IaC Security Rules

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

This product is not supported for your selected Datadog site ().

Infrastructure as Code (IaC) Security identifies misconfigurations and security risks in infrastructure-as-code files before deployment, helping ensure that cloud environments remain secure and compliant.

For Helm resolution to work correctly, each chart directory must include the charts it depends on. For details, see Chart File Structure in the Helm documentation.
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Always admit admission control plugin set
always_admit_admission_control_plugin_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Always pull images admission control plugin not set
always_pull_images_admission_control_plugin_not_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Anonymous auth is not set to false
anonymous_auth_is_not_set_to_false
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Audit log maxage not properly set
audit_log_maxage_not_properly_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Audit log maxbackup not properly set
audit_log_maxbackup_not_properly_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Audit log maxsize not properly set
audit_log_maxsize_not_properly_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Audit log path not set
audit_log_path_not_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Audit policy does not cover key security concerns
audit_policy_not_cover_key_security_concerns
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Audit policy file not defined
audit_policy_file_not_defined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Authorization mode node not set
authorization_mode_node_not_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Authorization mode RBAC not set
authorization_mode_rbac_not_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Authorization mode set to always allow
authorization_mode_set_to_always_allow
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Auto TLS set to true
auto_tls_set_to_true
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Basic auth file is set
basic_auth_file_is_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Bind address not properly set
bind_address_not_properly_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Certificate authority is not unique
not_unique_certificate_authority
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Client certificate authentication not set up properly
client_certificate_authentication_not_setup_properly
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Cluster admin rolebinding with superuser permissions
cluster_admin_role_binding_with_super_user_permissions
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Cluster allows unsafe sysctls
cluster_allows_unsafe_sysctls
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg CNI plugin does not support network policies
cni_plugin_does_not_support_network_policies
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Container is privileged
container_is_privileged
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Container running as root
containers_running_as_root
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Container with low UID
containers_run_with_low_uid
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Container with unmasked /proc access
container_runs_unmasked
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Containers missing drop capabilities
no_drop_capabilities_for_containers
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Containers with added capabilities
containers_with_added_capabilities
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Containers with sys admin capabilities
containers_with_sys_admin_capabilities
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg CPU limits not set
cpu_limits_not_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg CPU requests not set
cpu_requests_not_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg CronJob deadline not configured
cronjob_deadline_not_configured
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Dashboard is enabled
dashboard_is_enabled
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Deployment without podAntiAffinity
deployment_has_no_pod_anti_affinity
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Deployment without PodDisruptionBudget
deployment_without_pod_disruption_budget
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Docker daemon socket is exposed to containers
docker_daemon_socket_is_exposed_to_containers
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Encryption provider config is not defined
encryption_provider_config_is_not_defined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Encryption provider not properly configured
encryption_provider_not_properly_configured
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Ensure administrative boundaries between resources
ensure_administrative_boundaries_between_resources
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg etcd client certificate authentication set to false
etcd_client_certificate_authentication_set_to_false
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg etcd client certificate file not defined
etcd_client_certificate_file_not_defined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg etcd peer client certificate authentication set to false
etcd_peer_client_certificate_authentication_set_to_false
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg etcd peer TLS certificate files not properly set
etcd_peer_tls_certificate_files_not_properly_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg etcd TLS certificate files not properly set
etcd_tls_certificate_files_not_properly_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg etcd TLS certificate not properly configured
etcd_tls_certificate_not_properly_configured
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Event rate limit admission control plugin not set
event_rate_limit_admission_control_plugin_not_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg HPA targeted deployments with configured replica count
hpa_targeted_deployments_with_configured_replica_count
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg HPA targets invalid object
hpa_targets_invalid_object
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Image policy webhook admission control plugin not set
image_policy_webhook_admission_control_plugin_not_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Image pull policy of the container is not set to always
image_pull_policy_of_container_is_not_always
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Image without digest
image_without_digest
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Incorrect volume claim access mode ReadWriteOnce
incorrect_volume_claim_access_mode_read_write_once
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Ingress controller exposes workload
ingress_controller_exposes_workload
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Insecure bind address set
insecure_bind_address_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Insecure port not properly set
insecure_port_not_properly_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Invalid image tag
invalid_image
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Invalid metadata label
metadata_label_is_invalid
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet certificate authority not set
kubelet_certificate_authority_not_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet client certificate or key not set
kubelet_client_certificate_or_key_not_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet client periodic certificate switch disabled
kubelet_client_periodic_certificate_switch_disabled
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet event QPS not properly set
kubelet_event_qps_not_properly_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet hostname override is set
kubelet_hostname_override_is_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet HTTPS set to false
kubelet_https_set_to_false
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet not managing IP tables
kubelet_not_managing_ip_tables
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet protect-kernel-defaults set to false
kubelet_protect_kernel_defaults_set_to_false
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet read-only port is not set to zero
kubelet_read_only_port_is_not_set_to_zero
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet streaming connection timeout disabled
kubelet_streaming_connection_timeout_disabled
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Liveness probe is not defined
liveness_probe_is_not_defined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Memory limits not defined
memory_limits_not_defined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Memory requests not defined
memory_requests_not_defined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Missing AppArmor profile
missing_app_armor_config
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Namespace lifecycle admission control plugin disabled
namespace_lifecycle_admission_control_plugin_disabled
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg NET_RAW capabilities disabled for PSP
net_raw_capabilities_disabled_for_psp
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg NET_RAW capabilities not dropped
net_raw_capabilities_not_being_dropped
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Network policy without Pod target
network_policy_is_not_targeting_any_pod
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Node restriction admission control plugin not set
node_restriction_admission_control_plugin_not_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Non kube-system pod with host mount
non_kube_system_pod_with_host_mount
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Object is using a deprecated API version
object_is_using_a_deprecated_api_version
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Peer auto TLS set to true
peer_auto_tls_set_to_true
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Permissive access to create Pods
permissive_access_to_create_pods
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Pod misconfigured network policy
pod_misconfigured_network_policy
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Pod or container without LimitRange
pod_or_container_without_limit_range
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Pod or container without ResourceQuota
pod_or_container_without_resource_quota
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Pod or container without security context
pod_or_container_without_security_context
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Pod security policy admission control plugin not set
pod_security_policy_admission_control_plugin_not_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg PodSecurityPolicy allows host network sharing
psp_containers_share_host_network_namespace
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Privilege escalation allowed
privilege_escalation_allowed
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Profiling not set to false
profiling_not_set_to_false
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg PSP allows privilege escalation
psp_allows_privilege_escalation
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg PSP allows sharing host IPC
psp_allows_sharing_host_ipc
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg PSP allows sharing host PID
psp_allows_sharing_host_pid
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg PSP set to privileged
psp_set_to_privileged
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg PSP with added capabilities
psp_with_added_capabilities
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg PSP with unrestricted access to host path
psp_with_unrestricted_access_to_host_path
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg RBAC roles allow privilege escalation
rbac_roles_allow_privilege_escalation
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg RBAC roles with attach permission
rbac_roles_with_attach_permission
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg RBAC roles with exec permission
rbac_roles_with_exec_permission
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg RBAC roles with impersonate permission
rbac_roles_with_impersonate_permission
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg RBAC roles with port-forwarding permission
rbac_roles_with_portforwarding_permissions
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg RBAC roles with read secrets permissions
rbac_roles_with_read_secrets_permissions
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg RBAC wildcard in rule
rbac_wildcard_in_rule
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Readiness probe is not configured
readiness_probe_is_not_configured
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Request timeout not properly set
request_timeout_not_properly_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Role binding to default service account
role_binding_to_default_service_account
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Root CA file not defined
root_ca_file_not_defined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Root container not mounted as read-only
root_container_not_mounted_as_read_only
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Root containers admitted
root_containers_admitted
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Rotate Kubelet server certificate not active
rotate_kubelet_server_certificate_not_active
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Seccomp profile is not configured
seccomp_profile_is_not_configured
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Secrets used as environment variables
secrets_as_environment_variables
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Secure port set to zero
secure_port_set_to_zero
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Security context deny admission control plugin not set
security_context_deny_admission_control_plugin_not_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service account admission control plugin disabled
service_account_admission_control_plugin_disabled
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service account key file not properly set
service_account_key_file_not_properly_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service account lookup set to false
service_account_lookup_set_to_false
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service account name undefined or empty
service_account_name_undefined_or_empty
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service account private key file not defined
service_account_private_key_file_not_defined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service account token auto-mount not disabled
service_account_token_automount_not_disabled
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service does not target a Pod
service_does_not_target_pod
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service type is NodePort
service_type_is_nodeport
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service with external load balancer
service_with_external_load_balancer
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg ServiceAccount allows access to secrets
service_account_allows_access_secrets
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Shared host IPC namespace
shared_host_ipc_namespace
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Shared host network namespace
shared_host_network_namespace
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Shared host PID namespace
shared_host_pid_namespace
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Shared service account
shared_service_account
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg StatefulSet requests storage
statefulset_requests_storage
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg StatefulSet without podAntiAffinity
statefulset_has_no_pod_anti_affinity
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg StatefulSet without PodDisruptionBudget
statefulset_without_pod_disruption_budget
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg StatefulSet without service name
statefulset_without_service_name
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Terminated pod garbage collector threshold not properly set
terminated_pod_garbage_collector_threshold_not_properly_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Tiller (Helm v2) deployed
tiller_is_deployed
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Tiller Deployment accessible within cluster
tiller_deployment_is_accessible_from_within_the_cluster
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Tiller Service present
tiller_service_is_not_deleted
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg TLS connection certificate not set up
tls_connection_certificate_not_setup
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Token auth file is set
token_auth_file_is_set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Unrestricted capabilities in PodSecurityPolicy
not_limited_capabilities_for_pod_security_policy
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Use service account credentials not set to true
use_service_account_credentials_not_set_to_true
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Using Kubernetes native secret management
using_kubernetes_native_secret_management
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Using unrecommended namespace
using_unrecommended_namespace
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Volume mount with OS directory write permissions
volume_mount_with_os_directory_write_permissions
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Weak TLS cipher suites
weak_tls_cipher_suites
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Workload host port not specified
workload_host_port_not_specified
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Workload mounting with sensitive OS directory
workload_mounting_with_sensitive_os_directory
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ALB deletion protection disabled
alb_deletion_protection_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ALB is not integrated with WAF
alb_is_not_integrated_with_waf
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ALB listening on HTTP
alb_listening_on_http
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ALB not dropping invalid headers
alb_not_dropping_invalid_headers
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Amazon DMS replication instance is publicly accessible
amazon_dms_replication_instance_is_publicly_accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg AmazonMQ broker encryption disabled
amazon_mq_broker_encryption_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg AMI most recent without owner or filter
ami_owner_missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg AMI not encrypted
ami_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg AMI shared with multiple accounts
ami_shared_with_multiple_accounts
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway access logging disabled
api_gateway_access_logging_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway deployment without access log setting
api_gateway_deployment_without_access_log_setting
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API gateway deployment without API gateway usage plan associated
api_gateway_deployment_without_api_gateway_usage_plan_associated
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway endpoint config is not private
api_gateway_endpoint_config_is_not_private
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway method does not contains an API key
api_gateway_method_does_not_contains_an_api_key
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway method settings cache not encrypted
api_gateway_method_settings_cache_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway stage without API Gateway usage plan associated
api_gateway_stage_without_api_gateway_usage_plan_associated
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway with CloudWatch logging disabled
api_gateway_with_cloudwatch_logging_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway with invalid compression
api_gateway_with_invalid_compression
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway with open access
api_gateway_with_open_access
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway without configured authorizer
api_gateway_without_configured_authorizer
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway without security policy
api_gateway_without_security_policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway without SSL certificate
api_gateway_without_ssl_certificate
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway without WAF
api_gateway_without_waf
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway X-Ray disabled
api_gateway_xray_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Athena database not encrypted
athena_database_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Athena workgroup not encrypted
athena_workgroup_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Aurora with disabled at rest encryption
aurora_with_disabled_at_rest_encryption
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Authentication without MFA
authentication_without_mfa
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Auto scaling group with no associated ELB
auto_scaling_group_with_no_associated_elb
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Automatic minor upgrades disabled
automatic_minor_upgrades_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Autoscaling groups supply tags
autoscaling_groups_supply_tags
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg AWS password policy with unchangeable passwords
aws_password_policy_with_unchangeable_passwords
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Batch job definition with privileged container properties
batch_job_definition_with_privileged_container_properties
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CA certificate identifier is outdated
ca_certificate_identifier_is_outdated
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CDN configuration is missing
cdn_configuration_is_missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Certificate has expired
certificate_has_expired
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Certificate RSA key bytes lower than 256
certificate_rsa_key_bytes_lower_than_256
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudFront logging disabled
cloudfront_logging_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Cloudfront viewer protocol policy allows HTTP
cloudfront_viewer_protocol_policy_allows_http
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudFront without WAF
cloudfront_without_waf
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail log file validation disabled
cloudtrail_log_file_validation_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail log files not encrypted with KMS
cloudtrail_log_files_not_encrypted_with_kms
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail log files S3 bucket is publicly accessible
cloudtrail_log_files_s3_bucket_is_publicly_accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail log files S3 bucket with logging disabled
cloudtrail_log_files_s3_bucket_with_logging_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail logging disabled
cloudtrail_logging_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail multi region disabled
cloudtrail_multi_region_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail not integrated with CloudWatch
cloudtrail_not_integrated_with_cloudwatch
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail SNS topic name undefined
cloudtrail_sns_topic_name_undefined
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch AWS Config configuration changes alarm missing
cloudwatch_aws_config_configuration_changes_alarm_missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch AWS organizations changes missing alarm
cloudwatch_aws_organizations_changes_missing_alarm
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch changes to NACL alarm missing
cloudwatch_changes_to_nacl_alarm_missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Cloudwatch CloudTrail configuration changes alarm missing
cloudwatch_cloudtrail_configuration_changes_alarm_missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch console sign-in without MFA alarm missing
cloudwatch_management_console_sign_in_without_mfa_alarm_missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch disabling or scheduled deletion of customer created CMK alarm missing
cloudwatch_disabling_or_scheduled_deletion_of_customer_created_cmk_alarm_missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch IAM policy changes alarm missing
cloudwatch_iam_policy_changes_alarm_missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch log group without KMS
cloudwatch_log_group_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch logging disabled
cloudwatch_logging_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch logs destination with vulnerable policy
cloudwatch_logs_destination_with_vulnerable_policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch management console auth failed alarm missing
cloudwatch_management_console_auth_failed_alarm_missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch metrics disabled
cloudwatch_metrics_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch network gateways changes alarm missing
cloudwatch_network_gateways_changes_alarm_missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch root account use missing
cloudwatch_root_account_use_alarm_missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch route table changes alarm missing
cloudwatch_route_table_changes_alarm_missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch S3 policy change alarm missing
cloudwatch_s3_policy_change_alarm_missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Cloudwatch security group changes alarm missing
cloudwatch_security_group_changes_alarm_missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch unauthorized access alarm missing
cloudwatch_unauthorized_access_defined_alarm_missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch VPC changes alarm missing
cloudwatch_vpc_changes_alarm_missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch without retention period specified
cloudwatch_without_retention_period_specified
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CMK is unusable
cmk_is_unusable
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CMK rotation disabled
cmk_rotation_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CodeBuild project encrypted with AWS managed key
codebuild_project_encrypted_with_aws_managed_key
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Cognito user pool without MFA
cognito_userpool_without_mfa
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Config rule for encrypted volumes disabled
config_rule_for_encrypted_volumes_is_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Configuration aggregator to all regions disabled
config_configuration_aggregator_to_all_regions_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Cross-account IAM assume role policy without external id or MFA
cross_account_iam_assume_role_policy_without_external_id_or_mfa
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DAX cluster not encrypted
dax_cluster_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DB instance storage not encrypted
db_instance_storage_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DB security group has public interface
db_security_group_has_public_interface
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DB security group open to large scope
db_security_group_open_to_large_scope
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DB security group with public scope
db_security_group_with_public_scope
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DB snapshot is public
db_snapshot_public
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Default security groups with unrestricted traffic
default_security_groups_with_unrestricted_traffic
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Default VPC exists
default_vpc_exists
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DMS endpoints without SSL
dms_endpoint_no_ssl_configured
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DocumentDB cluster encrypted with AWS managed key
docdb_cluster_encrypted_with_aws_managed_key
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DocumentDB cluster not encrypted
docdb_cluster_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DocumentDB cluster without KMS
docdb_cluster_without_kms
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DocumentDB logging is disabled
docdb_logging_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DynamoDB table not encrypted
dynamodb_table_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DynamoDB table Point-in-Time Recovery disabled
dynamodb_table_point_in_time_recovery_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Dynamodb VPC endpoint without route table association
dynamodb_vpc_endpoint_without_route_table_association
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EBS default encryption disabled
ebs_default_encryption_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EBS volume encryption disabled
ebs_volume_encryption_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EBS volume snapshot not encrypted
ebs_volume_snapshot_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 instance has public IP
ec2_instance_has_public_ip
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 instance monitoring disabled
ec2_instance_monitoring_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 instance using API keys
ec2_instance_using_api_keys
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 instance using default security group
ec2_instance_using_default_security_group
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 instance using default VPC
ec2_instance_using_default_vpc
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 not EBS optimized
ec2_not_ebs_optimized
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECR image tag not immutable
ecr_image_tag_not_immutable
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECR repository is publicly accessible
ecr_repository_is_publicly_accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECR repository not encrypted with CMK
ecr_repository_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECR repository without policy
ecr_repository_without_policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS cluster with container insights disabled
ecs_cluster_container_insights_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS service admin role is present
ecs_service_admin_role_is_present
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS service without running tasks
ecs_service_without_running_tasks
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS task definition network mode not recommended
ecs_task_definition_network_mode_not_recommended
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS task definition volume not encrypted
ecs_task_definition_volume_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EFS not encrypted
efs_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EFS with vulnerable policy
efs_with_vulnerable_policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EFS without KMS
efs_without_kms
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EKS cluster encryption disabled
eks_cluster_encryption_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EKS cluster has public access
eks_cluster_has_public_access
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EKS cluster has public access CIDRs
eks_cluster_has_public_access_cidrs
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EKS cluster logging is not enabled
eks_cluster_log_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EKS node group remote access disabled
eks_node_group_remote_access_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ElastiCache nodes not created across multi AZ
elasticache_nodes_not_created_across_multi_az
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ElastiCache Redis cluster without backup
elasticache_redis_cluster_without_backup
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ElastiCache replication group not encrypted at rest
elasticache_replication_group_not_encrypted_at_rest
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ElastiCache replication group not encrypted at transit
elasticache_replication_group_not_encrypted_at_transit
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ElastiCache using default port
elasticache_using_default_port
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ElastiCache without VPC
elasticache_without_vpc
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch domain not encrypted node to node
elasticsearch_domain_not_encrypted_node_to_node
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch domain with vulnerable policy
elasticsearch_domain_with_vulnerable_policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch encryption with KMS disabled
elasticsearch_encryption_with_kms_is_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch log disabled
elasticsearch_logs_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch not encrypted at rest
elasticsearch_not_encrypted_at_rest
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch uses default security group
elasticsearch_using_default_security_group
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch with HTTPS disabled
elasticsearch_with_https_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch without IAM authentication
elasticsearch_without_iam_authentication
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch without slow logs
elasticsearch_without_slow_logs
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ELB access log disabled
elb_access_logging_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ELB using insecure protocols
elb_using_insecure_protocols
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ELB using weak ciphers
elb_using_weak_ciphers
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EMR without VPC
emr_without_vpc
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Fine-grained access control disabled for OpenSearch/Elasticsearch
elasticsearch_no_finegrain_access_control
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Global Accelerator flow logs disabled
global_accelerator_flow_logs_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Glue Data Catalog encryption disabled
glue_data_catalog_encryption_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Glue security configuration encryption disabled
glue_security_configuration_encryption_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Glue with vulnerable policy
glue_with_vulnerable_policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole'
group_with_privilege_escalation_by_actions_iam_PassRole_and_cloudformation_CreateStack
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'
group_with_privilege_escalation_by_actions_iam_PassRole_and_ec2_RunInstances
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole'
group_with_privilege_escalation_by_actions_iam_PassRole_and_glue_CreateDevEndpoint
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'glue:UpdateDevEndpoint'
group_with_privilege_escalation_by_actions_glue_UpdateDevEndpoint
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:AddUserToGroup'
group_with_privilege_escalation_by_actions_iam_AddUserToGroup
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:AttachGroupPolicy'
group_with_privilege_escalation_by_actions_iam_AttachGroupPolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:AttachRolePolicy'
group_with_privilege_escalation_by_actions_iam_AttachRolePolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:AttachUserPolicy'
group_with_privilege_escalation_by_actions_iam_AttachUserPolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:CreateAccessKey'
group_with_privilege_escalation_by_actions_iam_CreateAccessKey
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:CreateLoginProfile'
group_with_privilege_escalation_by_actions_iam_CreateLoginProfile
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:CreatePolicyVersion'
group_with_privilege_escalation_by_actions_iam_CreatePolicyVersion
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:PutGroupPolicy'
group_with_privilege_escalation_by_actions_iam_PutGroupPolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:PutRolePolicy'
group_with_privilege_escalation_by_actions_iam_PutRolePolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:PutUserPolicy'
group_with_privilege_escalation_by_actions_iam_PutUserPolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:SetDefaultPolicyVersion'
group_with_privilege_escalation_by_actions_iam_SetDefaultPolicyVersion
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole'
group_with_privilege_escalation_by_actions_iam_UpdateAssumeRolePolicy_and_sts_AssumeRole
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:UpdateLoginProfile'
group_with_privilege_escalation_by_actions_iam_UpdateLoginProfile
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction'
group_with_privilege_escalation_by_actions_iam_PassRole_and_lambda_CreateFunction_and_lambda_InvokeFunction
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'lambda:UpdateFunctionCode'
group_with_privilege_escalation_by_actions_lambda_UpdateFunctionCode
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg GuardDuty detector disabled
guardduty_detector_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Hardcoded AWS access key
hardcoded_aws_access_key
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Hardcoded AWS access key in Lambda
hardcoded_aws_access_key_in_lambda
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg HTTP port open to internet
http_port_open
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM access key is exposed
iam_access_key_is_exposed
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM database auth not enabled
iam_database_auth_not_enabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM group without users
iam_group_without_users
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM password policy does not require lowercase letter
iam_password_does_not_require_lowercase
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM password policy does not require numbers
iam_password_does_not_require_number
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM password policy does not require symbol
iam_password_does_not_require_symbol
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM password policy does not require uppercase letter
iam_password_does_not_require_uppercase
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM password without minimum length
iam_password_without_minimum_length
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM policies attached to user
iam_policies_attached_to_user
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM policies with full privileges
iam_policies_with_full_privileges
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM policy grants 'AssumeRole' permission across all services
iam_policy_grants_assumerole_permission_across_all_services
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM policy grants full permissions
iam_policy_grants_full_permissions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM role allows all principals to assume
iam_role_allows_all_principals_to_assume
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM role policy passrole allows all
iam_role_policy_passrole_allows_all
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM role with full privileges
iam_role_with_full_privileges
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM user has too many access keys
iam_user_too_many_access_keys
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM user policy without MFA
iam_user_policy_without_mfa
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM user with access to console
iam_user_with_access_to_console
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IMDSv1 enabled
imdsv1_is_enabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Instance with no VPC
instance_with_no_vpc
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Kinesis not encrypted with KMS
kinesis_not_encrypted_with_kms
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Kinesis SSE not configured
kinesis_sse_not_configured
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg KMS key with no deletion window
kms_key_with_no_deletion_window
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg KMS key with vulnerable policy
kms_key_with_full_permissions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda function publicly accessible
lambda_function_publicly_accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda function with privileged role
lambda_function_with_privileged_role
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda functions without X-Ray tracing
lambda_functions_without_x-ray_tracing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda IAM InvokeFunction misconfigured
lambda_iam_invokefunction_misconfigured
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda permission misconfigured
lambda_permission_misconfigured
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda permission principal is wildcard
lambda_permission_principal_is_wildcard
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda with vulnerable policy
lambda_with_vulnerable_policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Launch configuration is not encrypted
launch_configuration_is_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Misconfigured password policy expiration
misconfigured_password_policy_expiration
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Missing cluster log types
missing_cluster_log_types
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg MQ broker is publicly accessible
mq_broker_is_publicly_accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg MQ broker logging disabled
mq_broker_logging_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg MSK broker is publicly accessible
msk_broker_is_publicly_accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg MSK cluster encryption disabled
msk_cluster_encryption_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg MSK cluster logging disabled
msk_cluster_logging_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Neptune cluster instance is publicly accessible
neptune_cluster_instance_is_publicly_accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Neptune cluster snapshot not encrypted
neptune_snapshots_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Neptune cluster with IAM database authentication disabled
neptune_cluster_with_iam_database_authentication_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Neptune database cluster encryption disabled
neptune_database_cluster_encryption_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Neptune logging is disabled
neptune_logging_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Network ACL with unrestricted access to RDP
network_acl_with_unrestricted_access_to_rdp
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Network ACL with unrestricted access to SSH
network_acl_with_unrestricted_access_to_ssh
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg No password policy enabled
no_password_policy_enabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg No stack policy
no_stack_policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Password without reuse prevention
password_without_reuse_prevention
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Policy without principal
policy_without_principal
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Public and private EC2 share role
public_and_private_ec2_share_role
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Public Lambda via API Gateway
public_lambda_via_api_gateway
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS associated with public subnet
rds_associated_with_public_subnet
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS cluster with backup disabled
rds_cluster_with_backup_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS database cluster not encrypted
rds_database_cluster_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS DB instance publicly accessible
rds_db_instance_publicly_accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS storage not encrypted
rds_storage_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS using default port
rds_using_default_port
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS with backup disabled
rds_with_backup_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS without logging
rds_without_logging
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redis disabled
redis_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redis not compliant
redis_not_compliant
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redshift cluster logging disabled
redshift_cluster_logging_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redshift cluster without VPC
redshift_cluster_without_vpc
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redshift not encrypted
redshift_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redshift publicly accessible
redshift_publicly_accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redshift using default port
redshift_using_default_port
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Remote Desktop port open to internet
remote_desktop_port_open_to_internet
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Resource not using tags
resource_not_using_tags
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg REST API with vulnerable policy
rest_api_with_vulnerable_policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole'
role_with_privilege_escalation_by_actions_iam_PassRole_and_cloudformation_CreateStack
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'
role_with_privilege_escalation_by_actions_iam_PassRole_and_ec2_RunInstances
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole'
role_with_privilege_escalation_by_actions_iam_PassRole_and_glue_CreateDevEndpoint
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'glue:UpdateDevEndpoint'
role_with_privilege_escalation_by_actions_glue_UpdateDevEndpoint
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:AddUserToGroup'
role_with_privilege_escalation_by_actions_iam_AddUserToGroup
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:AttachGroupPolicy'
role_with_privilege_escalation_by_actions_iam_AttachGroupPolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:AttachRolePolicy'
role_with_privilege_escalation_by_actions_iam_AttachRolePolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:AttachUserPolicy'
role_with_privilege_escalation_by_actions_iam_AttachUserPolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:CreateAccessKey'
role_with_privilege_escalation_by_actions_iam_CreateAccessKey
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:CreateLoginProfile'
role_with_privilege_escalation_by_actions_iam_CreateLoginProfile
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:CreatePolicyVersion'
role_with_privilege_escalation_by_actions_iam_CreatePolicyVersion
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:PutGroupPolicy'
role_with_privilege_escalation_by_actions_iam_PutGroupPolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:PutRolePolicy'
role_with_privilege_escalation_by_actions_iam_PutRolePolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:PutUserPolicy'
role_with_privilege_escalation_by_actions_iam_PutUserPolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:SetDefaultPolicyVersion'
role_with_privilege_escalation_by_actions_iam_SetDefaultPolicyVersion
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole'
role_with_privilege_escalation_by_actions_iam_UpdateAssumeRolePolicy_and_sts_AssumeRole
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:UpdateLoginProfile'
role_with_privilege_escalation_by_actions_iam_UpdateLoginProfile
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction'
role_with_privilege_escalation_by_actions_iam_PassRole_and_lambda_CreateFunction_lambda_InvokeFunction
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'lambda:UpdateFunctionCode'
role_with_privilege_escalation_by_actions_lambda_UpdateFunctionCode
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Root account has active access keys
root_account_has_active_access_keys
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Route53 record undefined
route53_record_undefined
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket access to any principal
s3_bucket_access_to_any_principal
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket ACL allows read or write to all users
s3_bucket_acl_allows_read_or_write_to_all_users
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket ACL allows read to any authenticated user
s3_bucket_acl_allows_read_to_any_authenticated_user
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket ACL grants WRITE_ACP permission
s3_bucket_acl_grants_write_acp_permission
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows authenticated users access
s3_bucket_allows_access_to_all_authenticated_users
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows delete action from all principals
s3_bucket_allows_delete_action_from_all_principals
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows get action from all principals
s3_bucket_allows_get_action_from_all_principals
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows list action from all principals
s3_bucket_allows_list_action_from_all_principals
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows public ACL
s3_bucket_allows_public_acl
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows public policy
s3_bucket_with_public_policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows put action from all principals
s3_bucket_allows_put_action_from_all_principals
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket logging disabled
s3_bucket_logging_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket object not encrypted
s3_bucket_object_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket object-level CloudTrail logging disabled
s3_bucket_object_level_cloudtrail_logging_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket policy accepts HTTP requests
s3_bucket_policy_accepts_http_requests
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket public ACL overridden by public access block
s3_bucket_public_acl_overridden_by_public_access_block
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket with all permissions
s3_bucket_with_all_permissions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket with unsecured CORS rule
s3_bucket_with_unsecured_cors_rule
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket without enabled MFA delete
s3_bucket_without_enabled_mfa_delete
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket without ignore public ACL
s3_bucket_without_ignore_public_acl
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket without restriction of public bucket
s3_bucket_without_restriction_of_public_bucket
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket without versioning
s3_bucket_without_versioning
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 static website host enabled
s3_static_website_host_enabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SageMaker endpoint configuration encryption disabled
sagemaker_endpoint_configuration_encryption_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SageMaker notebook instance without KMS
sagemaker_notebook_instance_without_kms
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SageMaker notebook internet access enabled
sagemaker_direct_internet_access_enabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Secrets Manager secret encrypted with AWS-managed key
secretsmanager_secret_encrypted_with_aws_managed_key
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Secrets Manager secret without KMS
secretsmanager_secret_without_kms
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Secrets Manager with vulnerable policy
secrets_manager_with_vulnerable_policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Secure ciphers disabled
secure_ciphers_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security group not used
security_groups_not_used
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security group rule without description
security_group_rules_without_description
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security group rule without description
security_group_without_description
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security group with unrestricted access to SSH
security_group_with_unrestricted_access_to_ssh
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Sensitive port is exposed to entire network
sensitive_port_is_exposed_to_entire_network
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Sensitive port is exposed to small public network
sensitive_port_is_exposed_to_small_public_network
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Sensitive port is exposed to wide private network
sensitive_port_is_exposed_to_wide_private_network
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Service control policies disabled
service_control_policies_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SES policy with allowed IAM actions
ses_policy_with_allowed_iam_actions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Shield Advanced not in use
shield_advanced_not_in_use
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SNS topic encrypted with AWS managed key
sns_topic_encrypted_with_aws_managed_key
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SNS topic is publicly accessible
sns_topic_is_publicly_accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SNS topic not encrypted
sns_topic_not_encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SNS topic publicity has allow and NotAction simultaneously
sns_topic_publicity_has_allow_and_not_action_simultaneously
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SQL analysis services port 2383 (TCP) is publicly accessible
sql_analysis_services_port_2383_is_publicly_accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SQS policy allows all actions
sqs_policy_allows_all_actions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SQS policy with public access
sqs_policy_with_public_access
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SQS queue exposed
sqs_queue_exposed
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SQS VPC endpoint without DNS resolution
sqs_vpc_endpoint_without_dns_resolution
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SQS with SSE disabled
sqs_with_sse_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SSM session transit encryption disabled
ssm_session_transit_encryption_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SSO identity user unsafe creation
sso_identity_user_unsafe_creation
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SSO permission with inadequate user session duration
sso_permission_with_inadequate_user_session_duration
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SSO policy with full privileges
sso_policy_with_full_privileges
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Stack notifications disabled
stack_notifications_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Stack retention disabled
stack_retention_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Stack without template
stack_without_template
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Team tag missing on AWS resource
team_tag_not_present
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Unknown port exposed to internet
unknown_port_exposed_to_internet
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Unrestricted security group ingress
unrestricted_security_group_ingress
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Unscanned ECR image
unscanned_ecr_image
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User data contains encoded private key
user_data_contains_encoded_private_key
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole'
user_with_privilege_escalation_by_actions_iam_PassRole_and_cloudformation_CreateStack
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'
user_with_privilege_escalation_by_actions_iam_PassRole_and_ec2_RunInstances
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole'
user_with_privilege_escalation_by_actions_iam_PassRole_and_glue_CreateDevEndpoint
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'glue:UpdateDevEndpoint'
user_with_privilege_escalation_by_actions_glue_UpdateDevEndpoint
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:AddUserToGroup'
user_with_privilege_escalation_by_actions_iam_AddUserToGroup
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:AttachGroupPolicy'
user_with_privilege_escalation_by_actions_iam_AttachGroupPolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:AttachRolePolicy'
user_with_privilege_escalation_by_actions_iam_AttachRolePolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:AttachUserPolicy'
user_with_privilege_escalation_by_actions_iam_AttachUserPolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:CreateAccessKey'
user_with_privilege_escalation_by_actions_iam_CreateAccessKey
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:CreateLoginProfile'
user_with_privilege_escalation_by_actions_iam_CreateLoginProfile
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:CreatePolicyVersion'
user_with_privilege_escalation_by_actions_iam_CreatePolicyVersion
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:PutGroupPolicy'
user_with_privilege_escalation_by_actions_iam_PutGroupPolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:PutRolePolicy'
user_with_privilege_escalation_by_actions_iam_PutRolePolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:PutUserPolicy'
user_with_privilege_escalation_by_actions_iam_PutUserPolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:SetDefaultPolicyVersion'
user_with_privilege_escalation_by_actions_iam_SetDefaultPolicyVersion
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole'
user_with_privilege_escalation_by_actions_iam_UpdateAssumeRolePolicy_and_sts_AssumeRole
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:UpdateLoginProfile'
user_with_privilege_escalation_by_actions_iam_UpdateLoginProfile
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction'
user_with_privilege_escalation_by_actions_iam_PassRole_and_lambda_CreateFunction_and_lambda_InvokeFunction
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'lambda:UpdateFunctionCode'
user_with_privilege_escalation_by_actions_lambda_UpdateFunctionCode
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg VPC default security group accepts all traffic
vpc_default_security_group_accepts_all_traffic
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg VPC Flow Logs disabled
vpc_flowlogs_disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg VPC peering route table with unrestricted CIDR
vpc_peering_route_table_with_unrestricted_cidr
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg VPC subnet assigns public IP
vpc_subnet_assigns_public_ip
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg VPC without Network Firewall
vpc_without_network_firewall
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Vulnerable default SSL certificate
vulnerable_default_ssl_certificate
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Workspaces workspace volume not encrypted
workspaces_workspace_volume_not_encrypted
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg AD admin not configured for SQL server
ad_admin_not_configured_for_sql_server
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Admin user enabled for container registry
admin_user_enabled_for_container_registry
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg AKS disk encryption set ID undefined
aks_disk_encryption_set_id_undefined
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg AKS network policy misconfigured
aks_network_policy_misconfigured
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg AKS private cluster disabled
aks_private_cluster_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg AKS RBAC disabled
aks_rbac_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg App Service authentication disabled
app_service_authentication_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg App Service FTPS enforce disabled
app_service_ftps_enforce_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg App Service HTTP2 disabled
app_service_http2_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg App Service managed identity disabled
app_service_managed_identity_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg App Service not using latest TLS encryption version
app_service_not_using_latest_tls_encryption_version
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg App Service without latest PHP version
app_service_without_latest_php_version
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg App Service without latest Python version
app_service_without_latest_python_version
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Azure Active Directory authentication
azure_active_directory_authentication
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Azure App Service client certificate disabled
azure_app_service_client_certificate_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Azure Cognitive Search public network access enabled
azure_cognitive_search_public_network_access_enabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Azure Container Registry with no locks
azure_container_registry_with_no_locks
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Azure Front Door WAF disabled
azure_front_door_waf_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Azure instance using basic authentication
azure_instance_using_basic_authentication
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Azure Policy Add-on Disabled in AKS Cluster
aks_uses_azure_policies_addon_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Cosmos DB account without tags
cosmos_db_account_without_tags
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg CosmosDB account IP range filter not set
cosmosdb_account_ip_range_filter_not_set
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Dashboard is enabled
dashboard_is_enabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Default Azure storage account network access is too permissive
default_azure_storage_account_network_access_is_too_permissive
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Email alerts disabled
email_alerts_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Encryption on managed disk disabled
encryption_on_managed_disk_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Ensure Azure MariaDB server is using latest TLS (1.2)
mariadb_not_using_latest_tls
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Ensure MySQL is using the latest version of TLS encryption
mysql_not_using_latest_tls
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Ensure that Azure cloud resource has a team tag
team_tag_not_present
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Ensure that PostgreSQL server disables public network access
postgres_sql_server_enables_public_access
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Ensure that UDP services are restricted from the Internet
udp_services_not_restricted_from_internet
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Ensure web app is not remotely debuggable
remote_debugging_enabled_app_service
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Firewall rule allows too many hosts to access Redis Cache
firewall_rule_allows_too_many_hosts_to_access_redis_cache
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Function App authentication disabled
function_app_authentication_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Function App client certificates not required
function_app_client_certificates_unrequired
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Function App FTPS enforce disabled
function_app_ftps_enforce_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Function App HTTP2 disabled
function_app_http2_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Function App managed identity disabled
function_app_managed_identity_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Function App not using latest TLS encryption version
function_app_not_using_latest_tls_encryption_version
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Geo redundancy is disabled
geo_redundancy_is_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Key expiration not set
key_expiration_not_set
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Key Vault secrets content type undefined
key_vault_secrets_content_type_undefined
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Log retention is not set
log_retention_is_not_set
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg MariaDB server geo-redundant backup disabled
mariadb_server_georedundant_backup_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg MariaDB server public network access enabled
mariadb_public_network_access_enabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg MSSQL server auditing disabled
mssql_server_auditing_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg MSSQL server public network access enabled
mssql_server_public_network_access_enabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg MySQL server public access enabled
mysql_server_public_access_enabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg MySQL SSL connection disabled
mysql_ssl_connection_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Network interfaces IP forwarding enabled
network_interfaces_ip_forwarding_enabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Network interfaces with public IP
network_interfaces_with_public_ip
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Network watcher flow disabled
network_watcher_flow_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg PostgreSQL log checkpoints disabled
postgresql_log_checkpoints_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg PostgreSQL log connections not set
postgresql_log_connections_not_set
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg PostgreSQL log disconnections not set
postgresql_log_disconnections_not_set
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg PostgreSQL log duration not set
postgresql_log_duration_not_set
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg PostgreSQL server infrastructure encryption disabled
postgresql_server_infrastructure_encryption_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg PostgreSQL Server threat detection policy disabled
postgresql_server_threat_detection_policy_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg PostgreSQL server without connection throttling
postgresql_server_without_connection_throttling
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Public storage account
public_storage_account
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg RDP is exposed to the internet
rdp_is_exposed_to_the_internet
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Redis cache allows non SSL connections
redis_cache_allows_non_ssl_connections
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Redis entirely accessible
redis_entirely_accessible
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Redis not updated regularly
redis_not_updated_regularly
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Redis publicly accessible
redis_publicly_accessible
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Role assignment not limit guest user permissions
role_assignment_not_limit_guest_users_permissions
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Role definition allows custom role creation
role_definition_allows_custom_role_creation
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Secret expiration not set
secret_expiration_not_set
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Security center pricing tier is not standard
security_center_pricing_tier_is_not_standard
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Security contact email
security_contact_email
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Security group is not configured
security_group_is_not_configured
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Sensitive port is exposed to entire network
sensitive_port_is_exposed_to_entire_network
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Sensitive port is exposed to small public network
sensitive_port_is_exposed_to_small_public_network
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Sensitive port is exposed to wide private network
sensitive_port_is_exposed_to_wide_private_network
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Small activity log retention period
small_activity_log_retention_period
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Small flow logs retention period
small_flow_logs_retention_period
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Small MSSQL audit retention period
small_mssql_audit_retention_period
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Small MSSQL server audit retention
small_msql_server_audit_retention
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Small PostgreSQL DB server log retention period
small_postgresql_db_server_log_retention_period
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg SQL database audit disabled
sql_database_audit_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg SQL server alert email disabled
sql_server_alert_email_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg SQL server auditing disabled
sql_server_auditing_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg SQL server predictable Active Directory admin account name
sql_server_predictable_active_directory_admin_account_name
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg SQL server predictable admin account name
sql_server_predictable_admin_account_name
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Sqlserver ingress from any IP
sql_server_ingress_from_any_ip
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg SSH is exposed to the Internet
ssh_is_exposed_to_the_internet
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg SSL enforce disabled
ssl_enforce_is_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg ssl_enforcement_enabled is not set to ENABLED for MySQL database server
mysql_enforce_ssl_connection_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg ssl_enforcement_enabled is not set to ENABLED for PostgreSQL database server
postgres_enforce_ssl_connection_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Storage account not forcing HTTPS
storage_account_not_forcing_https
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Storage account not using latest TLS encryption version
storage_account_not_using_latest_tls_encryption_version
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Storage container is publicly accessible
storage_container_is_publicly_accessible
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Storage share file allows all ACL permissions
storage_share_file_allows_all_acl_permissions
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Storage table allows all ACL permissions
storage_table_allows_all_acl_permissions
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Trusted Microsoft services not enabled
trusted_microsoft_services_not_enabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Unrestricted SQL server access
unrestricted_sql_server_access
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Vault auditing disabled
vault_auditing_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Virtual network with DDoS protection plan disabled
virtual_network_with_ddos_protection_plan_disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg VM not attached to network
vm_not_attached_to_network
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg WAF is disabled for Azure application gateway
waf_is_disabled_for_azure_application_gateway
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Web app accepting traffic other than HTTPS
web_app_accepting_traffic_other_than_https
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Artifact Registry repo is public
artifact_registry_repository_is_public
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg BigQuery dataset is public
bigquery_dataset_is_public
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg BigQuery table is public
bigquery_table_is_public
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud DNS without DNSSEC
cloud_dns_without_dnssec
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud KMS key ring is anonymously or publicly accessible
cloud_kms_key_rings_are_public
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud Run service is public
cloud_run_service_is_public
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud Storage bucket is publicly accessible
cloud_storage_bucket_is_publicly_accessible
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud Storage bucket logging not enabled
cloud_storage_bucket_logging_not_enabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud Storage bucket versioning disabled
cloud_storage_bucket_versioning_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud Storage is anonymous or publicly accessible
cloud_storage_anonymous_or_publicly_accessible
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cluster labels disabled
cluster_labels_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Container Registry repo is public
container_registry_repository_is_public
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg COS node image not used
cos_node_image_not_used
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Dataproc clusters has public IPs
dataproc_cluster_has_public_ip
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Dataproc clusters publicly accessible
dataproc_clusters_is_public
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Disk encryption disabled
disk_encryption_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg DNSSEC using RSASHA1
dnssec_using_rsasha1
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Ensure legacy networks do not exist for a project
legacy_networks_exist_for_project
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Ensure SQL database instance has skip show database flag
sql_database_instance_does_not_have_skip_show_database
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg GKE control plane is public
gke_control_plane_is_public
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg GKE legacy authorization enabled
gke_legacy_authorization_enabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg GKE using default service account
gke_using_default_service_account
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute firewall ingress allows unrestricted FTP access
firewall_ingress_allows_unrestricted_ftp_access
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute firewall ingress allows unrestricted MySQL access
firewall_ingress_allows_unrestricted_mysql_access
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute network using default firewall rule
google_compute_network_using_default_firewall_rule
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute network using firewall rule that allows all ports
google_compute_network_using_firewall_rule_allows_all_ports
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute network using firewall rule that allows port range
google_compute_network_using_firewall_rule_allows_port_range
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute SSL policy weak cipher in use
google_compute_ssl_policy_weak_cipher_in_use
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute subnetwork logging disabled
google_compute_subnetwork_logging_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute subnetwork with private Google access disabled
google_compute_subnetwork_with_private_google_access_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Container node pool auto repair disabled
google_container_node_pool_auto_repair_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google project auto create network disabled
google_project_auto_create_network_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google project IAM binding service account has token creator or account user role
google_project_iam_binding_service_account_has_token_creator_or_account_user_role
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google project IAM member service account has admin role
google_project_iam_member_service_account_has_admin_role
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google project IAM member service account has token creator or account user role
google_project_iam_member_service_account_has_token_creator_or_account_user_role
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Storage bucket level access disabled
google_storage_bucket_level_access_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg High Google KMS crypto key rotation period
high_google_kms_crypto_key_rotation_period
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg IAM audit not properly configured
iam_audit_not_properly_configured
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg IP aliasing disabled
ip_aliasing_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg IP forwarding enabled
ip_forwarding_enabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg KMS admin and CryptoKey roles in use
kms_admin_and_crypto_key_roles_in_use
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg KMS CryptoKey is publicly accessible
kms_crypto_key_publicly_accessible
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Legacy client certificate auth enabled
legacy_client_certificate_auth_enabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Network policy disabled
network_policy_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Node auto upgrade disabled
node_auto_upgrade_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Not proper email account in use
not_proper_email_account_in_use
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg OSLogin disabled
os_login_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg OSLogin is disabled for VM instance
os_login_is_disabled_for_vm_instance
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Outdated GKE version
outdated_gke_version
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Pod security policy disabled
pod_security_policy_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Private cluster disabled
private_cluster_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Project-wide SSH keys are enabled in VM instances
project_wide_ssh_keys_are_enabled_in_vm_instances
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Pub/Sub Topics are anonymously or publicly accessible
pubsub_topic_is_public
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg RDP access is not restricted
rdp_access_is_not_restricted
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Serial ports are enabled for VM instances
vm_serial_ports_are_enabled_for_vm_instances
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Service account with improper privileges
service_account_with_improper_privileges
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Shielded GKE nodes disabled
shielded_gke_nodes_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Shielded VM disabled
shielded_vm_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg SQL DB instance backup disabled
sql_db_instance_backup_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg SQL DB instance publicly accessible
sql_db_instance_is_publicly_accessible
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg SQL DB instance with SSL disabled
sql_db_instance_with_ssl_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg SQL Server cross DB ownership chaining enabled
sql_database_has_cross_db_ownership_chaining
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg SSH access is not restricted
ssh_access_is_not_restricted
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Stackdriver Logging disabled
stackdriver_logging_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Stackdriver Monitoring disabled
stackdriver_monitoring_disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Team label missing on GCP resource
team_label_not_present
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg There are non GCP-managed service account keys for a service account
service_has_non_gcp_managed_service_account_keys
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg User with IAM role
user_with_iam_role
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Using default service account
using_default_service_account
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg VM with full cloud access
vm_with_full_cloud_access
>

Further Reading

お役に立つドキュメント、リンクや記事:

Set up IaC SecurityDOCUMENTATION more more Configure IaC Security ExclusionsDOCUMENTATION more more