxsize-not-properly-set

>

Audit log path not set

kubernetes-audit-log-path-not-set

>

Audit policy does not cover key security concerns

kubernetes-audit-policy-not-cover-key-security-concerns

>

Audit policy file not defined

kubernetes-audit-policy-file-not-defined

>

Authorization mode node not set

kubernetes-authorization-mode-node-not-set

>

Authorization mode RBAC not set

kubernetes-authorization-mode-rbac-not-set

>

Authorization mode set to always allow

kubernetes-authorization-mode-set-to-always-allow

>

Auto TLS set to true

kubernetes-auto-tls-set-to-true

>

Basic auth file is set

kubernetes-basic-auth-file-is-set

>

Bind address not properly set

kubernetes-bind-address-not-properly-set

>

Certificate authority is not unique

kubernetes-not-unique-certificate-authority

>

Client certificate authentication not set up properly

kubernetes-client-certificate-authentication-not-setup-properly

>

Cluster admin rolebinding with superuser permissions

kubernetes-cluster-admin-role-binding-with-super-user-permissions

>

Cluster allows unsafe sysctls

kubernetes-cluster-allows-unsafe-sysctls

>

CNI plugin does not support network policies

kubernetes-cni-plugin-does-not-support-network-policies

>

Container is privileged

kubernetes-container-is-privileged

>

Container running as root

kubernetes-containers-running-as-root

>

Container with low UID

kubernetes-containers-run-with-low-uid

>

Container with unmasked /proc access

kubernetes-container-runs-unmasked

>

Containers missing drop capabilities

kubernetes-no-drop-capabilities-for-containers

>

Containers with added capabilities

kubernetes-containers-with-added-capabilities

>

Containers with sys admin capabilities

kubernetes-containers-with-sys-admin-capabilities

>

CPU limits not set

kubernetes-cpu-limits-not-set

>

CPU requests not set

kubernetes-cpu-requests-not-set

>

CronJob deadline not configured

kubernetes-cronjob-deadline-not-configured

>

Dashboard is enabled

kubernetes-dashboard-is-enabled

>

Deployment without podAntiAffinity

kubernetes-deployment-has-no-pod-anti-affinity

>

Deployment without PodDisruptionBudget

kubernetes-deployment-without-pod-disruption-budget

>

Docker daemon socket is exposed to containers

kubernetes-docker-daemon-socket-is-exposed-to-containers

>

Encryption provider config is not defined

kubernetes-encryption-provider-config-is-not-defined

>

Encryption provider not properly configured

kubernetes-encryption-provider-not-properly-configured

>

Ensure administrative boundaries between resources

kubernetes-ensure-administrative-boundaries-between-resources

>

etcd client certificate authentication set to false

kubernetes-etcd-client-certificate-authentication-set-to-false

>

etcd client certificate file not defined

kubernetes-etcd-client-certificate-file-not-defined

>

etcd peer client certificate authentication set to false

kubernetes-etcd-peer-client-certificate-authentication-set-to-false

>

etcd peer TLS certificate files not properly set

kubernetes-etcd-peer-tls-certificate-files-not-properly-set

>

etcd TLS certificate files not properly set

kubernetes-etcd-tls-certificate-files-not-properly-set

>

etcd TLS certificate not properly configured

kubernetes-etcd-tls-certificate-not-properly-configured

>

Event rate limit admission control plugin not set

kubernetes-event-rate-limit-admission-control-plugin-not-set

>

HPA targeted deployments with configured replica count

kubernetes-hpa-targeted-deployments-with-configured-replica-count

>

HPA targets invalid object

kubernetes-hpa-targets-invalid-object

>

Image policy webhook admission control plugin not set

kubernetes-image-policy-webhook-admission-control-plugin-not-set

>

Image pull policy of the container is not set to always

kubernetes-image-pull-policy-of-container-is-not-always

>

Image without digest

kubernetes-image-without-digest

>

Incorrect volume claim access mode ReadWriteOnce

kubernetes-incorrect-volume-claim-access-mode-read-write-once

>

Ingress controller exposes workload

kubernetes-ingress-controller-exposes-workload

>

Insecure bind address set

kubernetes-insecure-bind-address-set

>

Insecure port not properly set

kubernetes-insecure-port-not-properly-set

>

Invalid image tag

kubernetes-invalid-image

>

Invalid metadata label

kubernetes-metadata-label-is-invalid

>

Kubelet certificate authority not set

kubernetes-kubelet-certificate-authority-not-set

>

Kubelet client certificate or key not set

kubernetes-kubelet-client-certificate-or-key-not-set

>

Kubelet client periodic certificate switch disabled

kubernetes-kubelet-client-periodic-certificate-switch-disabled

>

Kubelet event QPS not properly set

kubernetes-kubelet-event-qps-not-properly-set

>

Kubelet hostname override is set

kubernetes-kubelet-hostname-override-is-set

>

Kubelet HTTPS set to false

kubernetes-kubelet-https-set-to-false

>

Kubelet not managing IP tables

kubernetes-kubelet-not-managing-ip-tables

>

Kubelet protect-kernel-defaults set to false

kubernetes-kubelet-protect-kernel-defaults-set-to-false

>

Kubelet read-only port is not set to zero

kubernetes-kubelet-read-only-port-is-not-set-to-zero

>

Kubelet streaming connection timeout disabled

kubernetes-kubelet-streaming-connection-timeout-disabled

>

Liveness probe is not defined

kubernetes-liveness-probe-is-not-defined

>

Memory limits not defined

kubernetes-memory-limits-not-defined

>

Memory requests not defined

kubernetes-memory-requests-not-defined

>

Missing AppArmor profile

kubernetes-missing-app-armor-config

>

Namespace lifecycle admission control plugin disabled

kubernetes-namespace-lifecycle-admission-control-plugin-disabled

>

NET_RAW capabilities disabled for PSP

kubernetes-net-raw-capabilities-disabled-for-psp

>

NET_RAW capabilities not dropped

kubernetes-net-raw-capabilities-not-being-dropped

>

Network policy without Pod target

kubernetes-network-policy-is-not-targeting-any-pod

>

Node restriction admission control plugin not set

kubernetes-node-restriction-admission-control-plugin-not-set

>

Non kube-system pod with host mount

kubernetes-non-kube-system-pod-with-host-mount

>

Object is using a deprecated API version

kubernetes-object-is-using-a-deprecated-api-version

>

Peer auto TLS set to true

kubernetes-peer-auto-tls-set-to-true

>

Permissive access to create pods

kubernetes-permissive-access-to-create-pods

>

Pod misconfigured network policy

kubernetes-pod-misconfigured-network-policy

>

Pod or container without LimitRange

kubernetes-pod-or-container-without-limit-range

>

Pod or container without ResourceQuota

kubernetes-pod-or-container-without-resource-quota

>

Pod or container without security context

kubernetes-pod-or-container-without-security-context

>

Pod security policy admission control plugin not set

kubernetes-pod-security-policy-admission-control-plugin-not-set

>

PodSecurityPolicy allows host network sharing

kubernetes-psp-containers-share-host-network-namespace

>

Privilege escalation allowed

kubernetes-privilege-escalation-allowed

>

Profiling not set to false

kubernetes-profiling-not-set-to-false

>

PSP allows privilege escalation

kubernetes-psp-allows-privilege-escalation

>

PSP allows sharing host IPC

kubernetes-psp-allows-sharing-host-ipc

>

PSP allows sharing host PID

kubernetes-psp-allows-sharing-host-pid

>

PSP set to privileged

kubernetes-psp-set-to-privileged

>

PSP with added capabilities

kubernetes-psp-with-added-capabilities

>

PSP with unrestricted access to host path

kubernetes-psp-with-unrestricted-access-to-host-path

>

RBAC roles allow privilege escalation

kubernetes-rbac-roles-allow-privilege-escalation

>

RBAC roles with attach permission

kubernetes-rbac-roles-with-attach-permission

>

RBAC roles with exec permission

kubernetes-rbac-roles-with-exec-permission

>

RBAC roles with impersonate permission

kubernetes-rbac-roles-with-impersonate-permission

>

RBAC roles with port-forwarding permission

kubernetes-rbac-roles-with-portforwarding-permissions

>

RBAC roles with read secrets permissions

kubernetes-rbac-roles-with-read-secrets-permissions

>

RBAC wildcard in rule

kubernetes-rbac-wildcard-in-rule

>

Readiness probe is not configured

kubernetes-readiness-probe-is-not-configured

>

Request timeout not properly set

kubernetes-request-timeout-not-properly-set

>

Role binding to default service account

kubernetes-role-binding-to-default-service-account

>

Root CA file not defined

kubernetes-root-ca-file-not-defined

>

Root container not mounted as read-only

kubernetes-root-container-not-mounted-as-read-only

>

Root containers admitted

kubernetes-root-containers-admitted

>

Rotate Kubelet server certificate not active

kubernetes-rotate-kubelet-server-certificate-not-active

>

Seccomp profile is not configured

kubernetes-seccomp-profile-is-not-configured

>

Secrets used as environment variables

kubernetes-secrets-as-environment-variables

>

Secure port set to zero

kubernetes-secure-port-set-to-zero

>

Security context deny admission control plugin not set

kubernetes-security-context-deny-admission-control-plugin-not-set

>

Service account admission control plugin disabled

kubernetes-service-account-admission-control-plugin-disabled

>

Service account key file not properly set

kubernetes-service-account-key-file-not-properly-set

>

Service account lookup set to false

kubernetes-service-account-lookup-set-to-false

>

Service account name undefined or empty

kubernetes-service-account-name-undefined-or-empty

>

Service account private key file not defined

kubernetes-service-account-private-key-file-not-defined

>

Service account token auto-mount not disabled

kubernetes-service-account-token-automount-not-disabled

>

Service does not target a Pod

kubernetes-service-does-not-target-pod

>

Service type is NodePort

kubernetes-service-type-is-nodeport

>

Service with external load balancer

kubernetes-service-with-external-load-balancer

>

ServiceAccount allows access to secrets

kubernetes-service-account-allows-access-secrets

>

Shared host IPC namespace

kubernetes-shared-host-ipc-namespace

>

Shared host network namespace

kubernetes-shared-host-network-namespace

>

Shared host PID namespace

kubernetes-shared-host-pid-namespace

>

Shared service account

kubernetes-shared-service-account

>

StatefulSet requests storage

kubernetes-statefulset-requests-storage

>

StatefulSet without podAntiAffinity

kubernetes-statefulset-has-no-pod-anti-affinity

>

StatefulSet without PodDisruptionBudget

kubernetes-statefulset-without-pod-disruption-budget

>

StatefulSet without service name

kubernetes-statefulset-without-service-name

>

Terminated pod garbage collector threshold not properly set

kubernetes-terminated-pod-garbage-collector-threshold-not-properly-set

>

Tiller (Helm v2) deployed

kubernetes-tiller-is-deployed

>

Tiller Deployment accessible within cluster

kubernetes-tiller-deployment-is-accessible-from-within-the-cluster

>

Tiller Service present

kubernetes-tiller-service-is-not-deleted

>

TLS connection certificate not set up

kubernetes-tls-connection-certificate-not-setup

>

Token auth file is set

kubernetes-token-auth-file-is-set

>

Unrestricted capabilities in PodSecurityPolicy

kubernetes-not-limited-capabilities-for-pod-security-policy

>

Use service account credentials not set to true

kubernetes-use-service-account-credentials-not-set-to-true

>

Using Kubernetes native secret management

kubernetes-using-kubernetes-native-secret-management

>

Using unrecommended namespace

kubernetes-using-unrecommended-namespace

>

Volume mount with OS directory write permissions

kubernetes-volume-mount-with-os-directory-write-permissions

>

Weak TLS cipher suites

kubernetes-weak-tls-cipher-suites

>

Workload host port not specified

kubernetes-workload-host-port-not-specified

>

Workload mounting with sensitive OS directory

kubernetes-workload-mounting-with-sensitive-os-directory

>

Kubernetes

>

Generic Git module without revision

terraform-generic-git-module-without-revision

>

Output without description

terraform-output-without-description

>

Variable without description

terraform-variable-without-description

>

Variable without type

terraform-variable-without-type

>

Terraform

>

Action trail logging for all regions disabled

terraform-alicloud-action-trail-logging-all-regions-disabled

>

ActionTrail trail OSS bucket is publicly accessible

terraform-alicloud-actiontrail-trail-oss-bucket-is-publicly-accessible

>

ALB listening on HTTP

terraform-alicloud-alb-listening-on-http

>

API Gateway API protocol not HTTPS

terraform-alicloud-api-gateway-api-protocol-not-https

>

CMK is unusable

terraform-alicloud-cmk-is-unusable

>

CS Kubernetes node pool auto repair disabled

terraform-alicloud-cs-kubernetes-node-pool-auto-repair-disabled

>

Disk encryption disabled

terraform-alicloud-disk-encryption-disabled

>

ECS data disk KMS key ID undefined

terraform-alicloud-ecs-data-disk-kms-key-id-undefined

>

High KMS key rotation period

terraform-alicloud-high-kms-key-rotation-period

>

Kubernetes cluster without Terway as CNI network plugin

terraform-alicloud-kubernetes-cluster-without-terway-as-cni-network-plugin

>

Launch template is not encrypted

terraform-alicloud-launch-template-is-not-encrypted

>

Log retention is not greater than 90 days

terraform-alicloud-log-retention-is-not-greater-than-90-days

>

NAS file system not encrypted

terraform-alicloud-nas-file-system-not-encrypted

>

NAS file system without KMS

terraform-alicloud-nas-file-system-without-kms

>

No ROS stack policy

terraform-alicloud-no-ros-stack-policy

>

OSS bucket allows all actions from all principals

terraform-alicloud-oss-bucket-allows-all-actions-from-all-principals

>

OSS bucket allows delete action from all principals

terraform-alicloud-oss-bucket-allows-delete-from-all-principals

>

OSS bucket allows list action from all principals

terraform-alicloud-oss-bucket-allows-list-action-from-all-principals

>

OSS bucket allows put action from all principals

terraform-alicloud-oss-bucket-allows-put-action-from-all-principals

>

OSS bucket encryption using CMK disabled

terraform-alicloud-oss-bucket-cmk-encryption-disabled

>

OSS bucket has static website

terraform-alicloud-oss-bucket-has-static-website

>

OSS bucket IP restriction disabled

terraform-alicloud-oss-bucket-ip-restriction-disabled

>

OSS bucket lifecycle rule disabled

terraform-alicloud-oss-bucket-lifecycle-disabled

>

OSS bucket logging disabled

terraform-alicloud-oss-bucket-logging-disabled

>

OSS bucket public access enabled

terraform-alicloud-oss-bucket-public-access-enabled

>

OSS bucket transfer acceleration disabled

terraform-alicloud-oss-bucket-transfer-acceleration-disabled

>

OSS bucket versioning disabled

terraform-alicloud-oss-bucket-versioning-disabled

>

OSS buckets secure transport disabled

terraform-alicloud-oss-buckets-securetransport-disabled

>

Public security group rule all ports or protocols

terraform-alicloud-public-security-group-rule-all-ports-or-protocols

>

Public security group rule sensitive port

terraform-alicloud-public-security-group-rule-sensitive-port

>

Public security group rule unknown port

terraform-alicloud-public-security-group-rule-unknown-port

>

RAM account password policy does not enforce minimum password length

terraform-alicloud-ram-account-password-policy-not-required-minimum-length

>

RAM account password policy does not require numbers

terraform-alicloud-ram-account-password-policy-not-required-numbers

>

RAM account password policy does not require symbols

terraform-alicloud-ram-account-password-policy-not-required-symbols

>

RAM account password policy max login attempts not recommended

terraform-alicloud-ram-account-password-policy-max-login-attempts-unrecommended

>

RAM account password policy max password age not recommended

terraform-alicloud-ram-account-password-policy-max-password-age-unrecommended

>

RAM account password policy not require at least one lowercase character

terraform-alicloud-ram-password-security-policy-not-require-at-least-one-lowercase-character

>

RAM account password policy not require at least one uppercase character

terraform-alicloud-ram-password-security-policy-not-require-at-least-one-uppercase-character

>

RAM account password policy without reuse prevention

terraform-alicloud-ram-account-password-policy-without-reuse-prevention

>

RAM policy admin access not attached to users groups roles

terraform-alicloud-ram-policy-admin-access-not-attached-to-users-groups-roles

>

RAM policy attached to user

terraform-alicloud-ram-policy-attached-to-user

>

RAM security preference does not enforce MFA login

terraform-alicloud-ram-security-preference-not-enforce-mfa

>

RDS DB instance publicly accessible

terraform-alicloud-rds-instance-address-publicly-accessible

>

RDS DB instance publicly accessible

terraform-alicloud-rds-instance-publicly-accessible

>

RDS instance events not logged

terraform-alicloud-rds-instance-events-not-logged

>

RDS instance log connections disabled

terraform-alicloud-rds-instance-log-connections-disabled

>

RDS instance log disconnections disabled

terraform-alicloud-rds-instance-log-disconnections-disabled

>

RDS instance log duration disabled

terraform-alicloud-rds-instance-log-duration-disabled

>

RDS instance retention period not recommended

terraform-alicloud-rds-instance-retention-not-recommended

>

RDS instance SSL action disabled

terraform-alicloud-rds-instance-ssl-action-disabled

>

RDS instance TDE status disabled

terraform-alicloud-rds-instance-tde-status-disabled

>

ROS stack notifications disabled

terraform-alicloud-ros-stack-notifications-disabled

>

ROS stack retention disabled

terraform-alicloud-ros-stack-retention-disabled

>

ROS stack without template

terraform-alicloud-ros-stack-without-template

>

SLB policy with insecure TLS version in use

terraform-alicloud-slb-policy-with-insecure-tls-version-in-use

>

VPC flow logs disabled

terraform-alicloud-vpc-flow-logs-disabled

>

Terraform / Alicloud

>

ALB deletion protection disabled

terraform-aws-alb-deletion-protection-disabled

>

ALB is not integrated with WAF

terraform-aws-alb-is-not-integrated-with-waf

>

ALB listening on HTTP

terraform-aws-alb-listening-on-http

>

ALB not dropping invalid headers

terraform-aws-alb-not-dropping-invalid-headers

>

Amazon DMS replication instance is publicly accessible

terraform-aws-amazon-dms-replication-instance-is-publicly-accessible

>

AmazonMQ broker encryption disabled

terraform-aws-amazon-mq-broker-encryption-disabled

>

AMI most recent without owner or filter

terraform-aws-ami-owner-missing

>

AMI not encrypted

terraform-aws-ami-not-encrypted

>

AMI shared with multiple accounts

terraform-aws-ami-shared-with-multiple-accounts

>

API Gateway access logging disabled

terraform-aws-api-gateway-access-logging-disabled

>

API Gateway deployment without access log setting

terraform-aws-api-gateway-deployment-without-access-log-setting

>

API Gateway deployment without API Gateway usage plan associated

terraform-aws-api-gateway-deployment-without-api-gateway-usage-plan-associated

>

API Gateway endpoint config is not private

terraform-aws-api-gateway-endpoint-config-is-not-private

>

API Gateway method does not contain an API key

terraform-aws-api-gateway-method-does-not-contain-an-api-key

>

API Gateway method settings cache not encrypted

terraform-aws-api-gateway-method-settings-cache-not-encrypted

>

API Gateway stage without API Gateway usage plan associated

terraform-aws-api-gateway-stage-without-api-gateway-usage-plan-associated

>

API Gateway with CloudWatch logging disabled

terraform-aws-api-gateway-with-cloudwatch-logging-disabled

>

API Gateway with invalid compression

terraform-aws-api-gateway-with-invalid-compression

>

API Gateway with open access

terraform-aws-api-gateway-with-open-access

>

API Gateway without configured authorizer

terraform-aws-api-gateway-without-configured-authorizer

>

API Gateway without security policy

terraform-aws-api-gateway-without-security-policy

>

API Gateway without SSL certificate

terraform-aws-api-gateway-without-ssl-certificate

>

API Gateway without WAF

terraform-aws-api-gateway-without-waf

>

API Gateway X-Ray disabled

terraform-aws-api-gateway-xray-disabled

>

Athena database not encrypted

terraform-aws-athena-database-not-encrypted

>

Athena workgroup not encrypted

terraform-aws-athena-workgroup-not-encrypted

>

Authentication without MFA

terraform-aws-authentication-without-mfa

>

Auto scaling group with no associated ELB

terraform-aws-auto-scaling-group-with-no-associated-elb

>

Automatic minor upgrades disabled

terraform-aws-automatic-minor-upgrades-disabled

>

Autoscaling groups supply tags

terraform-aws-autoscaling-groups-supply-tags

>

AWS password policy with unchangeable passwords

terraform-aws-aws-password-policy-with-unchangeable-passwords

>

Batch job definition with privileged container properties

terraform-aws-batch-job-definition-with-privileged-container-properties

>

CA certificate identifier is outdated

terraform-aws-ca-certificate-identifier-is-outdated

>

CDN configuration is missing

terraform-aws-cdn-configuration-is-missing

>

Certificate has expired

terraform-aws-certificate-has-expired

>

Certificate RSA key bytes lower than 256

terraform-aws-certificate-rsa-key-bytes-lower-than-256

>

CloudFront logging disabled

terraform-aws-cloudfront-logging-disabled

>

Cloudfront viewer protocol policy allows HTTP

terraform-aws-cloudfront-viewer-protocol-policy-allows-http

>

CloudFront without minimum protocol TLS 1.2

terraform-aws-cloudfront-without-minimum-protocol-tls-1-2

>

CloudFront without WAF

terraform-aws-cloudfront-without-waf

>

CloudTrail log file validation disabled

terraform-aws-cloudtrail-log-file-validation-disabled

>

CloudTrail log files not encrypted with KMS

terraform-aws-cloudtrail-log-files-not-encrypted-with-kms

>

CloudTrail log files S3 bucket is publicly accessible

terraform-aws-cloudtrail-log-files-s3-bucket-is-publicly-accessible

>

CloudTrail log files S3 bucket with logging disabled

terraform-aws-cloudtrail-log-files-s3-bucket-with-logging-disabled

>

CloudTrail logging disabled

terraform-aws-cloudtrail-logging-disabled

>

CloudTrail multi region disabled

terraform-aws-cloudtrail-multi-region-disabled

>

CloudTrail not integrated with CloudWatch

terraform-aws-cloudtrail-not-integrated-with-cloudwatch

>

CloudTrail SNS topic name undefined

terraform-aws-cloudtrail-sns-topic-name-undefined

>

CloudWatch AWS Config configuration changes alarm missing

terraform-aws-cloudwatch-aws-config-configuration-changes-alarm-missing

>

CloudWatch changes to NACL alarm missing

terraform-aws-cloudwatch-changes-to-nacl-alarm-missing

>

Cloudwatch CloudTrail configuration changes alarm missing

terraform-aws-cloudwatch-cloudtrail-configuration-changes-alarm-missing

>

CloudWatch console sign-in without MFA alarm missing

terraform-aws-cloudwatch-management-console-sign-in-without-mfa-alarm-missing

>

CloudWatch disabling or scheduled deletion of customer created CMK alarm missing

terraform-aws-cloudwatch-disabling-or-scheduled-deletion-of-customer-created-cmk-alarm-missing

>

CloudWatch IAM policy changes alarm missing

terraform-aws-cloudwatch-iam-policy-changes-alarm-missing

>

CloudWatch log group without KMS

terraform-aws-cloudwatch-log-group-not-encrypted

>

CloudWatch logging disabled

terraform-aws-cloudwatch-logging-disabled

>

CloudWatch logs destination with vulnerable policy

terraform-aws-cloudwatch-logs-destination-with-vulnerable-policy

>

CloudWatch management console auth failed alarm missing

terraform-aws-cloudwatch-management-console-auth-failed-alarm-missing

>

CloudWatch metrics disabled

terraform-aws-cloudwatch-metrics-disabled

>

CloudWatch network gateways changes alarm missing

terraform-aws-cloudwatch-network-gateways-changes-alarm-missing

>

CloudWatch root account use missing

terraform-aws-cloudwatch-root-account-use-alarm-missing

>

CloudWatch route table changes alarm missing

terraform-aws-cloudwatch-route-table-changes-alarm-missing

>

CloudWatch S3 policy change alarm missing

terraform-aws-cloudwatch-s3-policy-change-alarm-missing

>

Cloudwatch security group changes alarm missing

terraform-aws-cloudwatch-security-group-changes-alarm-missing

>

CloudWatch unauthorized access alarm missing

terraform-aws-cloudwatch-unauthorized-access-defined-alarm-missing

>

CloudWatch VPC changes alarm missing

terraform-aws-cloudwatch-vpc-changes-alarm-missing

>

CloudWatch without retention period specified

terraform-aws-cloudwatch-without-retention-period-specified

>

CMK is unusable

terraform-aws-cmk-is-unusable

>

CMK rotation disabled

terraform-aws-cmk-rotation-disabled

>

CodeBuild project encrypted with AWS managed key

terraform-aws-codebuild-project-encrypted-with-aws-managed-key

>

Cognito user pool without MFA

terraform-aws-cognito-userpool-without-mfa

>

Config rule for encrypted volumes disabled

terraform-aws-config-rule-for-encrypted-volumes-is-disabled

>

Configuration aggregator to all regions disabled

terraform-aws-config-configuration-aggregator-to-all-regions-disabled

>

Cross-account IAM assume role policy without external id or MFA

terraform-aws-cross-account-iam-assume-role-policy-without-external-id-or-mfa

>

DAX cluster not encrypted

terraform-aws-dax-cluster-not-encrypted

>

DB instance storage not encrypted

terraform-aws-db-instance-storage-not-encrypted

>

DB security group has public interface

terraform-aws-db-security-group-has-public-interface

>

DB security group open to large scope

terraform-aws-db-security-group-open-to-large-scope

>

DB security group with public scope

terraform-aws-db-security-group-with-public-scope

>

DB snapshot is public

terraform-aws-db-snapshot-public

>

Default security groups with unrestricted traffic

terraform-aws-default-security-groups-with-unrestricted-traffic

>

Default VPC exists

terraform-aws-default-vpc-exists

>

DMS endpoints without SSL

terraform-aws-dms-endpoint-no-ssl-configured

>

DocumentDB cluster encrypted with AWS managed key

terraform-aws-docdb-cluster-encrypted-with-aws-managed-key

>

DocumentDB cluster not encrypted

terraform-aws-docdb-cluster-not-encrypted

>

DocumentDB cluster without KMS

terraform-aws-docdb-cluster-without-kms

>

DocumentDB logging is disabled

terraform-aws-docdb-logging-disabled

>

DynamoDB table not encrypted

terraform-aws-dynamodb-table-not-encrypted

>

DynamoDB table Point-in-Time Recovery disabled

terraform-aws-dynamodb-table-point-in-time-recovery-disabled

>

Dynamodb VPC endpoint without route table association

terraform-aws-dynamodb-vpc-endpoint-without-route-table-association

>

EBS default encryption disabled

terraform-aws-ebs-default-encryption-disabled

>

EBS volume encryption disabled

terraform-aws-ebs-volume-encryption-disabled

>

EBS volume snapshot not encrypted

terraform-aws-ebs-volume-snapshot-not-encrypted

>

EC2 instance has public IP

terraform-aws-ec2-instance-has-public-ip

>

EC2 instance monitoring disabled

terraform-aws-ec2-instance-monitoring-disabled

>

EC2 instance using API keys

terraform-aws-ec2-instance-using-api-keys

>

EC2 instance using default security group

terraform-aws-ec2-instance-using-default-security-group

>

EC2 instance using default VPC

terraform-aws-ec2-instance-using-default-vpc

>

EC2 not EBS optimized

terraform-aws-ec2-not-ebs-optimized

>

ECR image tag not immutable

terraform-aws-ecr-image-tag-not-immutable

>

ECR repository is publicly accessible

terraform-aws-ecr-repository-is-publicly-accessible

>

ECR repository not encrypted with CMK

terraform-aws-ecr-repository-not-encrypted

>

ECR repository without policy

terraform-aws-ecr-repository-without-policy

>

ECS cluster with container insights disabled

terraform-aws-ecs-cluster-container-insights-disabled

>

ECS service admin role is present

terraform-aws-ecs-service-admin-role-is-present

>

ECS service without running tasks

terraform-aws-ecs-service-without-running-tasks

>

ECS task definition network mode not recommended

terraform-aws-ecs-task-definition-network-mode-not-recommended

>

ECS task definition volume not encrypted

terraform-aws-ecs-task-definition-volume-not-encrypted

>

EFS not encrypted

terraform-aws-efs-not-encrypted

>

EFS with vulnerable policy

terraform-aws-efs-with-vulnerable-policy

>

EFS without KMS

terraform-aws-efs-without-kms

>

EKS cluster encryption disabled

terraform-aws-eks-cluster-encryption-disabled

>

EKS cluster has public access

terraform-aws-eks-cluster-has-public-access

>

EKS cluster has public access CIDRs

terraform-aws-eks-cluster-has-public-access-cidrs

>

EKS cluster logging is not enabled

terraform-aws-eks-cluster-log-disabled

>

EKS node group remote access disabled

terraform-aws-eks-node-group-remote-access-disabled

>

ElastiCache nodes not created across multi AZ

terraform-aws-elasticache-nodes-not-created-across-multi-az

>

ElastiCache Redis cluster without backup

terraform-aws-elasticache-redis-cluster-without-backup

>

ElastiCache replication group not encrypted at rest

terraform-aws-elasticache-replication-group-not-encrypted-at-rest

>

ElastiCache replication group not encrypted at transit

terraform-aws-elasticache-replication-group-not-encrypted-at-transit

>

ElastiCache using default port

terraform-aws-elasticache-using-default-port

>

ElastiCache without VPC

terraform-aws-elasticache-without-vpc

>

Elasticsearch domain not encrypted node to node

terraform-aws-elasticsearch-domain-not-encrypted-node-to-node

>

Elasticsearch domain with vulnerable policy

terraform-aws-elasticsearch-domain-with-vulnerable-policy

>

Elasticsearch encryption with KMS disabled

terraform-aws-elasticsearch-encryption-with-kms-is-disabled

>

Elasticsearch log disabled

terraform-aws-elasticsearch-logs-disabled

>

Elasticsearch not encrypted at rest

terraform-aws-elasticsearch-not-encrypted-at-rest

>

Elasticsearch uses default security group

terraform-aws-elasticsearch-using-default-security-group

>

Elasticsearch with HTTPS disabled

terraform-aws-elasticsearch-with-https-disabled

>

Elasticsearch without IAM authentication

terraform-aws-elasticsearch-without-iam-authentication

>

Elasticsearch without slow logs

terraform-aws-elasticsearch-without-slow-logs

>

ELB access log disabled

terraform-aws-elb-access-logging-disabled

>

ELB using insecure protocols

terraform-aws-elb-using-insecure-protocols

>

ELB using weak ciphers

terraform-aws-elb-using-weak-ciphers

>

EMR without VPC

terraform-aws-emr-without-vpc

>

Fine-grained access control disabled for OpenSearch/Elasticsearch

terraform-aws-elasticsearch-no-finegrain-access-control

>

Global Accelerator flow logs disabled

terraform-aws-global-accelerator-flow-logs-disabled

>

Glue Data Catalog encryption disabled

terraform-aws-glue-data-catalog-encryption-disabled

>

Glue security configuration encryption disabled

terraform-aws-glue-security-configuration-encryption-disabled

>

Glue with vulnerable policy

terraform-aws-glue-with-vulnerable-policy

>

Group with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole'

terraform-aws-group-with-privilege-escalation-by-actions-iam-passrole-and-cloudformation-createstack

>

Group with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'

terraform-aws-group-with-privilege-escalation-by-actions-iam-passrole-and-ec2-runinstances

>

Group with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole'

terraform-aws-group-with-privilege-escalation-by-actions-iam-passrole-and-glue-createdevendpoint

>

Group with privilege escalation by actions 'glue:UpdateDevEndpoint'

terraform-aws-group-with-privilege-escalation-by-actions-glue-updatedevendpoint

>

Group with privilege escalation by actions 'iam:AddUserToGroup'

terraform-aws-group-with-privilege-escalation-by-actions-iam-addusertogroup

>

Group with privilege escalation by actions 'iam:AttachGroupPolicy'

terraform-aws-group-with-privilege-escalation-by-actions-iam-attachgrouppolicy

>

Group with privilege escalation by actions 'iam:AttachRolePolicy'

terraform-aws-group-with-privilege-escalation-by-actions-iam-attachrolepolicy

>

Group with privilege escalation by actions 'iam:AttachUserPolicy'

terraform-aws-group-with-privilege-escalation-by-actions-iam-attachuserpolicy

>

Group with privilege escalation by actions 'iam:CreateAccessKey'

terraform-aws-group-with-privilege-escalation-by-actions-iam-createaccesskey

>

Group with privilege escalation by actions 'iam:CreateLoginProfile'

terraform-aws-group-with-privilege-escalation-by-actions-iam-createloginprofile

>

Group with privilege escalation by actions 'iam:CreatePolicyVersion'

terraform-aws-group-with-privilege-escalation-by-actions-iam-createpolicyversion

>

Group with privilege escalation by actions 'iam:PutGroupPolicy'

terraform-aws-group-with-privilege-escalation-by-actions-iam-putgrouppolicy

>

Group with privilege escalation by actions 'iam:PutRolePolicy'

terraform-aws-group-with-privilege-escalation-by-actions-iam-putrolepolicy

>

Group with privilege escalation by actions 'iam:PutUserPolicy'

terraform-aws-group-with-privilege-escalation-by-actions-iam-putuserpolicy

>

Group with privilege escalation by actions 'iam:SetDefaultPolicyVersion'

terraform-aws-group-with-privilege-escalation-by-actions-iam-setdefaultpolicyversion

>

Group with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole'

terraform-aws-group-with-privilege-escalation-by-actions-iam-updateassumerolepolicy-and-sts-assumerole

>

Group with privilege escalation by actions 'iam:UpdateLoginProfile'

terraform-aws-group-with-privilege-escalation-by-actions-iam-updateloginprofile

>

Group with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction'

terraform-aws-group-with-privilege-escalation-by-actions-iam-passrole-and-lambda-createfunction-and-lambda-invokefunction

>

Group with privilege escalation by actions 'lambda:UpdateFunctionCode'

terraform-aws-group-with-privilege-escalation-by-actions-lambda-updatefunctioncode

>

GuardDuty detector disabled

terraform-aws-guardduty-detector-disabled

>

HTTP port open to internet

terraform-aws-http-port-open

>

IAM access key is exposed

terraform-aws-iam-access-key-is-exposed

>

IAM database auth not enabled

terraform-aws-iam-database-auth-not-enabled

>

IAM group without users

terraform-aws-iam-group-without-users

>

IAM password policy does not require lowercase letter

terraform-aws-iam-password-does-not-require-lowercase

>

IAM password policy does not require numbers

terraform-aws-iam-password-does-not-require-number

>

IAM password policy does not require symbol

terraform-aws-iam-password-does-not-require-symbol

>

IAM password policy does not require uppercase letter

terraform-aws-iam-password-does-not-require-uppercase

>

IAM password without minimum length

terraform-aws-iam-password-without-minimum-length

>

IAM policies attached to user

terraform-aws-iam-policies-attached-to-user

>

IAM policies with full privileges

terraform-aws-iam-policies-with-full-privileges

>

IAM policy grants 'AssumeRole' permission across all services

terraform-aws-iam-policy-grants-assumerole-permission-across-all-services

>

IAM policy grants full permissions

terraform-aws-iam-policy-grants-full-permissions

>

IAM role allows all principals to assume

terraform-aws-iam-role-allows-all-principals-to-assume

>

IAM role policy passrole allows all

terraform-aws-iam-role-policy-passrole-allows-all

>

IAM role with full privileges

terraform-aws-iam-role-with-full-privileges

>

IAM user has too many access keys

terraform-aws-iam-user-too-many-access-keys

>

IAM user policy without MFA

terraform-aws-iam-user-policy-without-mfa

>

IAM user with access to console

terraform-aws-iam-user-with-access-to-console

>

IMDSv1 enabled

terraform-aws-imdsv1-is-enabled

>

Instance with no VPC

terraform-aws-instance-with-no-vpc

>

Kinesis not encrypted with KMS

terraform-aws-kinesis-not-encrypted-with-kms

>

Kinesis SSE not configured

terraform-aws-kinesis-sse-not-configured

>

KMS key with no deletion window

terraform-aws-kms-key-with-no-deletion-window

>

KMS key with vulnerable policy

terraform-aws-kms-key-with-full-permissions

>

Lambda function publicly accessible

terraform-aws-lambda-function-publicly-accessible

>

Lambda function with privileged role

terraform-aws-lambda-function-with-privileged-role

>

Lambda functions without X-Ray tracing

terraform-aws-lambda-functions-without-x-ray-tracing

>

Lambda IAM InvokeFunction misconfigured

terraform-aws-lambda-iam-invokefunction-misconfigured

>

Lambda permission misconfigured

terraform-aws-lambda-permission-misconfigured

>

Lambda permission principal is wildcard

terraform-aws-lambda-permission-principal-is-wildcard

>

Lambda with vulnerable policy

terraform-aws-lambda-with-vulnerable-policy

>

Launch configuration is not encrypted

terraform-aws-launch-configuration-is-not-encrypted

>

Misconfigured password policy expiration

terraform-aws-misconfigured-password-policy-expiration

>

Missing CloudWatch alarm for AWS Organizations changes

terraform-aws-cloudwatch-aws-organizations-changes-missing-alarm

>

Missing cluster log types

terraform-aws-missing-cluster-log-types

>

MQ broker is publicly accessible

terraform-aws-mq-broker-is-publicly-accessible

>

MQ broker logging disabled

terraform-aws-mq-broker-logging-disabled

>

MSK broker is publicly accessible

terraform-aws-msk-broker-is-publicly-accessible

>

MSK cluster encryption disabled

terraform-aws-msk-cluster-encryption-disabled

>

MSK cluster logging disabled

terraform-aws-msk-cluster-logging-disabled

>

Neptune cluster instance is publicly accessible

terraform-aws-neptune-cluster-instance-is-publicly-accessible

>

Neptune cluster snapshot not encrypted

terraform-aws-neptune-snapshots-not-encrypted

>

Neptune cluster with IAM database authentication disabled

terraform-aws-neptune-cluster-with-iam-database-authentication-disabled

>

Neptune database cluster encryption disabled

terraform-aws-neptune-database-cluster-encryption-disabled

>

Neptune logging is disabled

terraform-aws-neptune-logging-disabled

>

Network ACL with unrestricted access to RDP

terraform-aws-network-acl-with-unrestricted-access-to-rdp

>

Network ACL with unrestricted access to SSH

terraform-aws-network-acl-with-unrestricted-access-to-ssh

>

No password policy enabled

terraform-aws-no-password-policy-enabled

>

No stack policy

terraform-aws-no-stack-policy

>

Password without reuse prevention

terraform-aws-password-without-reuse-prevention

>

Policy without principal

terraform-aws-policy-without-principal

>

Public and private EC2 share role

terraform-aws-public-and-private-ec2-share-role

>

Public Lambda via API Gateway

terraform-aws-public-lambda-via-api-gateway

>

RDS associated with public subnet

terraform-aws-rds-associated-with-public-subnet

>

RDS cluster with backup disabled

terraform-aws-rds-cluster-with-backup-disabled

>

RDS database cluster not encrypted

terraform-aws-rds-database-cluster-not-encrypted

>

RDS DB instance publicly accessible

terraform-aws-rds-db-instance-publicly-accessible

>

RDS storage not encrypted

terraform-aws-rds-storage-not-encrypted

>

RDS using default port

terraform-aws-rds-using-default-port

>

RDS with backup disabled

terraform-aws-rds-with-backup-disabled

>

RDS without logging

terraform-aws-rds-without-logging

>

Redis disabled

terraform-aws-redis-disabled

>

Redis not compliant

terraform-aws-redis-not-compliant

>

Redshift cluster logging disabled

terraform-aws-redshift-cluster-logging-disabled

>

Redshift cluster without VPC

terraform-aws-redshift-cluster-without-vpc

>

Redshift not encrypted

terraform-aws-redshift-not-encrypted

>

Redshift publicly accessible

terraform-aws-redshift-publicly-accessible

>

Redshift using default port

terraform-aws-redshift-using-default-port

>

Remote Desktop port open to internet

terraform-aws-remote-desktop-port-open-to-internet

>

Resource not using tags

terraform-aws-resource-not-using-tags

>

REST API with vulnerable policy

terraform-aws-rest-api-with-vulnerable-policy

>

Role with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole'

terraform-aws-role-with-privilege-escalation-by-actions-iam-passrole-and-cloudformation-createstack

>

Role with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'

terraform-aws-role-with-privilege-escalation-by-actions-iam-passrole-and-ec2-runinstances

>

Role with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole'

terraform-aws-role-with-privilege-escalation-by-actions-iam-passrole-and-glue-createdevendpoint

>

Role with privilege escalation by actions 'glue:UpdateDevEndpoint'

terraform-aws-role-with-privilege-escalation-by-actions-glue-updatedevendpoint

>

Role with privilege escalation by actions 'iam:AddUserToGroup'

terraform-aws-role-with-privilege-escalation-by-actions-iam-addusertogroup

>

Role with privilege escalation by actions 'iam:AttachGroupPolicy'

terraform-aws-role-with-privilege-escalation-by-actions-iam-attachgrouppolicy

>

Role with privilege escalation by actions 'iam:AttachRolePolicy'

terraform-aws-role-with-privilege-escalation-by-actions-iam-attachrolepolicy

>

Role with privilege escalation by actions 'iam:AttachUserPolicy'

terraform-aws-role-with-privilege-escalation-by-actions-iam-attachuserpolicy

>

Role with privilege escalation by actions 'iam:CreateAccessKey'

terraform-aws-role-with-privilege-escalation-by-actions-iam-createaccesskey

>

Role with privilege escalation by actions 'iam:CreateLoginProfile'

terraform-aws-role-with-privilege-escalation-by-actions-iam-createloginprofile

>

Role with privilege escalation by actions 'iam:CreatePolicyVersion'

terraform-aws-role-with-privilege-escalation-by-actions-iam-createpolicyversion

>

Role with privilege escalation by actions 'iam:PutGroupPolicy'

terraform-aws-role-with-privilege-escalation-by-actions-iam-putgrouppolicy

>

Role with privilege escalation by actions 'iam:PutRolePolicy'

terraform-aws-role-with-privilege-escalation-by-actions-iam-putrolepolicy

>

Role with privilege escalation by actions 'iam:PutUserPolicy'

terraform-aws-role-with-privilege-escalation-by-actions-iam-putuserpolicy

>

Role with privilege escalation by actions 'iam:SetDefaultPolicyVersion'

terraform-aws-role-with-privilege-escalation-by-actions-iam-setdefaultpolicyversion

>

Role with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole'

terraform-aws-role-with-privilege-escalation-by-actions-iam-updateassumerolepolicy-and-sts-assumerole

>

Role with privilege escalation by actions 'iam:UpdateLoginProfile'

terraform-aws-role-with-privilege-escalation-by-actions-iam-updateloginprofile

>

Role with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction'

terraform-aws-role-with-privilege-escalation-by-actions-iam-passrole-and-lambda-createfunction-lambda-invokefunction

>

Role with privilege escalation by actions 'lambda:UpdateFunctionCode'

terraform-aws-role-with-privilege-escalation-by-actions-lambda-updatefunctioncode

>

Root account has active access keys

terraform-aws-root-account-has-active-access-keys

>

Route53 record undefined

terraform-aws-route53-record-undefined

>

S3 bucket access to any principal

terraform-aws-s3-bucket-access-to-any-principal

>

S3 bucket ACL allows read or write to all users

terraform-aws-s3-bucket-acl-allows-read-or-write-to-all-users

>

S3 bucket ACL allows read to any authenticated user

terraform-aws-s3-bucket-acl-allows-read-to-any-authenticated-user

>

S3 bucket ACL grants WRITE_ACP permission

terraform-aws-s3-bucket-acl-grants-write-acp-permission

>

S3 bucket allows authenticated users access

terraform-aws-s3-bucket-allows-access-to-all-authenticated-users

>

S3 bucket allows delete action from all principals

terraform-aws-s3-bucket-allows-delete-action-from-all-principals

>

S3 bucket allows get action from all principals

terraform-aws-s3-bucket-allows-get-action-from-all-principals

>

S3 bucket allows list action from all principals

terraform-aws-s3-bucket-allows-list-action-from-all-principals

>

S3 bucket allows public ACL

terraform-aws-s3-bucket-allows-public-acl

>

S3 bucket allows public policy

terraform-aws-s3-bucket-with-public-policy

>

S3 bucket allows put action from all principals

terraform-aws-s3-bucket-allows-put-action-from-all-principals

>

S3 bucket logging disabled

terraform-aws-s3-bucket-logging-disabled

>

S3 bucket object not encrypted

terraform-aws-s3-bucket-object-not-encrypted

>

S3 bucket object-level CloudTrail logging disabled

terraform-aws-s3-bucket-object-level-cloudtrail-logging-disabled

>

S3 bucket policy accepts HTTP requests

terraform-aws-s3-bucket-policy-accepts-http-requests

>

S3 bucket public ACL overridden by public access block

terraform-aws-s3-bucket-public-acl-overridden-by-public-access-block

>

S3 bucket with all permissions

terraform-aws-s3-bucket-with-all-permissions

>

S3 bucket with unsecured CORS rule

terraform-aws-s3-bucket-with-unsecured-cors-rule

>

S3 bucket without enabled MFA delete

terraform-aws-s3-bucket-without-enabled-mfa-delete

>

S3 bucket without ignore public ACL

terraform-aws-s3-bucket-without-ignore-public-acl

>

S3 bucket without restriction of public bucket

terraform-aws-s3-bucket-without-restriction-of-public-bucket

>

S3 bucket without versioning

terraform-aws-s3-bucket-without-versioning

>

S3 static website host enabled

terraform-aws-s3-static-website-host-enabled

>

SageMaker endpoint configuration encryption disabled

terraform-aws-sagemaker-endpoint-configuration-encryption-disabled

>

SageMaker notebook instance without KMS

terraform-aws-sagemaker-notebook-instance-without-kms

>

SageMaker notebook internet access enabled

terraform-aws-sagemaker-direct-internet-access-enabled

>

Secrets Manager secret encrypted with AWS-managed key

terraform-aws-secretsmanager-secret-encrypted-with-aws-managed-key

>

Secrets Manager secret without KMS

terraform-aws-secretsmanager-secret-without-kms

>

Secrets Manager with vulnerable policy

terraform-aws-secrets-manager-with-vulnerable-policy

>

Secure ciphers disabled

terraform-aws-secure-ciphers-disabled

>

Security group not used

terraform-aws-security-groups-not-used

>

Security group rule without description

terraform-aws-security-group-rules-without-description

>

Security group rule without description

terraform-aws-security-group-without-description

>

Security group with unrestricted access to SSH

terraform-aws-security-group-with-unrestricted-access-to-ssh

>

Sensitive port is exposed to entire network

terraform-aws-sensitive-port-is-exposed-to-entire-network

>

Sensitive port is exposed to small public network

terraform-aws-sensitive-port-is-exposed-to-small-public-network

>

Sensitive port is exposed to wide private network

terraform-aws-sensitive-port-is-exposed-to-wide-private-network

>

Service control policies disabled

terraform-aws-service-control-policies-disabled

>

SES policy with allowed IAM actions

terraform-aws-ses-policy-with-allowed-iam-actions

>

Shield Advanced not in use

terraform-aws-shield-advanced-not-in-use

>

SNS topic encrypted with AWS managed key

terraform-aws-sns-topic-encrypted-with-aws-managed-key

>

SNS topic is publicly accessible

terraform-aws-sns-topic-is-publicly-accessible

>

SNS topic not encrypted

terraform-aws-sns-topic-not-encrypted

>

SNS topic publicity has allow and NotAction simultaneously

terraform-aws-sns-topic-publicity-has-allow-and-not-action-simultaneously

>

SQL analysis services port 2383 (TCP) is publicly accessible

terraform-aws-sql-analysis-services-port-2383-is-publicly-accessible

>

SQS policy allows all actions

terraform-aws-sqs-policy-allows-all-actions

>

SQS policy with public access

terraform-aws-sqs-policy-with-public-access

>

SQS queue exposed

terraform-aws-sqs-queue-exposed

>

SQS VPC endpoint without DNS resolution

terraform-aws-sqs-vpc-endpoint-without-dns-resolution

>

SQS with SSE disabled

terraform-aws-sqs-with-sse-disabled

>

SSM session transit encryption disabled

terraform-aws-ssm-session-transit-encryption-disabled

>

SSO identity user unsafe creation

terraform-aws-sso-identity-user-unsafe-creation

>

SSO permission with inadequate user session duration

terraform-aws-sso-permission-with-inadequate-user-session-duration

>

SSO policy with full privileges

terraform-aws-sso-policy-with-full-privileges

>

Stack notifications disabled

terraform-aws-stack-notifications-disabled

>

Stack retention disabled

terraform-aws-stack-retention-disabled

>

Stack without template

terraform-aws-stack-without-template

>

Team tag missing on AWS resource

terraform-aws-team-tag-not-present

>

Unknown port exposed to internet

terraform-aws-unknown-port-exposed-to-internet

>

Unrestricted security group ingress

terraform-aws-unrestricted-security-group-ingress

>

Unscanned ECR image

terraform-aws-unscanned-ecr-image

>

User data contains encoded private key

terraform-aws-user-data-contains-encoded-private-key

>

User with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole'

terraform-aws-user-with-privilege-escalation-by-actions-iam-passrole-and-cloudformation-createstack

>

User with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'

terraform-aws-user-with-privilege-escalation-by-actions-iam-passrole-and-ec2-runinstances

>

User with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole'

terraform-aws-user-with-privilege-escalation-by-actions-iam-passrole-and-glue-createdevendpoint

>

User with privilege escalation by actions 'glue:UpdateDevEndpoint'

terraform-aws-user-with-privilege-escalation-by-actions-glue-updatedevendpoint

>

User with privilege escalation by actions 'iam:AddUserToGroup'

terraform-aws-user-with-privilege-escalation-by-actions-iam-addusertogroup

>

User with privilege escalation by actions 'iam:AttachGroupPolicy'

terraform-aws-user-with-privilege-escalation-by-actions-iam-attachgrouppolicy

>

User with privilege escalation by actions 'iam:AttachRolePolicy'

terraform-aws-user-with-privilege-escalation-by-actions-iam-attachrolepolicy

>

User with privilege escalation by actions 'iam:AttachUserPolicy'

terraform-aws-user-with-privilege-escalation-by-actions-iam-attachuserpolicy

>

User with privilege escalation by actions 'iam:CreateAccessKey'

terraform-aws-user-with-privilege-escalation-by-actions-iam-createaccesskey

>

User with privilege escalation by actions 'iam:CreateLoginProfile'

terraform-aws-user-with-privilege-escalation-by-actions-iam-createloginprofile

>

User with privilege escalation by actions 'iam:CreatePolicyVersion'

terraform-aws-user-with-privilege-escalation-by-actions-iam-createpolicyversion

>

User with privilege escalation by actions 'iam:PutGroupPolicy'

terraform-aws-user-with-privilege-escalation-by-actions-iam-putgrouppolicy

>

User with privilege escalation by actions 'iam:PutRolePolicy'

terraform-aws-user-with-privilege-escalation-by-actions-iam-putrolepolicy

>

User with privilege escalation by actions 'iam:PutUserPolicy'

terraform-aws-user-with-privilege-escalation-by-actions-iam-putuserpolicy

>

User with privilege escalation by actions 'iam:SetDefaultPolicyVersion'

terraform-aws-user-with-privilege-escalation-by-actions-iam-setdefaultpolicyversion

>

User with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole'

terraform-aws-user-with-privilege-escalation-by-actions-iam-updateassumerolepolicy-and-sts-assumerole

>

User with privilege escalation by actions 'iam:UpdateLoginProfile'

terraform-aws-user-with-privilege-escalation-by-actions-iam-updateloginprofile

>

User with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction'

terraform-aws-user-with-privilege-escalation-by-actions-iam-passrole-and-lambda-createfunction-and-lambda-invokefunction

>

User with privilege escalation by actions 'lambda:UpdateFunctionCode'

terraform-aws-user-with-privilege-escalation-by-actions-lambda-updatefunctioncode

>

VPC default security group accepts all traffic

terraform-aws-vpc-default-security-group-accepts-all-traffic

>

VPC Flow Logs disabled

terraform-aws-vpc-flowlogs-disabled

>

VPC peering route table with unrestricted CIDR

terraform-aws-vpc-peering-route-table-with-unrestricted-cidr

>

VPC subnet assigns public IP

terraform-aws-vpc-subnet-assigns-public-ip

>

VPC without Network Firewall

terraform-aws-vpc-without-network-firewall

>

Vulnerable default SSL certificate

terraform-aws-vulnerable-default-ssl-certificate

>

Workspaces workspace volume not encrypted

terraform-aws-workspaces-workspace-volume-not-encrypted

>

Terraform / AWS

>

AD admin not configured for SQL server

terraform-azure-ad-admin-not-configured-for-sql-server

>

Admin user enabled for container registry

terraform-azure-admin-user-enabled-for-container-registry

>

AKS disk encryption set ID undefined

terraform-azure-aks-disk-encryption-set-id-undefined

>

AKS network policy misconfigured

terraform-azure-aks-network-policy-misconfigured

>

AKS private cluster disabled

terraform-azure-aks-private-cluster-disabled

>

AKS RBAC disabled

terraform-azure-aks-rbac-disabled

>

App Service authentication disabled

terraform-azure-app-service-authentication-disabled

>

App Service FTPS enforce disabled

terraform-azure-app-service-ftps-enforce-disabled

>

App Service HTTP2 disabled

terraform-azure-app-service-http2-disabled

>

App Service managed identity disabled

terraform-azure-app-service-managed-identity-disabled

>

App Service not using latest TLS encryption version

terraform-azure-app-service-not-using-latest-tls-encryption-version

>

App Service without latest PHP version

terraform-azure-app-service-without-latest-php-version

>

App Service without latest Python version

terraform-azure-app-service-without-latest-python-version

>

Azure Active Directory authentication

terraform-azure-azure-active-directory-authentication

>

Azure App Service client certificate disabled

terraform-azure-azure-app-service-client-certificate-disabled

>

Azure Cognitive Search public network access enabled

terraform-azure-azure-cognitive-search-public-network-access-enabled

>

Azure Container Registry with no locks

terraform-azure-azure-container-registry-with-no-locks

>

Azure Front Door WAF disabled

terraform-azure-azure-front-door-waf-disabled

>

Azure instance using basic authentication

terraform-azure-azure-instance-using-basic-authentication

>

Azure Policy Add-on Disabled in AKS Cluster

terraform-azure-aks-uses-azure-policies-addon-disabled

>

Cosmos DB account without tags

terraform-azure-cosmos-db-account-without-tags

>

CosmosDB account IP range filter not set

terraform-azure-cosmosdb-account-ip-range-filter-not-set

>

Dashboard is enabled

terraform-azure-dashboard-is-enabled

>

Default Azure storage account network access is too permissive

terraform-azure-default-azure-storage-account-network-access-is-too-permissive

>

Email alerts disabled

terraform-azure-email-alerts-disabled

>

Encryption on managed disk disabled

terraform-azure-encryption-on-managed-disk-disabled

>

Ensure Azure MariaDB server is using latest TLS (1.2)

terraform-azure-mariadb-not-using-latest-tls

>

Ensure MySQL is using the latest version of TLS encryption

terraform-azure-mysql-not-using-latest-tls

>

Ensure that Azure cloud resource has a team tag

terraform-azure-team-tag-not-present

>

Ensure that PostgreSQL server disables public network access

terraform-azure-postgres-sql-server-enables-public-access

>

Ensure that UDP services are restricted from the Internet

terraform-azure-udp-services-not-restricted-from-internet

>

Ensure web app is not remotely debuggable

terraform-azure-remote-debugging-enabled-app-service

>

Firewall rule allows too many hosts to access Redis Cache

terraform-azure-firewall-rule-allows-too-many-hosts-to-access-redis-cache

>

Function App authentication disabled

terraform-azure-function-app-authentication-disabled

>

Function App client certificates not required

terraform-azure-function-app-client-certificates-unrequired

>

Function App FTPS enforce disabled

terraform-azure-function-app-ftps-enforce-disabled

>

Function App HTTP2 disabled

terraform-azure-function-app-http2-disabled

>

Function App managed identity disabled

terraform-azure-function-app-managed-identity-disabled

>

Function App not using latest TLS encryption version

terraform-azure-function-app-not-using-latest-tls-encryption-version

>

Geo redundancy is disabled

terraform-azure-geo-redundancy-is-disabled

>

Key expiration not set

terraform-azure-key-expiration-not-set

>

Key Vault secrets content type undefined

terraform-azure-key-vault-secrets-content-type-undefined

>

Log retention is not set

terraform-azure-log-retention-is-not-set

>

MariaDB server geo-redundant backup disabled

terraform-azure-mariadb-server-georedundant-backup-disabled

>

MariaDB server public network access enabled

terraform-azure-mariadb-public-network-access-enabled

>

MSSQL server auditing disabled

terraform-azure-mssql-server-auditing-disabled

>

MSSQL server public network access enabled

terraform-azure-mssql-server-public-network-access-enabled

>

MySQL server public access enabled

terraform-azure-mysql-server-public-access-enabled

>

MySQL SSL connection disabled

terraform-azure-mysql-ssl-connection-disabled

>

Network interfaces IP forwarding enabled

terraform-azure-network-interfaces-ip-forwarding-enabled

>

Network interfaces with public IP

terraform-azure-network-interfaces-with-public-ip

>

Network watcher flow disabled

terraform-azure-network-watcher-flow-disabled

>

PostgreSQL log checkpoints disabled

terraform-azure-postgresql-log-checkpoints-disabled

>

PostgreSQL log connections not set

terraform-azure-postgresql-log-connections-not-set

>

PostgreSQL log disconnections not set

terraform-azure-postgresql-log-disconnections-not-set

>

PostgreSQL log duration not set

terraform-azure-postgresql-log-duration-not-set

>

PostgreSQL server infrastructure encryption disabled

terraform-azure-postgresql-server-infrastructure-encryption-disabled

>

PostgreSQL Server threat detection policy disabled

terraform-azure-postgresql-server-threat-detection-policy-disabled

>

PostgreSQL server without connection throttling

terraform-azure-postgresql-server-without-connection-throttling

>

Public storage account

terraform-azure-public-storage-account

>

RDP is exposed to the internet

terraform-azure-rdp-is-exposed-to-the-internet

>

Redis cache allows non SSL connections

terraform-azure-redis-cache-allows-non-ssl-connections

>

Redis entirely accessible

terraform-azure-redis-entirely-accessible

>

Redis not updated regularly

terraform-azure-redis-not-updated-regularly

>

Redis publicly accessible

terraform-azure-redis-publicly-accessible

>

Role assignment not limit guest user permissions

terraform-azure-role-assignment-not-limit-guest-users-permissions

>

Role definition allows custom role creation

terraform-azure-role-definition-allows-custom-role-creation

>

Secret expiration not set

terraform-azure-secret-expiration-not-set

>

Security center pricing tier is not standard

terraform-azure-security-center-pricing-tier-is-not-standard

>

Security contact email

terraform-azure-security-contact-email

>

Security group is not configured

terraform-azure-security-group-is-not-configured

>

Sensitive port is exposed to entire network

terraform-azure-sensitive-port-is-exposed-to-entire-network

>

Sensitive port is exposed to small public network

terraform-azure-sensitive-port-is-exposed-to-small-public-network

>

Sensitive port is exposed to wide private network

terraform-azure-sensitive-port-is-exposed-to-wide-private-network

>

Small activity log retention period

terraform-azure-small-activity-log-retention-period

>

Small flow logs retention period

terraform-azure-small-flow-logs-retention-period

>

Small MSSQL audit retention period

terraform-azure-small-mssql-audit-retention-period

>

Small MSSQL server audit retention

terraform-azure-small-msql-server-audit-retention

>

Small PostgreSQL DB server log retention period

terraform-azure-small-postgresql-db-server-log-retention-period

>

SQL database audit disabled

terraform-azure-sql-database-audit-disabled

>

SQL server alert email disabled

terraform-azure-sql-server-alert-email-disabled

>

SQL server auditing disabled

terraform-azure-sql-server-auditing-disabled

>

SQL server predictable Active Directory admin account name

terraform-azure-sql-server-predictable-active-directory-admin-account-name

>

SQL server predictable admin account name

terraform-azure-sql-server-predictable-admin-account-name

>

Sqlserver ingress from any IP

terraform-azure-sql-server-ingress-from-any-ip

>

SSH is exposed to the Internet

terraform-azure-ssh-is-exposed-to-the-internet

>

SSL enforce disabled

terraform-azure-ssl-enforce-is-disabled

>

ssl_enforcement_enabled is not set to ENABLED for MySQL database server

terraform-azure-mysql-enforce-ssl-connection-disabled

>

ssl_enforcement_enabled is not set to ENABLED for PostgreSQL database server

terraform-azure-postgres-enforce-ssl-connection-disabled

>

Storage account not forcing HTTPS

terraform-azure-storage-account-not-forcing-https

>

Storage account not using latest TLS encryption version

terraform-azure-storage-account-not-using-latest-tls-encryption-version

>

Storage container is publicly accessible

terraform-azure-storage-container-is-publicly-accessible

>

Storage share file allows all ACL permissions

terraform-azure-storage-share-file-allows-all-acl-permissions

>

Storage table allows all ACL permissions

terraform-azure-storage-table-allows-all-acl-permissions

>

Trusted Microsoft services not enabled

terraform-azure-trusted-microsoft-services-not-enabled

>

Unrestricted SQL server access

terraform-azure-unrestricted-sql-server-access

>

Vault auditing disabled

terraform-azure-vault-auditing-disabled

>

Virtual network with DDoS protection plan disabled

terraform-azure-virtual-network-with-ddos-protection-plan-disabled

>

VM not attached to network

terraform-azure-vm-not-attached-to-network

>

WAF is disabled for Azure application gateway

terraform-azure-waf-is-disabled-for-azure-application-gateway

>

Web app accepting traffic other than HTTPS

terraform-azure-web-app-accepting-traffic-other-than-https

>

Terraform / Azure

>

Check Databricks cluster AWS attribute best practices

terraform-databricks-cluster-aws-attributes

>

Check Databricks cluster Azure attribute best practices

terraform-databricks-cluster-azure-attributes

>

Check Databricks cluster GCP attribute best practices

terraform-databricks-cluster-gcp-attributes

>

Databricks autoscale configuration incomplete

terraform-databricks-autoscale-badly-setup

>

Databricks cluster or job with no or insecure permissions

terraform-databricks-databricks-permissions

>

Databricks cluster uses non-LTS Spark version

terraform-databricks-use-lts-spark-version

>

Databricks group without user or instance profile

terraform-databricks-group-without-user-or-instance-profile

>

Indefinitely Databricks OBO token lifetime

terraform-databricks-indefinitely-obo-token

>

Indefinitely Databricks token lifetime

terraform-databricks-indefinitely-token

>

Job's task is legacy (spark_submit_task)

terraform-databricks-use-spark-submit-task

>

Unrestricted Databricks ACL

terraform-databricks-unrestricted-acl

>

Terraform / Databricks

>

Artifact Registry repo is public

terraform-gcp-artifact-registry-repository-is-public

>

BigQuery dataset is public

terraform-gcp-bigquery-dataset-is-public

>

BigQuery table is public

terraform-gcp-bigquery-table-is-public

>

Cloud DNS without DNSSEC

terraform-gcp-cloud-dns-without-dnssec

>

Cloud KMS key ring is anonymously or publicly accessible

terraform-gcp-cloud-kms-key-rings-are-public

>

Cloud Run service is public

terraform-gcp-cloud-run-service-is-public

>

Cloud Storage bucket is publicly accessible

terraform-gcp-cloud-storage-bucket-is-publicly-accessible

>

Cloud Storage bucket logging not enabled

terraform-gcp-cloud-storage-bucket-logging-not-enabled

>

Cloud Storage bucket versioning disabled

terraform-gcp-cloud-storage-bucket-versioning-disabled

>

Cloud Storage is anonymous or publicly accessible

terraform-gcp-cloud-storage-anonymous-or-publicly-accessible

>

Cluster labels disabled

terraform-gcp-cluster-labels-disabled

>

Container Registry repo is public

terraform-gcp-container-registry-repository-is-public

>

COS node image not used

terraform-gcp-cos-node-image-not-used

>

Dataproc clusters has public IPs

terraform-gcp-dataproc-cluster-has-public-ip

>

Dataproc clusters publicly accessible

terraform-gcp-dataproc-clusters-is-public

>

Disk encryption disabled

terraform-gcp-disk-encryption-disabled

>

DNSSEC using RSASHA1

terraform-gcp-dnssec-using-rsasha1

>

Ensure legacy networks do not exist for a project

terraform-gcp-legacy-networks-exist-for-project

>

Ensure SQL database instance has skip show database flag

terraform-gcp-sql-database-instance-does-not-have-skip-show-database

>

GKE control plane is public

terraform-gcp-gke-control-plane-is-public

>

GKE legacy authorization enabled

terraform-gcp-gke-legacy-authorization-enabled

>

GKE using default service account

terraform-gcp-gke-using-default-service-account

>

Google Compute firewall ingress allows unrestricted FTP access

terraform-gcp-firewall-ingress-allows-unrestricted-ftp-access

>

Google Compute firewall ingress allows unrestricted MySQL access

terraform-gcp-firewall-ingress-allows-unrestricted-mysql-access

>

Google Compute network using default firewall rule

terraform-gcp-google-compute-network-using-default-firewall-rule

>

Google Compute network using firewall rule that allows all ports

terraform-gcp-google-compute-network-using-firewall-rule-allows-all-ports

>

Google Compute network using firewall rule that allows port range

terraform-gcp-google-compute-network-using-firewall-rule-allows-port-range

>

Google Compute SSL policy weak cipher in use

terraform-gcp-google-compute-ssl-policy-weak-cipher-in-use

>

Google Compute subnetwork logging disabled

terraform-gcp-google-compute-subnetwork-logging-disabled

>

Google Compute subnetwork with private Google access disabled

terraform-gcp-google-compute-subnetwork-with-private-google-access-disabled

>

Google Container node pool auto repair disabled

terraform-gcp-google-container-node-pool-auto-repair-disabled

>

Google project auto create network disabled

terraform-gcp-google-project-auto-create-network-disabled

>

Google project IAM binding service account has token creator or account user role

terraform-gcp-google-project-iam-binding-service-account-has-token-creator-or-account-user-role

>

Google project IAM member service account has admin role

terraform-gcp-google-project-iam-member-service-account-has-admin-role

>

Google project IAM member service account has token creator or account user role

terraform-gcp-google-project-iam-member-service-account-has-token-creator-or-account-user-role

>

Google Storage bucket level access disabled

terraform-gcp-google-storage-bucket-level-access-disabled

>

High Google KMS crypto key rotation period

terraform-gcp-high-google-kms-crypto-key-rotation-period

>

IAM audit not properly configured

terraform-gcp-iam-audit-not-properly-configured

>

IP aliasing disabled

terraform-gcp-ip-aliasing-disabled

>

IP forwarding enabled

terraform-gcp-ip-forwarding-enabled

>

KMS admin and CryptoKey roles in use

terraform-gcp-kms-admin-and-crypto-key-roles-in-use

>

KMS CryptoKey is publicly accessible

terraform-gcp-kms-crypto-key-publicly-accessible

>

Legacy client certificate auth enabled

terraform-gcp-legacy-client-certificate-auth-enabled

>

Network policy disabled

terraform-gcp-network-policy-disabled

>

Node auto upgrade disabled

terraform-gcp-node-auto-upgrade-disabled

>

Not proper email account in use

terraform-gcp-not-proper-email-account-in-use

>

OSLogin disabled

terraform-gcp-os-login-disabled

>

OSLogin is disabled for VM instance

terraform-gcp-os-login-is-disabled-for-vm-instance

>

Outdated GKE version

terraform-gcp-outdated-gke-version

>

Pod security policy disabled

terraform-gcp-pod-security-policy-disabled

>

Private cluster disabled

terraform-gcp-private-cluster-disabled

>

Project-wide SSH keys are enabled in VM instances

terraform-gcp-project-wide-ssh-keys-are-enabled-in-vm-instances

>

Pub/Sub Topics are anonymously or publicly accessible

terraform-gcp-pubsub-topic-is-public

>

RDP access is not restricted

terraform-gcp-rdp-access-is-not-restricted

>

Serial ports are enabled for VM instances

terraform-gcp-vm-serial-ports-are-enabled-for-vm-instances

>

Service account with improper privileges

terraform-gcp-service-account-with-improper-privileges

>

Shielded GKE nodes disabled

terraform-gcp-shielded-gke-nodes-disabled

>

Shielded VM disabled

terraform-gcp-shielded-vm-disabled

>

SQL DB instance backup disabled

terraform-gcp-sql-db-instance-backup-disabled

>

SQL DB instance publicly accessible

terraform-gcp-sql-db-instance-is-publicly-accessible

>

SQL DB instance with SSL disabled

terraform-gcp-sql-db-instance-with-ssl-disabled

>

SQL Server cross DB ownership chaining enabled

terraform-gcp-sql-database-has-cross-db-ownership-chaining

>

SSH access is not restricted

terraform-gcp-ssh-access-is-not-restricted

>

Stackdriver Logging disabled

terraform-gcp-stackdriver-logging-disabled

>

Stackdriver Monitoring disabled

terraform-gcp-stackdriver-monitoring-disabled

>

Team label missing on GCP resource

terraform-gcp-team-label-not-present

>

There are non GCP-managed service account keys for a service account

terraform-gcp-service-has-non-gcp-managed-service-account-keys

>

User with IAM role

terraform-gcp-user-with-iam-role

>

Using default service account

terraform-gcp-using-default-service-account

>

VM with full cloud access

terraform-gcp-vm-with-full-cloud-access

>

Terraform / GCP

>

Github organization webhook with SSL disabled

terraform-github-organization-webhook-with-ssl-disabled

>

GitHub repository set to public

terraform-github-repository-set-to-public

>

Terraform / GitHub

>

Cluster admin rolebinding with superuser permissions

terraform-kubernetes-cluster-admin-role-binding-with-super-user-permissions

>

Cluster allows unsafe sysctls

terraform-kubernetes-cluster-allows-unsafe-sysctls

>

Container host PID is true

terraform-kubernetes-container-host-pid-is-true

>

Container is privileged

terraform-kubernetes-container-is-privileged

>

Container resources limits undefined

terraform-kubernetes-container-resources-limits-undefined

>

Container runs unmasked

terraform-kubernetes-container-runs-unmasked

>

Containers with added capabilities

terraform-kubernetes-container-with-added-capabilities

>

Containers with sys admin capabilities

terraform-kubernetes-containers-with-sys-admin-capabilities

>

CPU limits not set

terraform-kubernetes-cpu-limits-not-set

>

CPU requests not set

terraform-kubernetes-cpu-requests-not-set

>

CronJob deadline not configured

terraform-kubernetes-cronjob-deadline-not-configured

>

Default service account in use

terraform-kubernetes-default-service-account-in-use

>

Deployment has no podAntiAffinity

terraform-kubernetes-deployment-has-no-pod-anti-affinity

>

Deployment without PodDisruptionBudget

terraform-kubernetes-deployment-without-pod-disruption-budget

>

Docker daemon socket is exposed to containers

terraform-kubernetes-docker-daemon-socket-is-exposed-to-containers

>

HPA targets invalid object

terraform-kubernetes-hpa-targets-invalid-object

>

Image pull policy of the container is not set to always

terraform-kubernetes-image-pull-policy-of-container-is-not-always

>

Image without digest

terraform-kubernetes-image-without-digest

>

Incorrect volume claim access mode ReadWriteOnce

terraform-kubernetes-incorrect-volume-claim-access-mode-read-write-once

>

Ingress controller exposes workload

terraform-kubernetes-ingress-controller-exposes-workload

>

Invalid image

terraform-kubernetes-invalid-image

>

Liveness probe is not defined

terraform-kubernetes-liveness-probe-is-not-defined

>

Memory limits not defined

terraform-kubernetes-memory-limits-not-defined

>

Memory requests not defined

terraform-kubernetes-memory-requests-not-defined

>

Metadata label is invalid

terraform-kubernetes-metadata-label-is-invalid

>

Missing AppArmor config

terraform-kubernetes-missing-app-armor-config

>

NET_RAW capabilities disabled for PSP

terraform-kubernetes-net-raw-capabilities-disabled-for-psp

>

NET_RAW capabilities not being dropped

terraform-kubernetes-net-raw-capabilities-not-being-dropped

>

Network policy is not targeting any pod

terraform-kubernetes-network-policy-is-not-targeting-any-pod

>

No drop capabilities for containers

terraform-kubernetes-no-drop-capabilities-for-containers

>

Non kube system pod with host mount

terraform-kubernetes-non-kube-system-pod-with-host-mount

>

Permissive access to create pods

terraform-kubernetes-permissive-access-to-create-pods

>

Pod or container without security context

terraform-kubernetes-pod-or-container-without-security-context

>

Privilege escalation allowed

terraform-kubernetes-privilege-escalation-allowed

>

PSP allows containers to share the host network namespace

terraform-kubernetes-psp-allows-containers-to-share-the-host-network-namespace

>

PSP allows privilege escalation

terraform-kubernetes-psp-allows-privilege-escalation

>

PSP allows sharing host IPC

terraform-kubernetes-psp-allows-sharing-host-ipc

>

PSP set to privileged

terraform-kubernetes-psp-set-to-privileged

>

PSP with added capabilities

terraform-kubernetes-psp-with-added-capabilities

>

RBAC roles with read secrets permissions

terraform-kubernetes-rbac-roles-with-read-secrets-permissions

>

Readiness probe is not configured

terraform-kubernetes-readiness-probe-is-not-configured

>

Role binding to default service account

terraform-kubernetes-role-binding-to-default-service-account

>

Root container not mounted as read-only

terraform-kubernetes-root-container-not-mounted-as-read-only

>

Root containers admitted

terraform-kubernetes-root-containers-admitted

>

Seccomp profile is not configured

terraform-kubernetes-seccomp-profile-is-not-configured

>

Secrets as environment variables

terraform-kubernetes-secrets-as-environment-variables

>

Service account allows access secrets

terraform-kubernetes-service-account-allows-access-secrets

>

Service account name undefined or empty

terraform-kubernetes-service-account-name-undefined-or-empty

>

Service account token automount not disabled

terraform-kubernetes-service-account-token-automount-not-disabled

>

Service type is NodePort

terraform-kubernetes-service-type-is-nodeport

>

Service with external load balancer

terraform-kubernetes-service-with-external-load-balancer

>

Shared host IPC namespace

terraform-kubernetes-shared-host-ipc-namespace

>

Shared host network namespace

terraform-kubernetes-shared-host-network-namespace

>

Shared service account

terraform-kubernetes-shared-service-account

>

StatefulSet requests storage

terraform-kubernetes-statefulset-requests-storage

>

StatefulSet without PodDisruptionBudget

terraform-kubernetes-statefulset-without-pod-disruption-budget

>

StatefulSet without service name

terraform-kubernetes-statefulset-without-service-name

>

Tiller (Helm v2) is deployed

terraform-kubernetes-tiller-is-deployed

>

Using default namespace

terraform-kubernetes-using-default-namespace

>

Volume mount with OS directory write permissions

terraform-kubernetes-volume-mount-with-os-directory-write-permissions

>

Workload host port not specified

terraform-kubernetes-workload-host-port-not-specified

>

Workload mounting with sensitive OS directory

terraform-kubernetes-workload-mounting-with-sensitive-os-directory

>

Terraform / Kubernetes

>

NIFCLOUD computing has common private network

terraform-nifcloud-computing-instance-has-common-private

>

NIFCLOUD computing has public ingress security group rule

terraform-nifcloud-computing-instance-has-public-ingress-sgr

>

NIFCLOUD computing undefined description to security group

terraform-nifcloud-computing-security-group-description-undefined

>

NIFCLOUD computing undefined description to security group rule

terraform-nifcloud-computing-security-group-rule-description-undefined

>

NIFCLOUD computing undefined security group to instance

terraform-nifcloud-computing-instance-security-group-undefined

>

NIFCLOUD DNS has verified record

terraform-nifcloud-dns-has-verified-record

>

NIFCLOUD ELB has common private network

terraform-nifcloud-elb-has-common-private

>

NIFCLOUD ELB listener using HTTP protocol

terraform-nifcloud-elb-listener-use-http

>

NIFCLOUD ELB using HTTP protocol

terraform-nifcloud-elb-use-http

>

NIFCLOUD LB listener using HTTP port

terraform-nifcloud-load-balancer-listener-use-http

>

NIFCLOUD LB using HTTP port

terraform-nifcloud-load-balancer-use-http

>

NIFCLOUD LB using insecure TLS policy ID

terraform-nifcloud-load-balancer-use-insecure-tls-policy-id

>

NIFCLOUD LB using insecure TLS policy name

terraform-nifcloud-load-balancer-use-insecure-tls-policy-name

>

NIFCLOUD NAS has common private network

terraform-nifcloud-nas-instance-has-common-private

>

NIFCLOUD NAS has public ingress NAS security group rule

terraform-nifcloud-nas-security-group-has-public-ingress-sgr

>

NIFCLOUD NAS undefined description to NAS security group

terraform-nifcloud-nas-security-group-description-undefined

>

NIFCLOUD RDB backup retention period below 7 days

terraform-nifcloud-db-does-not-have-long-backup-retention

>

NIFCLOUD RDB has common private network

terraform-nifcloud-db-instance-has-common-private

>

NIFCLOUD RDB has public DB access

terraform-nifcloud-db-has-public-access

>

NIFCLOUD RDB has public DB ingress security group rule

terraform-nifcloud-db-security-group-has-public-ingress-sgr

>

NIFCLOUD RDB undefined description to DB security group

terraform-nifcloud-db-security-group-description-undefined

>

NIFCLOUD router has common private network

terraform-nifcloud-router-has-common-private

>

NIFCLOUD router undefined security group

terraform-nifcloud-router-security-group-undefined

>

NIFCLOUD VPN gateway undefined security group

terraform-nifcloud-vpn-gateway-security-group-undefined

>

Terraform / Nifcloud

>

CDB instance internet service enabled

terraform-tencentcloud-cdb-instance-internet-service-enabled

>

CDB instance internet using default intranet port

terraform-tencentcloud-cdb-instance-using-default-intranet-port

>

CDB instance without backup policy

terraform-tencentcloud-cdb-instance-without-backup-policy

>

CLB instance log setting disabled

terraform-tencentcloud-clb-instance-log-setting-disabled

>

CLB listener using insecure protocols

terraform-tencentcloud-clb-listener-using-insecure-protocols

>

CVM instance disable monitor service

terraform-tencentcloud-cvm-instance-disable-monitor-service

>

CVM instance has public IP

terraform-tencentcloud-cvm-instance-has-public-ip

>

CVM instance using default security group

terraform-tencentcloud-cvm-instance-using-default-security-group

>

CVM instance using default VPC

terraform-tencentcloud-cvm-instance-using-default-vpc

>

CVM instance using user data

terraform-tencentcloud-cvm-instance-using-user-data

>

Disk encryption disabled

terraform-tencentcloud-disk-encryption-disabled

>

Security group rule set accepts all traffic

terraform-tencentcloud-security-group-rule-set-accepts-all-traffic

>

TKE cluster encryption protection disabled

terraform-tencentcloud-tke-cluster-encryption-protection-disabled

>

TKE cluster has public access

terraform-tencentcloud-tke-cluster-has-public-access

>

TKE cluster log agent is not enabled

terraform-tencentcloud-tke-cluster-log-disabled

>

VPC flow logs disabled

terraform-tencentcloud-vpc-flow-log-disabled

>

Terraform / TencentCloud

>