IaC 보안 규칙

이 제품은 선택한 Datadog 사이트()에서 지원되지 않습니다.

인프라 코드(IaC) 보안은 배포 전에 IaC 파일에서 잘못된 구성 및 보안 위험을 식별하여 클라우드 환경이 안전하고 규정을 준수하도록 보장합니다.

Helm 의 의존성 해결이 올바르게 작동하려면, 각 차트 디렉토리에는 해당 차트가 의존하는 차트가 포함되어야 합니다. 자세한 내용은 Helm 문서의 차트 파일 구조를 참조하세요.

추가 자료

추가 유용한 문서, 링크 및 기사:

IaC 보안 설정설명서 more more IaC 보안 구성설명서 more more
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ALB listening on HTTP
ansible-aws-alb-listening-on-http
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg AMI not encrypted
ansible-aws-ami-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg AMI shared with multiple accounts
ansible-aws-ami-shared-with-multiple-accounts
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway endpoint config is not private
ansible-aws-api-gateway-endpoint-config-is-not-private
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway with CloudWatch Logs disabled
ansible-aws-api-gateway-with-cloudwatch-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway without configured authorizer
ansible-aws-api-gateway-without-configured-authorizer
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway without SSL certificate
ansible-aws-api-gateway-without-ssl-certificate
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway without WAF
ansible-aws-api-gateway-without-waf
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway X-Ray disabled
ansible-aws-api-gateway-xray-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Authentication without MFA
ansible-aws-authentication-without-mfa
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Auto Scaling Group with no associated ELB
ansible-aws-auto-scaling-group-with-no-associated-elb
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Automatic minor upgrades disabled
ansible-aws-automatic-minor-upgrades-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg AWS password policy with unchangeable passwords
ansible-aws-aws-password-policy-with-unchangeable-passwords
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Batch job definition with privileged container properties
ansible-aws-batch-job-definition-with-privileged-container-properties
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CA certificate identifier is outdated
ansible-aws-ca-certificate-identifier-is-outdated
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CDN configuration is missing
ansible-aws-cdn-configuration-is-missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Certificate has expired
ansible-aws-certificate-has-expired
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Certificate RSA key bytes lower than 256
ansible-aws-certificate-rsa-key-bytes-lower-than-256
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudFront logging disabled
ansible-aws-cloudfront-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudFront viewer protocol policy allows HTTP
ansible-aws-viewer-protocol-policy-allows-http
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudFront without minimum protocol TLS 1.2
ansible-aws-cloudfront-without-minimum-protocol-tls-1-2
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudFront without WAF
ansible-aws-cloudfront-without-waf
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail log file validation disabled
ansible-aws-cloudtrail-log-file-validation-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail log files not encrypted with KMS
ansible-aws-cloudtrail-log-files-not-encrypted-with-kms
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail logging disabled
ansible-aws-cloudtrail-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail multi-region is disabled
ansible-aws-cloudtrail-multi-region-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail not integrated with CloudWatch
ansible-aws-cloudtrail-not-integrated-with-cloudwatch
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail SNS topic name undefined
ansible-aws-cloudtrail-sns-topic-name-undefined
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch without retention period specified
ansible-aws-cloudwatch-without-retention-period-specified
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CMK is unusable
ansible-aws-cmk-is-unusable
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CMK rotation disabled
ansible-aws-cmk-rotation-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CodeBuild project is not encrypted
ansible-aws-codebuild-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Config rule for encrypted volumes disabled
ansible-aws-config-rule-for-encrypted-volumes-is-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Configuration aggregator to all regions disabled
ansible-aws-config-configuration-aggregator-to-all-regions-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Cross-account IAM assume role policy without ExternalId or MFA
ansible-aws-cross-account-iam-assume-role-policy-without-external-id-or-mfa
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DB instance storage not encrypted
ansible-aws-db-instance-storage-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DB security group open to large scope
ansible-aws-db-security-group-open-to-large-scope
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DB security group with public scope
ansible-aws-db-security-group-with-public-scope
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Default security groups with unrestricted traffic
ansible-aws-default-security-groups-with-unrestricted-traffic
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EBS volume encryption disabled
ansible-aws-ebs-volume-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 instance has public IP
ansible-aws-ec2-instance-has-public-ip
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 instance is not EBS optimized
ansible-aws-ec2-not-ebs-optimized
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 instance using default security group
ansible-aws-ec2-instance-using-default-security-group
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 instance using default VPC
ansible-aws-ec2-instance-using-default-vpc
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 security group allows public access
ansible-aws-ec2-group-has-public-interface
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECR image tag not immutable
ansible-aws-ecr-image-tag-not-immutable
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECR repository is publicly accessible
ansible-aws-ecr-repository-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS service admin role is present
ansible-aws-ecs-service-admin-role-is-present
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS service without running tasks
ansible-aws-ecs-service-without-running-tasks
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS services should not be assigned public IP addresses
ansible-aws-ecs-services-assigned-with-public-ip-address
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS task definition network mode not recommended
ansible-aws-ecs-task-definition-network-mode-not-recommended
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EFS not encrypted
ansible-aws-efs-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EFS without KMS
ansible-aws-efs-without-kms
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EFS without tags
ansible-aws-efs-without-tags
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ElastiCache using default port
ansible-aws-elasticache-using-default-port
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ElastiCache without VPC
ansible-aws-elasticache-without-vpc
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch with HTTPS disabled
ansible-aws-elasticsearch-with-https-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ELB using insecure protocols
ansible-aws-elb-using-insecure-protocols
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ELB using weak ciphers
ansible-aws-elb-using-weak-ciphers
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Hardcoded AWS access key
ansible-aws-hardcoded-aws-access-key
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Hardcoded AWS access key in Lambda
ansible-aws-hardcoded-aws-access-key-in-lambda
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg HTTP port open to internet
ansible-aws-http-port-open-to-internet
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM access key is exposed
ansible-aws-iam-access-key-is-exposed
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM database authentication is not enabled
ansible-aws-iam-database-auth-not-enabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM group without users
ansible-aws-iam-group-without-users
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM password without minimum length
ansible-aws-iam-password-without-minimum-length
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM policies attached to user
ansible-aws-iam-policies-attached-to-user
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM policies with full privileges
ansible-aws-iam-policies-with-full-privileges
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM policy grants 'AssumeRole' permission across all services
ansible-aws-iam-policy-grants-assumerole-permission-across-all-services
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM policy grants full permissions
ansible-aws-iam-policy-grants-full-permissions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM role allows all principals to assume
ansible-aws-iam-role-allows-all-principals-to-assume
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Instance uses metadata service IMDSv1
ansible-aws-instance-uses-metadata-service-imdsv1
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Instance with no VPC
ansible-aws-instance-with-no-vpc
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Kinesis not encrypted with KMS
ansible-aws-kinesis-not-encrypted-with-kms
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg KMS key with vulnerable policy
ansible-aws-kms-key-with-full-permissions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda function without tags
ansible-aws-lambda-function-without-tags
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda functions without X-Ray tracing
ansible-aws-lambda-functions-without-x-ray-tracing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda permission misconfigured
ansible-aws-lambda-permission-misconfigured
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda permission principal is wildcard
ansible-aws-lambda-permission-principal-is-wildcard
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Launch configuration is not encrypted
ansible-aws-launch-configuration-is-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Misconfigured password policy expiration
ansible-aws-misconfigured-password-policy-expiration
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg No stack policy
ansible-aws-no-stack-policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Password without reuse prevention
ansible-aws-password-without-reuse-prevention
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Public Lambda via API Gateway
ansible-aws-public-lambda-via-api-gateway
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Public port with wide port range
ansible-aws-public-port-wide
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS DB instance is not publicly accessible
ansible-aws-rds-db-instance-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS instance associated with a public subnet
ansible-aws-rds-associated-with-public-subnet
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS instance uses a default port
ansible-aws-rds-using-default-port
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS instance with backup disabled
ansible-aws-rds-with-backup-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redis not compliant
ansible-aws-redis-not-compliant
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redshift cluster is not encrypted
ansible-aws-redshift-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redshift publicly accessible
ansible-aws-redshift-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redshift using default port
ansible-aws-redshift-using-default-port
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Remote desktop port open to internet
ansible-aws-remote-desktop-port-open
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Root account has active access keys
ansible-aws-root-account-has-active-access-keys
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Route 53 record undefined
ansible-aws-route53-record-undefined
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket access to any principal
ansible-aws-s3-bucket-access-to-any-principal
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket ACL allows read access to all users
ansible-aws-s3-bucket-acl-allows-read-to-all-users
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket ACL allows read access to any authenticated user
ansible-aws-s3-bucket-acl-allows-read-to-any-authenticated-user
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows delete action from all principals
ansible-aws-s3-bucket-allows-delete-action-from-all-principals
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows GET action from all principals
ansible-aws-s3-bucket-allows-get-action-from-all-principals
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows list action from all principals
ansible-aws-s3-bucket-allows-list-action-from-all-principals
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows put action from all principals
ansible-aws-s3-bucket-allows-put-action-from-all-principals
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket logging disabled
ansible-aws-s3-bucket-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket with all permissions
ansible-aws-s3-bucket-with-all-permissions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket with public access
ansible-aws-s3-bucket-with-public-access
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket with unsecured CORS rule
ansible-aws-s3-bucket-with-unsecured-cors-rule
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket without server-side encryption
ansible-aws-s3-bucket-without-server-side-encryption
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket without versioning
ansible-aws-s3-bucket-without-versioning
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Secure ciphers disabled
ansible-aws-secure-ciphers-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security group ingress not restricted
ansible-aws-security-group-ingress-not-restricted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security group with unrestricted access to SSH
ansible-aws-security-group-with-unrestricted-access-to-ssh
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SES policy with allowed IAM actions
ansible-aws-ses-policy-with-allowed-iam-actions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SNS topic is publicly accessible
ansible-aws-sns-topic-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SQL Analysis Services port 2383 (TCP) is publicly accessible
ansible-aws-sql-analysis-services-port-2383-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SQS policy allows all actions
ansible-aws-sqs-policy-allows-all-actions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SQS policy with public access
ansible-aws-sqs-policy-with-public-access
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SQS queue exposed
ansible-aws-sqs-queue-exposed
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SQS queue with SSE disabled
ansible-aws-sqs-with-sse-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Stack notifications disabled
ansible-aws-stack-notifications-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Stack retention disabled
ansible-aws-stack-retention-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Stack without template
ansible-aws-stack-without-template
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Unknown port exposed to internet
ansible-aws-unknown-port-exposed-to-internet
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Unrestricted security group ingress
ansible-aws-unrestricted-security-group-ingress
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User data contains encoded private key
ansible-aws-user-data-contains-encoded-private-key
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Vulnerable default SSL certificate
ansible-aws-vulnerable-default-ssl-certificate
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg AD admin not configured for SQL server
ansible-azure-ad-admin-not-configured-for-sql-server
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Admin user enabled for container registry
ansible-azure-admin-user-enabled-for-container-registry
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg AKS monitoring logging disabled
ansible-azure-aks-monitoring-logging-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg AKS network policy misconfigured
ansible-azure-aks-network-policy-misconfigured
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg AKS RBAC disabled
ansible-azure-aks-rbac-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Azure Container Registry with no locks
ansible-azure-azure-container-registry-with-no-locks
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Azure instance using basic authentication
ansible-azure-azure-instance-using-basic-authentication
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Cosmos DB account without tags
ansible-azure-cosmosdb-account-without-tags
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg CosmosDB account IP range filter not set
ansible-azure-cosmosdb-account-ip-range-filter-not-set
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Default Azure storage account network access is too permissive
ansible-azure-default-azure-storage-account-network-access-is-too-permissive
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Firewall rule allows too many hosts to access Redis Cache
ansible-azure-firewall-rule-allows-too-many-hosts-to-access-redis-cache
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Key Vault soft delete is disabled
ansible-azure-key-vault-soft-delete-is-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Log retention is not set
ansible-azure-log-retention-is-not-set
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Monitoring log profile without all activities
ansible-azure-monitoring-log-profile-without-all-activities
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg MySQL SSL connection disabled
ansible-azure-mysql-ssl-connection-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg PostgreSQL log checkpoints disabled
ansible-azure-postgresql-log-checkpoints-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg PostgreSQL log connections not set
ansible-azure-postgresql-log-connections-not-set
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg PostgreSQL log disconnections not set
ansible-azure-postgresql-log-disconnections-not-set
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg PostgreSQL log duration not set
ansible-azure-postgresql-log-duration-not-set
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg PostgreSQL server without connection throttling
ansible-azure-postgresql-server-without-connection-throttling
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Public storage account
ansible-azure-public-storage-account
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Redis cache allows non-SSL connections
ansible-azure-redis-cache-allows-non-ssl-connections
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Redis entirely accessible
ansible-azure-redis-entirely-accessible
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Redis publicly accessible
ansible-azure-redis-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Role definition allows custom role creation
ansible-azure-role-definition-allows-custom-role-creation
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Security group is not configured
ansible-azure-security-group-is-not-configured
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Sensitive port is exposed to entire network
ansible-azure-sensitive-port-is-exposed-to-entire-network
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Small activity log retention period
ansible-azure-small-activity-log-retention-period
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg SQL Server predictable Active Directory account name
ansible-azure-sql-server-predictable-active-directory-admin-account-name
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg SQL Server predictable admin account name
ansible-azure-sql-server-predictable-admin-account-name
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg SQLServer ingress from any IP
ansible-azure-sql-server-ingress-from-any-ip
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg SSL enforce disabled
ansible-azure-ssl-enforce-is-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Storage account not forcing HTTPS
ansible-azure-storage-account-not-forcing-https
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Storage account not using latest TLS encryption version
ansible-azure-storage-account-not-using-latest-tls-encryption-version
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Storage container is publicly accessible
ansible-azure-storage-container-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Trusted Microsoft services not enabled
ansible-azure-trusted-microsoft-services-not-enabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Unrestricted SQL Server access
ansible-azure-unrestricted-sql-server-access
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg VM not attached to network
ansible-azure-vm-not-attached-to-network
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg WAF is disabled for Azure Application Gateway
ansible-azure-waf-is-disabled-for-azure-application-gateway
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Web app accepting traffic other than HTTPS
ansible-azure-web-app-accepting-traffic-other-than-https
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg BigQuery dataset is public
ansible-gcp-bigquery-dataset-is-public
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Client certificate disabled
ansible-gcp-client-certificate-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud DNS without DNSSEC
ansible-gcp-cloud-dns-without-dnssec
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud SQL instance with contained database authentication on
ansible-gcp-cloud-sql-instance-with-contained-database-authentication-on
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud SQL instance with cross DB ownership chaining on
ansible-gcp-cloud-sql-instance-with-cross-db-ownership-chaining-on
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud storage anonymous or publicly accessible
ansible-gcp-cloud-storage-anonymous-or-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud storage bucket logging not enabled
ansible-gcp-cloud-storage-bucket-logging-not-enabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud storage bucket versioning disabled
ansible-gcp-cloud-storage-bucket-versioning-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cluster labels disabled
ansible-gcp-cluster-labels-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cluster master authentication disabled
ansible-gcp-cluster-master-authentication-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Compute instance is publicly accessible
ansible-gcp-compute-instance-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg COS node image not used
ansible-gcp-cos-node-image-not-used
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Disk encryption disabled
ansible-gcp-disk-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg DNSSEC using RSASHA1
ansible-gcp-dnssec-using-rsasha1
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg GKE basic authentication enabled
ansible-gcp-gke-basic-authentication-enabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg GKE legacy authorization enabled
ansible-gcp-gke-legacy-authorization-enabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg GKE master authorized networks disabled
ansible-gcp-gke-master-authorized-networks-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg GKE using default service account
ansible-gcp-gke-using-default-service-account
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute network using default firewall rule
ansible-gcp-google-compute-network-using-default-firewall-rule
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute network using firewall rule that allows all ports
ansible-gcp-google-compute-network-using-firewall-rule-allows-all-ports
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute network using firewall rule that allows port range
ansible-gcp-google-compute-network-using-firewall-allows-port-range
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute SSL policy weak cipher in use
ansible-gcp-google-compute-ssl-policy-weak-cipher-in-use
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute subnetwork with Private Google Access disabled
ansible-gcp-google-compute-subnetwork-with-private-google-access-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google container node pool auto repair disabled
ansible-gcp-google-container-node-pool-auto-repair-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg High Google KMS crypto key rotation period
ansible-gcp-high-google-kms-crypto-key-rotation-period
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg IP aliasing disabled
ansible-gcp-ip-aliasing-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg IP forwarding enabled
ansible-gcp-ip-forwarding-enabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg MySQL instance with local infile on
ansible-gcp-mysql-instance-with-local-infile-on
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Network policy disabled
ansible-gcp-network-policy-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Node auto-upgrade disabled
ansible-gcp-node-auto-upgrade-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg OSLogin is disabled in VM instance
ansible-gcp-oslogin-is-disabled-for-vm-instance
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg PostgreSQL log connections disabled
ansible-gcp-postgresql-log-connections-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg PostgreSQL log_checkpoints flag not set to on
ansible-gcp-postgresql-log-checkpoints-flag-not-set-to-on
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg PostgreSQL logging of temporary files disabled
ansible-gcp-postgresql-logging-of-temporary-files-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg PostgreSQL misconfigured log messages flag
ansible-gcp-postgresql-misconfigured-log-messages-flag
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg PostgreSQL misconfigured logging duration flag
ansible-gcp-postgresql-misconfigured-logging-duration-flag
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Private cluster disabled
ansible-gcp-private-cluster-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Project-wide SSH keys are enabled in VM instances
ansible-gcp-project-wide-ssh-keys-are-enabled-in-vm-instances
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg RDP access is not restricted
ansible-gcp-rdp-access-is-not-restricted
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Serial ports are enabled for VM instances
ansible-gcp-serial-ports-enabled-for-vm-instances
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Shielded VM disabled
ansible-gcp-shielded-vm-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg SQL DB instance backup disabled
ansible-gcp-sql-db-instance-backup-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg SQL DB instance publicly accessible
ansible-gcp-sql-db-instance-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg SQL DB instance with SSL disabled
ansible-gcp-sql-db-instance-with-ssl-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg SSH access is not restricted
ansible-gcp-ssh-access-is-not-restricted
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Stackdriver logging disabled
ansible-gcp-stackdriver-logging-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Stackdriver monitoring disabled
ansible-gcp-stackdriver-monitoring-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Using default service account
ansible-gcp-using-default-service-account
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg VM with full cloud access
ansible-gcp-vm-with-full-cloud-access
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Anonymous definition
cicd-github-anonymous-definition
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Cache poisoning
cicd-github-cache-poisoning
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Concurrency limits
cicd-github-concurrency-limits
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Dangerous triggers
cicd-github-dangerous-triggers
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Dependabot cooldown
cicd-github-dependabot-cooldown
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Dependabot execution
cicd-github-dependabot-execution
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg GitHub environment file injection
cicd-github-github-env
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Hardcoded container credentials
cicd-github-hardcoded-container-credentials
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Misfeature
cicd-github-misfeature
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Obfuscation
cicd-github-obfuscation
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Overprovisioned secrets
cicd-github-overprovisioned-secrets
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Run block injection
cicd-github-run-block-injection
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Script block injection
cicd-github-script-block-injection
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Secrets inherit
cicd-github-secrets-inherit
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Secrets outside environment
cicd-github-secrets-outside-env
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Self-hosted runner
cicd-github-self-hosted-runner
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Superfluous actions
cicd-github-superfluous-actions
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Unpinned actions full length commit SHA
cicd-github-unpinned-actions-full-length-commit-sha
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Unpinned images
cicd-github-unpinned-images
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Unredacted secrets
cicd-github-unredacted-secrets
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Unsecured commands
cicd-github-unsecured-commands
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Unsound condition
cicd-github-unsound-conditions
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Unsound contains with controllable input
cicd-github-unsound-contains-with-controllable-input
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Unsound contains without controllable input
cicd-github-unsound-contains-no-controllable-input
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Unspecified workflows level permissions
cicd-github-unspecified-workflows-permissions
>
https://static.datadoghq.com/static/images/logos/github_avatar.svg Use trusted publishing for authentication
cicd-github-use-trusted-publishing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ALB is not integrated with WAF
cloudformation-aws-alb-is-not-integrated-with-waf
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ALB listening on HTTP
cloudformation-aws-alb-listening-on-http
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Alexa skill plaintext client secret exposed
cloudformation-aws-alexa-skill-plaintext-client-secret-exposed
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Amazon MQ broker encryption disabled
cloudformation-aws-amazon-mq-broker-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Amazon MQ broker is publicly accessible
cloudformation-aws-mq-broker-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Amazon MQ broker logging disabled
cloudformation-aws-mq-broker-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Amplify app access token exposed
cloudformation-aws-amplify-app-access-token-exposed
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Amplify app basic auth config password exposed
cloudformation-aws-amplify-app-basic-auth-config-password-exposed
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Amplify app OAuth token exposed
cloudformation-aws-amplify-app-oauth-token-exposed
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Amplify branch basic auth config password exposed
cloudformation-aws-amplify-branch-basic-auth-config-password-exposed
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway cache cluster disabled
cloudformation-aws-api-gateway-cache-cluster-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway cache encrypted disabled
cloudformation-aws-api-gateway-cache-encrypted-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway deployment without access log setting
cloudformation-aws-api-gateway-deployment-without-access-log-setting
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway deployment without usage plan associated
cloudformation-aws-api-gateway-deployment-without-api-gateway-usage-plan-associated
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway endpoint config is not private
cloudformation-aws-api-gateway-endpoint-config-is-not-private
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway method does not contain an API key
cloudformation-aws-api-gateway-method-does-not-contain-an-api-key
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway stage without usage plan associated
cloudformation-aws-api-gateway-stage-without-api-gateway-usage-plan-associated
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway V2 stage access logging settings not defined
cloudformation-aws-api-gateway-access-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway with invalid compression
cloudformation-aws-api-gateway-with-invalid-compression
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway with open access
cloudformation-aws-api-gateway-with-open-access
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway without configured authorizer
cloudformation-aws-api-gateway-without-configured-authorizer
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway without security policy
cloudformation-aws-api-gateway-without-security-policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway without SSL certificate
cloudformation-aws-api-gateway-without-ssl-certificate
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway without WAF
cloudformation-aws-api-gateway-without-waf
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway X-Ray disabled
cloudformation-aws-api-gateway-xray-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Auto Scaling group with no associated ELB
cloudformation-aws-auto-scaling-group-with-no-associated-elb
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Automatic minor upgrades disabled
cloudformation-aws-automatic-minor-upgrades-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg AWS DMS replication instance is publicly accessible
cloudformation-aws-amazon-dms-replication-instance-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Batch job definition with privileged container properties
cloudformation-aws-batch-job-definition-with-privileged-container-properties
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CDN configuration is missing
cloudformation-aws-cdn-configuration-is-missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudFormation metadata contains plaintext credentials
cloudformation-aws-cloudformation-specifying-credentials-not-safe
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudFront logging disabled
cloudformation-aws-cloudfront-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudFront viewer protocol policy allows HTTP
cloudformation-aws-cloudfront-viewer-protocol-policy-allows-http
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudFront without minimum protocol TLS 1.2
cloudformation-aws-cloudfront-without-minimum-protocol-tls-1-2
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudFront without WAF
cloudformation-aws-cloudfront-without-waf
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail log file validation disabled
cloudformation-aws-cloudtrail-log-file-validation-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail log files not encrypted with KMS
cloudformation-aws-cloudtrail-log-files-not-encrypted-with-kms
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail logging disabled
cloudformation-aws-cloudtrail-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail multi-region disabled
cloudformation-aws-cloudtrail-multi-region-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail not integrated with CloudWatch
cloudformation-aws-cloudtrail-not-integrated-with-cloudwatch
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail SNS topic name undefined
cloudformation-aws-cloudtrail-sns-topic-name-undefined
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch logging disabled
cloudformation-aws-cloudwatch-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch metrics disabled
cloudformation-aws-cloudwatch-metrics-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CMK is unusable
cloudformation-aws-cmk-is-unusable
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CMK rotation disabled
cloudformation-aws-cmk-rotation-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CMK unencrypted storage
cloudformation-aws-cmk-unencrypted-storage
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CodeBuild not encrypted
cloudformation-aws-codebuild-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Cognito user pool without MFA
cloudformation-aws-cognito-userpool-without-mfa
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Config rule for encrypted volumes disabled
cloudformation-aws-config-rule-for-encryption-volumes-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Configuration aggregator to all regions disabled
cloudformation-aws-config-configuration-aggregator-to-all-regions-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Connection between CloudFront origin not encrypted
cloudformation-aws-connection-between-cloudfront-origin-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Cross-account IAM assume role policy without external ID or MFA
cloudformation-aws-cross-account-iam-assume-role-policy-without-external-id-or-mfa
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DB security group open to large scope
cloudformation-aws-db-security-group-open-to-large-scope
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DB security group with public scope
cloudformation-aws-db-security-group-with-public-scope
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Default KMS key usage
cloudformation-aws-default-kms-key-usage
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Default security groups with unrestricted traffic
cloudformation-aws-default-security-groups-with-unrestricted-traffic
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Directory service Microsoft AD password set to plaintext or default ref
cloudformation-aws-directory-service-microsoft-ad-password-set-to-plaintext-or-default-ref
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Directory service simple AD password exposed
cloudformation-aws-directory-service-simple-ad-password-exposed
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DMS endpoint MongoDB settings password exposed
cloudformation-aws-dms-endpoint-mongo-db-settings-password-exposed
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DMS endpoint password exposed
cloudformation-aws-dms-endpoint-password-exposed
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DocDB cluster master password in plaintext
cloudformation-aws-docdb-cluster-master-password-in-plaintext
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DocDB logging is disabled
cloudformation-aws-docdb-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DynamoDB table not encrypted
cloudformation-aws-dynamodb-table-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DynamoDB table point-in-time recovery disabled
cloudformation-aws-dynamodb-table-point-in-time-recovery-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DynamoDB with AWS-owned CMK
cloudformation-aws-dynamodb-with-aws-owned-cmk
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DynamoDB with non-recommended table billing mode
cloudformation-aws-dynamodb-with-table-billing-mode-not-recommended
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EBS volume encryption disabled
cloudformation-aws-ebs-volume-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EBS volume not attached to instances
cloudformation-aws-ebs-volume-not-attached-to-instances
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EBS volume without KmsKeyId
cloudformation-aws-ebs-volume-without-kms-key-id
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 instance has no IAM role
cloudformation-aws-ec2-instance-has-no-iam-role
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 instance monitoring disabled
cloudformation-aws-ec2-instance-monitoring-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 instance subnet has public IP mapping on launch
cloudformation-aws-ec2-instance-subnet-has-public-ip-mapping-on-launch
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 instance using default security group
cloudformation-aws-ec2-instance-using-default-security-group
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 instance using default VPC
cloudformation-aws-ec2-instance-using-default-vpc
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 Network ACL Deny rule not blocking all traffic
cloudformation-aws-ec2-network-acl-ineffective-denied-traffic
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 network ACL duplicate rule
cloudformation-aws-ec2-network-acl-duplicate-rule
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 network ACL overlapping ports
cloudformation-aws-ec2-network-acl-overlapping-ports
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 not EBS optimized
cloudformation-aws-ec2-not-ebs-optimized
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 permissive network ACL protocols
cloudformation-aws-ec2-permissive-network-acl-protocols
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 public instance exposed through subnet
cloudformation-aws-ec2-public-instance-exposed-through-subnet
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 sensitive port is publicly exposed
cloudformation-aws-ec2-sensitive-port-is-publicly-exposed
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECR image tag not immutable
cloudformation-aws-ecr-image-tag-not-immutable
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECR repository is publicly accessible
cloudformation-aws-ecr-repository-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS cluster not encrypted at rest
cloudformation-aws-ecs-cluster-not-encrypted-at-rest
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS cluster with Container Insights disabled
cloudformation-aws-ecs-cluster-container-insights-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS no load balancer attached
cloudformation-aws-ecs-no-load-balancer-attached
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS service admin role is present
cloudformation-aws-ecs-service-admin-role-is-present
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS service without running tasks
cloudformation-aws-ecs-service-without-running-tasks
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS task definition health check missing
cloudformation-aws-ecs-task-definition-healthcheck-missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS task definition invalid CPU or memory
cloudformation-aws-ecs-task-definition-invalid-cpu-or-memory
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS task definition network mode not recommended
cloudformation-aws-ecs-task-definition-network-mode-not-recommended
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EFS not encrypted
cloudformation-aws-efs-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EFS volume with disabled transit encryption
cloudformation-aws-efs-volume-with-disabled-transit-encryption
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EFS without KMS
cloudformation-aws-efs-without-kms
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EFS without tags
cloudformation-aws-efs-without-tags
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EKS node group remote access
cloudformation-aws-eks-node-group-remote-access
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ElastiCache nodes not created across multi-AZ
cloudformation-aws-elasticache-nodes-not-created-across-multi-az
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ElastiCache using default port
cloudformation-aws-elasticache-using-default-port
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ElastiCache with disabled at-rest encryption
cloudformation-aws-elasticache-with-disabled-at-rest-encryption
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ElastiCache with disabled transit encryption
cloudformation-aws-elasticache-with-disabled-transit-encryption
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ElastiCache without VPC
cloudformation-aws-elasticache-without-vpc
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch encryption with KMS disabled
cloudformation-aws-elasticsearch-domain-encryption-with-kms-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch logs disabled
cloudformation-aws-elasticsearch-logs-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch not encrypted at rest
cloudformation-aws-elasticsearch-not-encrypted-at-rest
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch with HTTPS disabled
cloudformation-aws-elasticsearch-with-https-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch without IAM authentication
cloudformation-aws-elasticsearch-without-iam-authentication
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch without slow logs
cloudformation-aws-elasticsearch-without-slow-logs
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ELB access log disabled
cloudformation-aws-elb-access-log-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ELB sensitive port is exposed to entire network
cloudformation-aws-elb-sensitive-port-is-exposed-to-entire-network
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ELB using insecure protocols
cloudformation-aws-elb-using-insecure-protocols
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ELB using weak ciphers
cloudformation-aws-elb-using-weak-ciphers
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ELB with security group without inbound rules
cloudformation-aws-elb-with-security-group-without-inbound-rules
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ELB with security group without outbound rules
cloudformation-aws-elb-with-security-group-without-outbound-rules
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ELB without secure protocol
cloudformation-aws-elb-without-secure-protocol
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ELBv2 ALB access log disabled
cloudformation-aws-elb-v2-alb-access-log-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Empty roles for ECS cluster task definitions
cloudformation-aws-empty-roles-for-ecs-cluster-task-definitions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EMR cluster without security configuration
cloudformation-aws-emr-cluster-without-security-configuration
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EMR security configuration encryption disabled
cloudformation-aws-emr-security-configuration-encryptions-enabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EMR without VPC
cloudformation-aws-emr-wihout-vpc
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Fully open ingress
cloudformation-aws-fully-open-ingress
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg GameLift fleet EC2 inbound permissions with port range
cloudformation-aws-gamelift-fleet-ec2-inbound-permissions-with-port-range
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Geo restriction disabled
cloudformation-aws-geo-restriction-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg GitHub repository set to public
cloudformation-aws-github-repository-set-to-public
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg GuardDuty detector disabled
cloudformation-aws-guardduty-detector-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Hardcoded AWS access key in Lambda
cloudformation-aws-hardcoded-aws-access-key-in-lambda
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg High access key rotation period
cloudformation-aws-access-key-not-rotated-within-90-days
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg HTTP port open to internet
cloudformation-aws-http-port-open
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM Access Analyzer not enabled
cloudformation-aws-iam-access-analyzer-not-enabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM database auth not enabled
cloudformation-aws-iam-database-auth-not-enabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM group inline policies
cloudformation-aws-iam-groups-inline-policies
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM group without users
cloudformation-aws-iam-group-without-users
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM managed policy applied to a user
cloudformation-aws-iam-managed-policy-applied-to-a-user
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM password without minimum length
cloudformation-aws-iam-password-without-minimum-length
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM policies attached to a user
cloudformation-aws-iam-policies-attached-to-user
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM policies with full privileges
cloudformation-aws-iam-policies-with-full-privileges
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM policies without groups
cloudformation-aws-iam-policies-without-groups
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM policy grants AssumeRole permission across all services
cloudformation-aws-iam-policy-grants-assumerole-permission-across-all-services
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM policy grants full permissions
cloudformation-aws-iam-policy-grants-full-permissions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM policy on user
cloudformation-aws-iam-policy-on-user
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM role allows all principals to assume
cloudformation-aws-iam-role-allows-all-principals-to-assume
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM user has too many access keys
cloudformation-aws-iam-user-too-many-access-keys
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM user LoginProfile password is in plaintext
cloudformation-aws-iam-user-login-profile-password-is-in-plaintext
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM user with no group
cloudformation-aws-iam-user-with-no-group
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM user without password reset
cloudformation-aws-user-iam-missing-password-reset-required
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Inline policies are attached to an ECS service
cloudformation-aws-inline-policies-are-attached-to-ecs-service
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Instance with no VPC
cloudformation-aws-instance-with-no-vpc
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IoT policy allows a wildcard resource
cloudformation-aws-iot-policy-allows-wildcard-resource
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IoT policy allows action as a wildcard
cloudformation-aws-iot-policy-allows-action-as-wildcard
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Kinesis SSE not configured
cloudformation-aws-kinesis-sse-not-configured
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg KMS allows a wildcard principal
cloudformation-aws-kms-allows-wildcard-principal
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg KMS key rotation disabled
cloudformation-aws-kms-enable-key-rotation-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg KMS key with a vulnerable policy
cloudformation-aws-kms-key-with-full-permissions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda function without dead-letter queue
cloudformation-aws-lambda-function-without-dead-letter-queue
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda function without tags
cloudformation-aws-lambda-function-without-tags
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda functions with full privileges
cloudformation-aws-lambda-functions-with-full-privileges
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda functions without unique IAM roles
cloudformation-aws-lambda-functions-without-unique-iam-roles
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda functions without X-Ray tracing
cloudformation-aws-lambda-functions-without-x-ray-tracing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda permission misconfigured
cloudformation-aws-lambda-permission-misconfigured
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda permission principal is a wildcard
cloudformation-aws-lambda-permission-principal-is-wildcard
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Low RDS backup retention period
cloudformation-aws-low-rds-backup-retention-period
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg MSK broker is publicly accessible
cloudformation-aws-msk-broker-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg MSK cluster encryption disabled
cloudformation-aws-msk-cluster-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg MSK cluster logging disabled
cloudformation-aws-msk-cluster-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Neptune cluster with IAM database authentication disabled
cloudformation-aws-neptune-cluster-with-iam-database-authentication-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Neptune database cluster encryption disabled
cloudformation-aws-neptune-database-cluster-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Permissive Web ACL default action
cloudformation-aws-webacl-allow-defaultaction
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Public Lambda function via API Gateway
cloudformation-aws-public-lambda-via-api-gateway
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS associated with a public subnet
cloudformation-aws-rds-associated-with-public-subnet
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS DB instance publicly accessible
cloudformation-aws-rds-db-instance-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS DB instance with deletion protection disabled
cloudformation-aws-rds-db-instance-with-deletion-protection-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS Multi-AZ deployment disabled
cloudformation-aws-rds-multi-az-deployment-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS storage encryption disabled
cloudformation-aws-rds-storage-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS storage not encrypted
cloudformation-aws-rds-storage-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS using default port
cloudformation-aws-rds-using-default-port
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS with backup disabled
cloudformation-aws-rds-with-backup-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redshift cluster logging disabled
cloudformation-aws-redshift-cluster-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redshift cluster without a KMS CMK
cloudformation-aws-redshift-cluster-without-kms-cmk
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redshift not encrypted
cloudformation-aws-redshift-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redshift publicly accessible
cloudformation-aws-redshift-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redshift using default port
cloudformation-aws-redshift-using-default-port
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Refresh token is exposed
cloudformation-aws-refresh-token-is-exposed
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Remote Desktop port open to the internet
cloudformation-aws-remote-desktop-port-open-to-internet
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Root account has active access keys
cloudformation-aws-root-account-has-active-access-keys
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Route table with default routing
cloudformation-aws-routertable-with-default-routing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Route53 record undefined
cloudformation-aws-route53-record-undefined
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket access to any principal
cloudformation-aws-s3-bucket-access-to-any-principal
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket ACL allows read or write to all users
cloudformation-aws-s3-bucket-acl-allows-read-or-write-to-all-users
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket ACL allows read to all users
cloudformation-aws-s3-bucket-acl-allows-read-to-all-users
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket ACL allows read to any authenticated user
cloudformation-aws-s3-bucket-acl-allows-read-to-any-authenticated-user
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows delete action from all principals
cloudformation-aws-s3-bucket-allows-delete-actions-from-all-principals
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows get action from all principals
cloudformation-aws-s3-bucket-allows-get-actions-from-all-principals
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows list action from all principals
cloudformation-aws-s3-bucket-allows-list-actions-from-all-principals
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows public ACL
cloudformation-aws-s3-bucket-allows-public-acl
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows public policy
cloudformation-aws-s3-bucket-with-public-policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows put action from all principals
cloudformation-aws-s3-bucket-allows-put-actions-from-all-principals
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows restore actions from all principals
cloudformation-aws-s3-bucket-allows-restore-actions-from-all-principals
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket CloudTrail logging disabled
cloudformation-aws-s3-bucket-cloudtrail-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket logging disabled
cloudformation-aws-s3-bucket-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket should have bucket policy
cloudformation-aws-s3-bucket-should-have-bucket-policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket with all permissions
cloudformation-aws-s3-bucket-with-all-permissions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket with unsecured CORS rule
cloudformation-aws-s3-bucket-with-unsecured-cors-rule
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket without ignore public ACL
cloudformation-aws-s3-bucket-without-ignore-public-acl
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket without restriction of public bucket
cloudformation-aws-s3-bucket-without-restriction-of-public-bucket
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket without server-side encryption
cloudformation-aws-s3-bucket-without-server-side-encryption
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket without SSL in write actions
cloudformation-aws-s3-bucket-without-ssl-in-write-actions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket without versioning
cloudformation-aws-s3-bucket-without-versioning
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 static website host enabled
cloudformation-aws-s3-static-website-host-enabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SageMaker data encryption disabled
cloudformation-aws-sagemaker-data-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SageMaker enabling internet access
cloudformation-aws-sagemaker-enabling-internet-access
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SageMaker endpoint config should specify KmsKeyId attribute
cloudformation-aws-sagemaker-endpoint-config-should-specify-kms-key-id-attribute
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SageMaker notebook not placed in VPC
cloudformation-aws-sagemaker-notebook-not-placed-in-vpc
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SDB domain declared as a resource
cloudformation-aws-sdb-domain-declared-as-a-resource
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Secrets manager should specify KmsKeyId
cloudformation-aws-secrets-manager-should-specify-kms-key-id
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Secure ciphers disabled
cloudformation-aws-secure-ciphers-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security group egress CIDR open to world
cloudformation-aws-security-group-egress-cidr-open-to-world
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security group egress with all protocols
cloudformation-aws-security-group-egress-with-all-protocols
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security group egress with port range
cloudformation-aws-security-group-egress-with-port-range
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security group ingress has CIDR not recommended
cloudformation-aws-security-group-ingress-has-cidr-not-recommended
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security group ingress with all protocols
cloudformation-aws-security-group-ingress-with-all-protocols
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security group ingress with port range
cloudformation-aws-security-group-ingress-with-port-range
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security group rule without description
cloudformation-aws-security-group-rule-without-description
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security group unrestricted access to RDP
cloudformation-aws-security-groups-unrestricted-access-to-rdp
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security group with unrestricted access to SSH
cloudformation-aws-security-groups-with-unrestricted-access-to-ssh
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security groups allows unrestricted outbound traffic
cloudformation-aws-security-groups-allows-unrestricted-outbound-traffic
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security groups with exposed admin ports
cloudformation-aws-security-groups-with-exhibited-admin-ports
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security groups with meta IP
cloudformation-aws-security-groups-with-meta-ip
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security groups without VPC attached
cloudformation-aws-security-groups-without-vpc-attached
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Serverless API access logging setting undefined
cloudformation-aws-serverless-api-access-logging-setting-undefined
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Serverless API cache cluster disabled
cloudformation-aws-serverless-api-cache-cluster-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Serverless API endpoint config not private
cloudformation-aws-serverless-api-endpoint-config-not-private
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Serverless API without content encoding
cloudformation-aws-serverless-api-without-content-encoding
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Serverless API X-Ray tracing disabled
cloudformation-aws-serverless-api-xray-tracing-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Serverless function environment variables not encrypted
cloudformation-aws-serverless-function-environment-variables-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Serverless function without dead-letter queue
cloudformation-aws-serverless-function-without-dead-letter-queue
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Serverless function without tags
cloudformation-aws-serverless-function-without-tags
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Serverless function without unique IAM role
cloudformation-aws-serverless-function-without-unique-iam-role
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Serverless function without X-Ray tracing
cloudformation-aws-serverless-function-without-x-ray-tracing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Shield Advanced not in use
cloudformation-aws-shield-advanced-not-in-use
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SNS topic is publicly accessible
cloudformation-aws-sns-topic-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SNS topic publicity has Allow and NotAction simultaneously
cloudformation-aws-sns-topic-publicity-has-allow-and-not-action-simultaneously
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SNS topic without KmsMasterKeyId
cloudformation-aws-sns-topic-without-kms-master-key-id
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SQS policy with public access
cloudformation-aws-sqs-policy-with-public-access
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SQS with SSE disabled
cloudformation-aws-sqs-with-sse-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Stack notifications disabled
cloudformation-aws-stack-notifications-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Stack retention disabled
cloudformation-aws-stack-retention-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Support has no role associated
cloudformation-aws-support-has-no-role-associated
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg TCP UDP protocol network ACL entry allows all ports
cloudformation-aws-tcp-or-udp-protocol-network-acl-entry-allows-all-ports
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Unknown port exposed to internet
cloudformation-aws-unknown-port-exposed-to-internet
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Unrestricted security group ingress
cloudformation-aws-unrestricted-security-group-ingress
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Unscanned ECR image
cloudformation-aws-unscanned-ecr-image
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User data contains encoded private key
cloudformation-aws-user-data-contains-encoded-private-key
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg VPC attached with too many gateways
cloudformation-aws-vpc-attached-with-too-many-gateways
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg VPC Flow Logs disabled
cloudformation-aws-vpc-flowlogs-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg VPC without attached subnet
cloudformation-aws-vpc-without-attached-subnet
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg VPC without Network Firewall
cloudformation-aws-vpc-without-network-firewall
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Vulnerable default SSL certificate
cloudformation-aws-vulnerable-default-ssl-certificate
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Wildcard in ACM certificate domain name
cloudformation-aws-wildcard-in-acm-certificate-domain-name
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Workspace without encryption
cloudformation-aws-workspace-without-encryption
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg ADD instead of COPY
dockerfile-add-instead-of-copy
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg apk add using local cache path
dockerfile-apk-add-using-local-cache-path
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg apt-get install lists were not deleted
dockerfile-apt-get-install-lists-were-not-deleted
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg apt-get install pin version not defined
dockerfile-apt-get-install-pin-version-not-defined
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg apt-get missing flags to avoid manual input
dockerfile-apt-get-missing-flags-to-avoid-manual-input
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg apt-get not avoiding additional packages
dockerfile-apt-get-not-avoiding-additional-packages
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Avoid chmod 777
dockerfile-avoid-chmod-777
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Avoid HTTP
dockerfile-avoid-http
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Changing default shell using RUN command
dockerfile-changing-default-shell-using-run-command
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg chown flag exists
dockerfile-chown-flag-exists
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg COPY --from references current FROM alias
dockerfile-copy-from-references-current-from-alias
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg COPY with more than two arguments not ending with a slash
dockerfile-copy-with-more-than-two-arguments-not-ending-with-slash
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg curl or wget instead of ADD
dockerfile-curl-or-wget-instead-of-add
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Dockerfile should specify base image
dockerfile-should-specify-base-image
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg ENV refers to itself
dockerfile-env-no-refer-envvar
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Exposing port 22 (SSH)
dockerfile-exposing-port-22
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg First instruction must be ARG or FROM
dockerfile-first-instruction-should-be-arg-or-from
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg gem install without version
dockerfile-gem-install-without-version
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Healthcheck instruction missing
dockerfile-healthcheck-instruction-missing
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Image version not explicit
dockerfile-image-version-not-explicit
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Image version using latest
dockerfile-image-version-using-latest
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Last user is root
dockerfile-last-user-is-root
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg MAINTAINER instruction being used
dockerfile-maintainer-instruction-being-used
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Missing dnf clean all
dockerfile-missing-dnf-clean-all
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Missing flag from dnf install
dockerfile-missing-flag-from-dnf-install
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Missing user instruction
dockerfile-missing-user-instruction
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Missing version specification in dnf install
dockerfile-missing-version-specification-in-dnf-install
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Missing zypper clean
dockerfile-missing-zypper-clean
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Missing Zypper non-interactive switch
dockerfile-missing-zypper-non-interactive-switch
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Multiple CMD instructions listed
dockerfile-multiple-cmd-instructions-listed
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Multiple ENTRYPOINT instructions listed
dockerfile-multiple-entrypoint-instructions-listed
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Multiple HEALTHCHECK instructions
dockerfile-do-not-use-multiple-healthcheck
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Multiple RUN, ADD, COPY instructions listed
dockerfile-multiple-run-add-copy-instructions-listed
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Not using JSON for CMD and ENTRYPOINT arguments
dockerfile-not-using-json-in-cmd-and-entrypoint-arguments
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg npm install command without pinned version
dockerfile-npm-install-without-pinned-version
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg ONBUILD cannot trigger FROM or MAINTAINER
dockerfile-from-or-maintainer-cannot-be-triggered-within-onbuild
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Package update without install in same RUN
dockerfile-update-instruction-alone
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg pip install keeping cached packages
dockerfile-pip-install-keeping-cached-packages
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg RUN instruction using cd instead of WORKDIR
dockerfile-run-command-cd-instead-of-workdir
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Run using apt
dockerfile-run-using-apt
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Run using sudo
dockerfile-run-using-sudo
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Run using wget and curl
dockerfile-run-using-wget-and-curl
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Run utilities and POSIX commands
dockerfile-run-utilities-and-posix-commands
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Run yarn clean after yarn install
dockerfile-run-yarn-clean-after-yarn-install
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Same alias in different FROM statements
dockerfile-same-alias-in-different-froms
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Shell running a pipe without the pipefail flag
dockerfile-shell-running-a-pipe-without-pipefail-flag
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg UNIX ports out of range
dockerfile-unix-ports-out-of-range
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Unpinned package version in apk add
dockerfile-unpinned-package-version-in-apk-add
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Unpinned package version in pip install
dockerfile-unpinned-package-version-in-pip-install
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Use only allowed registry in FROM
dockerfile-use-only-an-allowed-registry-in-the-from-image
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Use recommended flags with useradd
dockerfile-use-recommended-flags-with-useradd
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Using --platform flag with FROM command
dockerfile-using-platform-with-from
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Using unnamed build stages
dockerfile-using-unnamed-build-stages
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg WORKDIR path not absolute
dockerfile-workdir-path-not-absolute
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg yum clean all missing
dockerfile-yum-clean-all-missing
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg yum install allows manual input
dockerfile-yum-install-allows-manual-input
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg yum install without version
dockerfile-yum-install-without-version
>
https://static.datadoghq.com/static/images/logos/docker_avatar.svg Zypper install without explicit package version
dockerfile-zypper-install-without-version
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Always admit admission control plugin set
kubernetes-always-admit-admission-control-plugin-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Always pull images admission control plugin not set
kubernetes-always-pull-images-admission-control-plugin-not-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Anonymous auth is not set to false
kubernetes-anonymous-auth-is-not-set-to-false
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Audit log maxage not properly set
kubernetes-audit-log-maxage-not-properly-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Audit log maxbackup not properly set
kubernetes-audit-log-maxbackup-not-properly-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Audit log maxsize not properly set
kubernetes-audit-log-maxsize-not-properly-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Audit log path not set
kubernetes-audit-log-path-not-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Audit policy does not cover key security concerns
kubernetes-audit-policy-not-cover-key-security-concerns
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Audit policy file not defined
kubernetes-audit-policy-file-not-defined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Authorization mode node not set
kubernetes-authorization-mode-node-not-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Authorization mode RBAC not set
kubernetes-authorization-mode-rbac-not-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Authorization mode set to always allow
kubernetes-authorization-mode-set-to-always-allow
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Auto TLS set to true
kubernetes-auto-tls-set-to-true
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Basic auth file is set
kubernetes-basic-auth-file-is-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Bind address not properly set
kubernetes-bind-address-not-properly-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Certificate authority is not unique
kubernetes-not-unique-certificate-authority
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Client certificate authentication not set up properly
kubernetes-client-certificate-authentication-not-setup-properly
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Cluster admin rolebinding with superuser permissions
kubernetes-cluster-admin-role-binding-with-super-user-permissions
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Cluster allows unsafe sysctls
kubernetes-cluster-allows-unsafe-sysctls
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg CNI plugin does not support network policies
kubernetes-cni-plugin-does-not-support-network-policies
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Container is privileged
kubernetes-container-is-privileged
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Container running as root
kubernetes-containers-running-as-root
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Container with low UID
kubernetes-containers-run-with-low-uid
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Container with unmasked /proc access
kubernetes-container-runs-unmasked
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Containers missing drop capabilities
kubernetes-no-drop-capabilities-for-containers
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Containers with added capabilities
kubernetes-containers-with-added-capabilities
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Containers with sys admin capabilities
kubernetes-containers-with-sys-admin-capabilities
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg CPU limits not set
kubernetes-cpu-limits-not-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg CPU requests not set
kubernetes-cpu-requests-not-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg CronJob deadline not configured
kubernetes-cronjob-deadline-not-configured
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Dashboard is enabled
kubernetes-dashboard-is-enabled
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Deployment without podAntiAffinity
kubernetes-deployment-has-no-pod-anti-affinity
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Deployment without PodDisruptionBudget
kubernetes-deployment-without-pod-disruption-budget
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Docker daemon socket is exposed to containers
kubernetes-docker-daemon-socket-is-exposed-to-containers
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Encryption provider config is not defined
kubernetes-encryption-provider-config-is-not-defined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Encryption provider not properly configured
kubernetes-encryption-provider-not-properly-configured
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Ensure administrative boundaries between resources
kubernetes-ensure-administrative-boundaries-between-resources
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg etcd client certificate authentication set to false
kubernetes-etcd-client-certificate-authentication-set-to-false
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg etcd client certificate file not defined
kubernetes-etcd-client-certificate-file-not-defined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg etcd peer client certificate authentication set to false
kubernetes-etcd-peer-client-certificate-authentication-set-to-false
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg etcd peer TLS certificate files not properly set
kubernetes-etcd-peer-tls-certificate-files-not-properly-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg etcd TLS certificate files not properly set
kubernetes-etcd-tls-certificate-files-not-properly-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg etcd TLS certificate not properly configured
kubernetes-etcd-tls-certificate-not-properly-configured
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Event rate limit admission control plugin not set
kubernetes-event-rate-limit-admission-control-plugin-not-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg HPA targeted deployments with configured replica count
kubernetes-hpa-targeted-deployments-with-configured-replica-count
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg HPA targets invalid object
kubernetes-hpa-targets-invalid-object
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Image policy webhook admission control plugin not set
kubernetes-image-policy-webhook-admission-control-plugin-not-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Image pull policy of the container is not set to always
kubernetes-image-pull-policy-of-container-is-not-always
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Image without digest
kubernetes-image-without-digest
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Incorrect volume claim access mode ReadWriteOnce
kubernetes-incorrect-volume-claim-access-mode-read-write-once
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Ingress controller exposes workload
kubernetes-ingress-controller-exposes-workload
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Insecure bind address set
kubernetes-insecure-bind-address-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Insecure port not properly set
kubernetes-insecure-port-not-properly-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Invalid image tag
kubernetes-invalid-image
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Invalid metadata label
kubernetes-metadata-label-is-invalid
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet certificate authority not set
kubernetes-kubelet-certificate-authority-not-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet client certificate or key not set
kubernetes-kubelet-client-certificate-or-key-not-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet client periodic certificate switch disabled
kubernetes-kubelet-client-periodic-certificate-switch-disabled
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet event QPS not properly set
kubernetes-kubelet-event-qps-not-properly-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet hostname override is set
kubernetes-kubelet-hostname-override-is-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet HTTPS set to false
kubernetes-kubelet-https-set-to-false
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet not managing IP tables
kubernetes-kubelet-not-managing-ip-tables
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet protect-kernel-defaults set to false
kubernetes-kubelet-protect-kernel-defaults-set-to-false
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet read-only port is not set to zero
kubernetes-kubelet-read-only-port-is-not-set-to-zero
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Kubelet streaming connection timeout disabled
kubernetes-kubelet-streaming-connection-timeout-disabled
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Liveness probe is not defined
kubernetes-liveness-probe-is-not-defined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Memory limits not defined
kubernetes-memory-limits-not-defined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Memory requests not defined
kubernetes-memory-requests-not-defined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Missing AppArmor profile
kubernetes-missing-app-armor-config
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Namespace lifecycle admission control plugin disabled
kubernetes-namespace-lifecycle-admission-control-plugin-disabled
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg NET_RAW capabilities disabled for PSP
kubernetes-net-raw-capabilities-disabled-for-psp
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg NET_RAW capabilities not dropped
kubernetes-net-raw-capabilities-not-being-dropped
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Network policy without Pod target
kubernetes-network-policy-is-not-targeting-any-pod
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Node restriction admission control plugin not set
kubernetes-node-restriction-admission-control-plugin-not-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Non kube-system pod with host mount
kubernetes-non-kube-system-pod-with-host-mount
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Object is using a deprecated API version
kubernetes-object-is-using-a-deprecated-api-version
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Peer auto TLS set to true
kubernetes-peer-auto-tls-set-to-true
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Permissive access to create pods
kubernetes-permissive-access-to-create-pods
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Pod misconfigured network policy
kubernetes-pod-misconfigured-network-policy
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Pod or container without LimitRange
kubernetes-pod-or-container-without-limit-range
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Pod or container without ResourceQuota
kubernetes-pod-or-container-without-resource-quota
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Pod or container without security context
kubernetes-pod-or-container-without-security-context
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Pod security policy admission control plugin not set
kubernetes-pod-security-policy-admission-control-plugin-not-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg PodSecurityPolicy allows host network sharing
kubernetes-psp-containers-share-host-network-namespace
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Privilege escalation allowed
kubernetes-privilege-escalation-allowed
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Profiling not set to false
kubernetes-profiling-not-set-to-false
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg PSP allows privilege escalation
kubernetes-psp-allows-privilege-escalation
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg PSP allows sharing host IPC
kubernetes-psp-allows-sharing-host-ipc
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg PSP allows sharing host PID
kubernetes-psp-allows-sharing-host-pid
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg PSP set to privileged
kubernetes-psp-set-to-privileged
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg PSP with added capabilities
kubernetes-psp-with-added-capabilities
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg PSP with unrestricted access to host path
kubernetes-psp-with-unrestricted-access-to-host-path
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg RBAC roles allow privilege escalation
kubernetes-rbac-roles-allow-privilege-escalation
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg RBAC roles with attach permission
kubernetes-rbac-roles-with-attach-permission
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg RBAC roles with exec permission
kubernetes-rbac-roles-with-exec-permission
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg RBAC roles with impersonate permission
kubernetes-rbac-roles-with-impersonate-permission
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg RBAC roles with port-forwarding permission
kubernetes-rbac-roles-with-portforwarding-permissions
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg RBAC roles with read secrets permissions
kubernetes-rbac-roles-with-read-secrets-permissions
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg RBAC wildcard in rule
kubernetes-rbac-wildcard-in-rule
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Readiness probe is not configured
kubernetes-readiness-probe-is-not-configured
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Request timeout not properly set
kubernetes-request-timeout-not-properly-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Role binding to default service account
kubernetes-role-binding-to-default-service-account
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Root CA file not defined
kubernetes-root-ca-file-not-defined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Root container not mounted as read-only
kubernetes-root-container-not-mounted-as-read-only
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Root containers admitted
kubernetes-root-containers-admitted
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Rotate Kubelet server certificate not active
kubernetes-rotate-kubelet-server-certificate-not-active
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Seccomp profile is not configured
kubernetes-seccomp-profile-is-not-configured
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Secrets used as environment variables
kubernetes-secrets-as-environment-variables
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Secure port set to zero
kubernetes-secure-port-set-to-zero
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Security context deny admission control plugin not set
kubernetes-security-context-deny-admission-control-plugin-not-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service account admission control plugin disabled
kubernetes-service-account-admission-control-plugin-disabled
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service account key file not properly set
kubernetes-service-account-key-file-not-properly-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service account lookup set to false
kubernetes-service-account-lookup-set-to-false
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service account name undefined or empty
kubernetes-service-account-name-undefined-or-empty
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service account private key file not defined
kubernetes-service-account-private-key-file-not-defined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service account token auto-mount not disabled
kubernetes-service-account-token-automount-not-disabled
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service does not target a Pod
kubernetes-service-does-not-target-pod
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service type is NodePort
kubernetes-service-type-is-nodeport
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service with external load balancer
kubernetes-service-with-external-load-balancer
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg ServiceAccount allows access to secrets
kubernetes-service-account-allows-access-secrets
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Shared host IPC namespace
kubernetes-shared-host-ipc-namespace
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Shared host network namespace
kubernetes-shared-host-network-namespace
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Shared host PID namespace
kubernetes-shared-host-pid-namespace
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Shared service account
kubernetes-shared-service-account
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg StatefulSet requests storage
kubernetes-statefulset-requests-storage
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg StatefulSet without podAntiAffinity
kubernetes-statefulset-has-no-pod-anti-affinity
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg StatefulSet without PodDisruptionBudget
kubernetes-statefulset-without-pod-disruption-budget
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg StatefulSet without service name
kubernetes-statefulset-without-service-name
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Terminated pod garbage collector threshold not properly set
kubernetes-terminated-pod-garbage-collector-threshold-not-properly-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Tiller (Helm v2) deployed
kubernetes-tiller-is-deployed
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Tiller Deployment accessible within cluster
kubernetes-tiller-deployment-is-accessible-from-within-the-cluster
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Tiller Service present
kubernetes-tiller-service-is-not-deleted
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg TLS connection certificate not set up
kubernetes-tls-connection-certificate-not-setup
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Token auth file is set
kubernetes-token-auth-file-is-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Unrestricted capabilities in PodSecurityPolicy
kubernetes-not-limited-capabilities-for-pod-security-policy
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Use service account credentials not set to true
kubernetes-use-service-account-credentials-not-set-to-true
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Using Kubernetes native secret management
kubernetes-using-kubernetes-native-secret-management
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Using unrecommended namespace
kubernetes-using-unrecommended-namespace
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Volume mount with OS directory write permissions
kubernetes-volume-mount-with-os-directory-write-permissions
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Weak TLS cipher suites
kubernetes-weak-tls-cipher-suites
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Workload host port not specified
kubernetes-workload-host-port-not-specified
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Workload mounting with sensitive OS directory
kubernetes-workload-mounting-with-sensitive-os-directory
>
Action trail logging for all regions disabled
terraform-alicloud-action-trail-logging-all-regions-disabled
>
ActionTrail trail OSS bucket is publicly accessible
terraform-alicloud-actiontrail-trail-oss-bucket-is-publicly-accessible
>
ALB listening on HTTP
terraform-alicloud-alb-listening-on-http
>
API Gateway API protocol not HTTPS
terraform-alicloud-api-gateway-api-protocol-not-https
>
CMK is unusable
terraform-alicloud-cmk-is-unusable
>
CS Kubernetes node pool auto repair disabled
terraform-alicloud-cs-kubernetes-node-pool-auto-repair-disabled
>
Disk encryption disabled
terraform-alicloud-disk-encryption-disabled
>
ECS data disk KMS key ID undefined
terraform-alicloud-ecs-data-disk-kms-key-id-undefined
>
High KMS key rotation period
terraform-alicloud-high-kms-key-rotation-period
>
Kubernetes cluster without Terway as CNI network plugin
terraform-alicloud-kubernetes-cluster-without-terway-as-cni-network-plugin
>
Launch template is not encrypted
terraform-alicloud-launch-template-is-not-encrypted
>
Log retention is not greater than 90 days
terraform-alicloud-log-retention-is-not-greater-than-90-days
>
NAS file system not encrypted
terraform-alicloud-nas-file-system-not-encrypted
>
NAS file system without KMS
terraform-alicloud-nas-file-system-without-kms
>
No ROS stack policy
terraform-alicloud-no-ros-stack-policy
>
OSS bucket allows all actions from all principals
terraform-alicloud-oss-bucket-allows-all-actions-from-all-principals
>
OSS bucket allows delete action from all principals
terraform-alicloud-oss-bucket-allows-delete-from-all-principals
>
OSS bucket allows list action from all principals
terraform-alicloud-oss-bucket-allows-list-action-from-all-principals
>
OSS bucket allows put action from all principals
terraform-alicloud-oss-bucket-allows-put-action-from-all-principals
>
OSS bucket encryption using CMK disabled
terraform-alicloud-oss-bucket-cmk-encryption-disabled
>
OSS bucket has static website
terraform-alicloud-oss-bucket-has-static-website
>
OSS bucket IP restriction disabled
terraform-alicloud-oss-bucket-ip-restriction-disabled
>
OSS bucket lifecycle rule disabled
terraform-alicloud-oss-bucket-lifecycle-disabled
>
OSS bucket logging disabled
terraform-alicloud-oss-bucket-logging-disabled
>
OSS bucket public access enabled
terraform-alicloud-oss-bucket-public-access-enabled
>
OSS bucket transfer acceleration disabled
terraform-alicloud-oss-bucket-transfer-acceleration-disabled
>
OSS bucket versioning disabled
terraform-alicloud-oss-bucket-versioning-disabled
>
OSS buckets secure transport disabled
terraform-alicloud-oss-buckets-securetransport-disabled
>
Public security group rule all ports or protocols
terraform-alicloud-public-security-group-rule-all-ports-or-protocols
>
Public security group rule sensitive port
terraform-alicloud-public-security-group-rule-sensitive-port
>
Public security group rule unknown port
terraform-alicloud-public-security-group-rule-unknown-port
>
RAM account password policy does not enforce minimum password length
terraform-alicloud-ram-account-password-policy-not-required-minimum-length
>
RAM account password policy does not require numbers
terraform-alicloud-ram-account-password-policy-not-required-numbers
>
RAM account password policy does not require symbols
terraform-alicloud-ram-account-password-policy-not-required-symbols
>
RAM account password policy max login attempts not recommended
terraform-alicloud-ram-account-password-policy-max-login-attempts-unrecommended
>
RAM account password policy max password age not recommended
terraform-alicloud-ram-account-password-policy-max-password-age-unrecommended
>
RAM account password policy not require at least one lowercase character
terraform-alicloud-ram-password-security-policy-not-require-at-least-one-lowercase-character
>
RAM account password policy not require at least one uppercase character
terraform-alicloud-ram-password-security-policy-not-require-at-least-one-uppercase-character
>
RAM account password policy without reuse prevention
terraform-alicloud-ram-account-password-policy-without-reuse-prevention
>
RAM policy admin access not attached to users groups roles
terraform-alicloud-ram-policy-admin-access-not-attached-to-users-groups-roles
>
RAM policy attached to user
terraform-alicloud-ram-policy-attached-to-user
>
RAM security preference does not enforce MFA login
terraform-alicloud-ram-security-preference-not-enforce-mfa
>
RDS DB instance publicly accessible
terraform-alicloud-rds-instance-address-publicly-accessible
>
RDS DB instance publicly accessible
terraform-alicloud-rds-instance-publicly-accessible
>
RDS instance events not logged
terraform-alicloud-rds-instance-events-not-logged
>
RDS instance log connections disabled
terraform-alicloud-rds-instance-log-connections-disabled
>
RDS instance log disconnections disabled
terraform-alicloud-rds-instance-log-disconnections-disabled
>
RDS instance log duration disabled
terraform-alicloud-rds-instance-log-duration-disabled
>
RDS instance retention period not recommended
terraform-alicloud-rds-instance-retention-not-recommended
>
RDS instance SSL action disabled
terraform-alicloud-rds-instance-ssl-action-disabled
>
RDS instance TDE status disabled
terraform-alicloud-rds-instance-tde-status-disabled
>
ROS stack notifications disabled
terraform-alicloud-ros-stack-notifications-disabled
>
ROS stack retention disabled
terraform-alicloud-ros-stack-retention-disabled
>
ROS stack without template
terraform-alicloud-ros-stack-without-template
>
SLB policy with insecure TLS version in use
terraform-alicloud-slb-policy-with-insecure-tls-version-in-use
>
VPC flow logs disabled
terraform-alicloud-vpc-flow-logs-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ALB deletion protection disabled
terraform-aws-alb-deletion-protection-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ALB is not integrated with WAF
terraform-aws-alb-is-not-integrated-with-waf
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ALB listening on HTTP
terraform-aws-alb-listening-on-http
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ALB not dropping invalid headers
terraform-aws-alb-not-dropping-invalid-headers
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Amazon DMS replication instance is publicly accessible
terraform-aws-amazon-dms-replication-instance-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg AmazonMQ broker encryption disabled
terraform-aws-amazon-mq-broker-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg AMI most recent without owner or filter
terraform-aws-ami-owner-missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg AMI not encrypted
terraform-aws-ami-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg AMI shared with multiple accounts
terraform-aws-ami-shared-with-multiple-accounts
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway access logging disabled
terraform-aws-api-gateway-access-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway deployment without access log setting
terraform-aws-api-gateway-deployment-without-access-log-setting
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway deployment without API Gateway usage plan associated
terraform-aws-api-gateway-deployment-without-api-gateway-usage-plan-associated
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway endpoint config is not private
terraform-aws-api-gateway-endpoint-config-is-not-private
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway method does not contain an API key
terraform-aws-api-gateway-method-does-not-contain-an-api-key
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway method settings cache not encrypted
terraform-aws-api-gateway-method-settings-cache-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway stage without API Gateway usage plan associated
terraform-aws-api-gateway-stage-without-api-gateway-usage-plan-associated
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway with CloudWatch logging disabled
terraform-aws-api-gateway-with-cloudwatch-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway with invalid compression
terraform-aws-api-gateway-with-invalid-compression
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway with open access
terraform-aws-api-gateway-with-open-access
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway without configured authorizer
terraform-aws-api-gateway-without-configured-authorizer
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway without security policy
terraform-aws-api-gateway-without-security-policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway without SSL certificate
terraform-aws-api-gateway-without-ssl-certificate
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway without WAF
terraform-aws-api-gateway-without-waf
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg API Gateway X-Ray disabled
terraform-aws-api-gateway-xray-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Athena database not encrypted
terraform-aws-athena-database-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Athena workgroup not encrypted
terraform-aws-athena-workgroup-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Authentication without MFA
terraform-aws-authentication-without-mfa
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Auto scaling group with no associated ELB
terraform-aws-auto-scaling-group-with-no-associated-elb
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Automatic minor upgrades disabled
terraform-aws-automatic-minor-upgrades-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Autoscaling groups supply tags
terraform-aws-autoscaling-groups-supply-tags
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg AWS password policy with unchangeable passwords
terraform-aws-aws-password-policy-with-unchangeable-passwords
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Batch job definition with privileged container properties
terraform-aws-batch-job-definition-with-privileged-container-properties
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CA certificate identifier is outdated
terraform-aws-ca-certificate-identifier-is-outdated
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CDN configuration is missing
terraform-aws-cdn-configuration-is-missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Certificate has expired
terraform-aws-certificate-has-expired
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Certificate RSA key bytes lower than 256
terraform-aws-certificate-rsa-key-bytes-lower-than-256
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudFront logging disabled
terraform-aws-cloudfront-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Cloudfront viewer protocol policy allows HTTP
terraform-aws-cloudfront-viewer-protocol-policy-allows-http
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudFront without minimum protocol TLS 1.2
terraform-aws-cloudfront-without-minimum-protocol-tls-1-2
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudFront without WAF
terraform-aws-cloudfront-without-waf
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail log file validation disabled
terraform-aws-cloudtrail-log-file-validation-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail log files not encrypted with KMS
terraform-aws-cloudtrail-log-files-not-encrypted-with-kms
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail log files S3 bucket is publicly accessible
terraform-aws-cloudtrail-log-files-s3-bucket-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail log files S3 bucket with logging disabled
terraform-aws-cloudtrail-log-files-s3-bucket-with-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail logging disabled
terraform-aws-cloudtrail-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail multi region disabled
terraform-aws-cloudtrail-multi-region-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail not integrated with CloudWatch
terraform-aws-cloudtrail-not-integrated-with-cloudwatch
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudTrail SNS topic name undefined
terraform-aws-cloudtrail-sns-topic-name-undefined
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch AWS Config configuration changes alarm missing
terraform-aws-cloudwatch-aws-config-configuration-changes-alarm-missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch changes to NACL alarm missing
terraform-aws-cloudwatch-changes-to-nacl-alarm-missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Cloudwatch CloudTrail configuration changes alarm missing
terraform-aws-cloudwatch-cloudtrail-configuration-changes-alarm-missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch console sign-in without MFA alarm missing
terraform-aws-cloudwatch-management-console-sign-in-without-mfa-alarm-missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch disabling or scheduled deletion of customer created CMK alarm missing
terraform-aws-cloudwatch-disabling-or-scheduled-deletion-of-customer-created-cmk-alarm-missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch IAM policy changes alarm missing
terraform-aws-cloudwatch-iam-policy-changes-alarm-missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch log group without KMS
terraform-aws-cloudwatch-log-group-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch logging disabled
terraform-aws-cloudwatch-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch logs destination with vulnerable policy
terraform-aws-cloudwatch-logs-destination-with-vulnerable-policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch management console auth failed alarm missing
terraform-aws-cloudwatch-management-console-auth-failed-alarm-missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch metrics disabled
terraform-aws-cloudwatch-metrics-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch network gateways changes alarm missing
terraform-aws-cloudwatch-network-gateways-changes-alarm-missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch root account use missing
terraform-aws-cloudwatch-root-account-use-alarm-missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch route table changes alarm missing
terraform-aws-cloudwatch-route-table-changes-alarm-missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch S3 policy change alarm missing
terraform-aws-cloudwatch-s3-policy-change-alarm-missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Cloudwatch security group changes alarm missing
terraform-aws-cloudwatch-security-group-changes-alarm-missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch unauthorized access alarm missing
terraform-aws-cloudwatch-unauthorized-access-defined-alarm-missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch VPC changes alarm missing
terraform-aws-cloudwatch-vpc-changes-alarm-missing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CloudWatch without retention period specified
terraform-aws-cloudwatch-without-retention-period-specified
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CMK is unusable
terraform-aws-cmk-is-unusable
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CMK rotation disabled
terraform-aws-cmk-rotation-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg CodeBuild project encrypted with AWS managed key
terraform-aws-codebuild-project-encrypted-with-aws-managed-key
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Cognito user pool without MFA
terraform-aws-cognito-userpool-without-mfa
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Config rule for encrypted volumes disabled
terraform-aws-config-rule-for-encrypted-volumes-is-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Configuration aggregator to all regions disabled
terraform-aws-config-configuration-aggregator-to-all-regions-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Cross-account IAM assume role policy without external id or MFA
terraform-aws-cross-account-iam-assume-role-policy-without-external-id-or-mfa
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DAX cluster not encrypted
terraform-aws-dax-cluster-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DB instance storage not encrypted
terraform-aws-db-instance-storage-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DB security group has public interface
terraform-aws-db-security-group-has-public-interface
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DB security group open to large scope
terraform-aws-db-security-group-open-to-large-scope
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DB security group with public scope
terraform-aws-db-security-group-with-public-scope
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DB snapshot is public
terraform-aws-db-snapshot-public
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Default security groups with unrestricted traffic
terraform-aws-default-security-groups-with-unrestricted-traffic
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Default VPC exists
terraform-aws-default-vpc-exists
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DMS endpoints without SSL
terraform-aws-dms-endpoint-no-ssl-configured
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DocumentDB cluster encrypted with AWS managed key
terraform-aws-docdb-cluster-encrypted-with-aws-managed-key
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DocumentDB cluster not encrypted
terraform-aws-docdb-cluster-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DocumentDB cluster without KMS
terraform-aws-docdb-cluster-without-kms
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DocumentDB logging is disabled
terraform-aws-docdb-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DynamoDB table not encrypted
terraform-aws-dynamodb-table-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg DynamoDB table Point-in-Time Recovery disabled
terraform-aws-dynamodb-table-point-in-time-recovery-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Dynamodb VPC endpoint without route table association
terraform-aws-dynamodb-vpc-endpoint-without-route-table-association
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EBS default encryption disabled
terraform-aws-ebs-default-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EBS volume encryption disabled
terraform-aws-ebs-volume-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EBS volume snapshot not encrypted
terraform-aws-ebs-volume-snapshot-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 instance has public IP
terraform-aws-ec2-instance-has-public-ip
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 instance monitoring disabled
terraform-aws-ec2-instance-monitoring-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 instance using API keys
terraform-aws-ec2-instance-using-api-keys
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 instance using default security group
terraform-aws-ec2-instance-using-default-security-group
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 instance using default VPC
terraform-aws-ec2-instance-using-default-vpc
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EC2 not EBS optimized
terraform-aws-ec2-not-ebs-optimized
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECR image tag not immutable
terraform-aws-ecr-image-tag-not-immutable
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECR repository is publicly accessible
terraform-aws-ecr-repository-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECR repository not encrypted with CMK
terraform-aws-ecr-repository-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECR repository without policy
terraform-aws-ecr-repository-without-policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS cluster with container insights disabled
terraform-aws-ecs-cluster-container-insights-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS service admin role is present
terraform-aws-ecs-service-admin-role-is-present
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS service without running tasks
terraform-aws-ecs-service-without-running-tasks
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS task definition network mode not recommended
terraform-aws-ecs-task-definition-network-mode-not-recommended
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ECS task definition volume not encrypted
terraform-aws-ecs-task-definition-volume-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EFS not encrypted
terraform-aws-efs-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EFS with vulnerable policy
terraform-aws-efs-with-vulnerable-policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EFS without KMS
terraform-aws-efs-without-kms
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EKS cluster encryption disabled
terraform-aws-eks-cluster-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EKS cluster has public access
terraform-aws-eks-cluster-has-public-access
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EKS cluster has public access CIDRs
terraform-aws-eks-cluster-has-public-access-cidrs
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EKS cluster logging is not enabled
terraform-aws-eks-cluster-log-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EKS node group remote access disabled
terraform-aws-eks-node-group-remote-access-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ElastiCache nodes not created across multi AZ
terraform-aws-elasticache-nodes-not-created-across-multi-az
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ElastiCache Redis cluster without backup
terraform-aws-elasticache-redis-cluster-without-backup
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ElastiCache replication group not encrypted at rest
terraform-aws-elasticache-replication-group-not-encrypted-at-rest
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ElastiCache replication group not encrypted at transit
terraform-aws-elasticache-replication-group-not-encrypted-at-transit
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ElastiCache using default port
terraform-aws-elasticache-using-default-port
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ElastiCache without VPC
terraform-aws-elasticache-without-vpc
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch domain not encrypted node to node
terraform-aws-elasticsearch-domain-not-encrypted-node-to-node
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch domain with vulnerable policy
terraform-aws-elasticsearch-domain-with-vulnerable-policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch encryption with KMS disabled
terraform-aws-elasticsearch-encryption-with-kms-is-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch log disabled
terraform-aws-elasticsearch-logs-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch not encrypted at rest
terraform-aws-elasticsearch-not-encrypted-at-rest
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch uses default security group
terraform-aws-elasticsearch-using-default-security-group
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch with HTTPS disabled
terraform-aws-elasticsearch-with-https-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch without IAM authentication
terraform-aws-elasticsearch-without-iam-authentication
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Elasticsearch without slow logs
terraform-aws-elasticsearch-without-slow-logs
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ELB access log disabled
terraform-aws-elb-access-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ELB using insecure protocols
terraform-aws-elb-using-insecure-protocols
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg ELB using weak ciphers
terraform-aws-elb-using-weak-ciphers
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg EMR without VPC
terraform-aws-emr-without-vpc
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Fine-grained access control disabled for OpenSearch/Elasticsearch
terraform-aws-elasticsearch-no-finegrain-access-control
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Global Accelerator flow logs disabled
terraform-aws-global-accelerator-flow-logs-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Glue Data Catalog encryption disabled
terraform-aws-glue-data-catalog-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Glue security configuration encryption disabled
terraform-aws-glue-security-configuration-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Glue with vulnerable policy
terraform-aws-glue-with-vulnerable-policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole'
terraform-aws-group-with-privilege-escalation-by-actions-iam-passrole-and-cloudformation-createstack
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'
terraform-aws-group-with-privilege-escalation-by-actions-iam-passrole-and-ec2-runinstances
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole'
terraform-aws-group-with-privilege-escalation-by-actions-iam-passrole-and-glue-createdevendpoint
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'glue:UpdateDevEndpoint'
terraform-aws-group-with-privilege-escalation-by-actions-glue-updatedevendpoint
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:AddUserToGroup'
terraform-aws-group-with-privilege-escalation-by-actions-iam-addusertogroup
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:AttachGroupPolicy'
terraform-aws-group-with-privilege-escalation-by-actions-iam-attachgrouppolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:AttachRolePolicy'
terraform-aws-group-with-privilege-escalation-by-actions-iam-attachrolepolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:AttachUserPolicy'
terraform-aws-group-with-privilege-escalation-by-actions-iam-attachuserpolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:CreateAccessKey'
terraform-aws-group-with-privilege-escalation-by-actions-iam-createaccesskey
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:CreateLoginProfile'
terraform-aws-group-with-privilege-escalation-by-actions-iam-createloginprofile
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:CreatePolicyVersion'
terraform-aws-group-with-privilege-escalation-by-actions-iam-createpolicyversion
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:PutGroupPolicy'
terraform-aws-group-with-privilege-escalation-by-actions-iam-putgrouppolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:PutRolePolicy'
terraform-aws-group-with-privilege-escalation-by-actions-iam-putrolepolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:PutUserPolicy'
terraform-aws-group-with-privilege-escalation-by-actions-iam-putuserpolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:SetDefaultPolicyVersion'
terraform-aws-group-with-privilege-escalation-by-actions-iam-setdefaultpolicyversion
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole'
terraform-aws-group-with-privilege-escalation-by-actions-iam-updateassumerolepolicy-and-sts-assumerole
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'iam:UpdateLoginProfile'
terraform-aws-group-with-privilege-escalation-by-actions-iam-updateloginprofile
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction'
terraform-aws-group-with-privilege-escalation-by-actions-iam-passrole-and-lambda-createfunction-and-lambda-invokefunction
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Group with privilege escalation by actions 'lambda:UpdateFunctionCode'
terraform-aws-group-with-privilege-escalation-by-actions-lambda-updatefunctioncode
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg GuardDuty detector disabled
terraform-aws-guardduty-detector-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg HTTP port open to internet
terraform-aws-http-port-open
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM access key is exposed
terraform-aws-iam-access-key-is-exposed
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM database auth not enabled
terraform-aws-iam-database-auth-not-enabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM group without users
terraform-aws-iam-group-without-users
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM password policy does not require lowercase letter
terraform-aws-iam-password-does-not-require-lowercase
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM password policy does not require numbers
terraform-aws-iam-password-does-not-require-number
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM password policy does not require symbol
terraform-aws-iam-password-does-not-require-symbol
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM password policy does not require uppercase letter
terraform-aws-iam-password-does-not-require-uppercase
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM password without minimum length
terraform-aws-iam-password-without-minimum-length
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM policies attached to user
terraform-aws-iam-policies-attached-to-user
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM policies with full privileges
terraform-aws-iam-policies-with-full-privileges
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM policy grants 'AssumeRole' permission across all services
terraform-aws-iam-policy-grants-assumerole-permission-across-all-services
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM policy grants full permissions
terraform-aws-iam-policy-grants-full-permissions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM role allows all principals to assume
terraform-aws-iam-role-allows-all-principals-to-assume
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM role policy passrole allows all
terraform-aws-iam-role-policy-passrole-allows-all
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM role with full privileges
terraform-aws-iam-role-with-full-privileges
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM user has too many access keys
terraform-aws-iam-user-too-many-access-keys
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM user policy without MFA
terraform-aws-iam-user-policy-without-mfa
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IAM user with access to console
terraform-aws-iam-user-with-access-to-console
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg IMDSv1 enabled
terraform-aws-imdsv1-is-enabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Instance with no VPC
terraform-aws-instance-with-no-vpc
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Kinesis not encrypted with KMS
terraform-aws-kinesis-not-encrypted-with-kms
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Kinesis SSE not configured
terraform-aws-kinesis-sse-not-configured
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg KMS key with no deletion window
terraform-aws-kms-key-with-no-deletion-window
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg KMS key with vulnerable policy
terraform-aws-kms-key-with-full-permissions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda function publicly accessible
terraform-aws-lambda-function-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda function with privileged role
terraform-aws-lambda-function-with-privileged-role
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda functions without X-Ray tracing
terraform-aws-lambda-functions-without-x-ray-tracing
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda IAM InvokeFunction misconfigured
terraform-aws-lambda-iam-invokefunction-misconfigured
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda permission misconfigured
terraform-aws-lambda-permission-misconfigured
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda permission principal is wildcard
terraform-aws-lambda-permission-principal-is-wildcard
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Lambda with vulnerable policy
terraform-aws-lambda-with-vulnerable-policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Launch configuration is not encrypted
terraform-aws-launch-configuration-is-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Misconfigured password policy expiration
terraform-aws-misconfigured-password-policy-expiration
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Missing CloudWatch alarm for AWS Organizations changes
terraform-aws-cloudwatch-aws-organizations-changes-missing-alarm
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Missing cluster log types
terraform-aws-missing-cluster-log-types
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg MQ broker is publicly accessible
terraform-aws-mq-broker-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg MQ broker logging disabled
terraform-aws-mq-broker-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg MSK broker is publicly accessible
terraform-aws-msk-broker-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg MSK cluster encryption disabled
terraform-aws-msk-cluster-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg MSK cluster logging disabled
terraform-aws-msk-cluster-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Neptune cluster instance is publicly accessible
terraform-aws-neptune-cluster-instance-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Neptune cluster snapshot not encrypted
terraform-aws-neptune-snapshots-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Neptune cluster with IAM database authentication disabled
terraform-aws-neptune-cluster-with-iam-database-authentication-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Neptune database cluster encryption disabled
terraform-aws-neptune-database-cluster-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Neptune logging is disabled
terraform-aws-neptune-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Network ACL with unrestricted access to RDP
terraform-aws-network-acl-with-unrestricted-access-to-rdp
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Network ACL with unrestricted access to SSH
terraform-aws-network-acl-with-unrestricted-access-to-ssh
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg No password policy enabled
terraform-aws-no-password-policy-enabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg No stack policy
terraform-aws-no-stack-policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Password without reuse prevention
terraform-aws-password-without-reuse-prevention
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Policy without principal
terraform-aws-policy-without-principal
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Public and private EC2 share role
terraform-aws-public-and-private-ec2-share-role
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Public Lambda via API Gateway
terraform-aws-public-lambda-via-api-gateway
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS associated with public subnet
terraform-aws-rds-associated-with-public-subnet
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS cluster with backup disabled
terraform-aws-rds-cluster-with-backup-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS database cluster not encrypted
terraform-aws-rds-database-cluster-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS DB instance publicly accessible
terraform-aws-rds-db-instance-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS storage not encrypted
terraform-aws-rds-storage-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS using default port
terraform-aws-rds-using-default-port
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS with backup disabled
terraform-aws-rds-with-backup-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg RDS without logging
terraform-aws-rds-without-logging
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redis disabled
terraform-aws-redis-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redis not compliant
terraform-aws-redis-not-compliant
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redshift cluster logging disabled
terraform-aws-redshift-cluster-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redshift cluster without VPC
terraform-aws-redshift-cluster-without-vpc
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redshift not encrypted
terraform-aws-redshift-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redshift publicly accessible
terraform-aws-redshift-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Redshift using default port
terraform-aws-redshift-using-default-port
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Remote Desktop port open to internet
terraform-aws-remote-desktop-port-open-to-internet
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Resource not using tags
terraform-aws-resource-not-using-tags
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg REST API with vulnerable policy
terraform-aws-rest-api-with-vulnerable-policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole'
terraform-aws-role-with-privilege-escalation-by-actions-iam-passrole-and-cloudformation-createstack
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'
terraform-aws-role-with-privilege-escalation-by-actions-iam-passrole-and-ec2-runinstances
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole'
terraform-aws-role-with-privilege-escalation-by-actions-iam-passrole-and-glue-createdevendpoint
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'glue:UpdateDevEndpoint'
terraform-aws-role-with-privilege-escalation-by-actions-glue-updatedevendpoint
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:AddUserToGroup'
terraform-aws-role-with-privilege-escalation-by-actions-iam-addusertogroup
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:AttachGroupPolicy'
terraform-aws-role-with-privilege-escalation-by-actions-iam-attachgrouppolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:AttachRolePolicy'
terraform-aws-role-with-privilege-escalation-by-actions-iam-attachrolepolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:AttachUserPolicy'
terraform-aws-role-with-privilege-escalation-by-actions-iam-attachuserpolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:CreateAccessKey'
terraform-aws-role-with-privilege-escalation-by-actions-iam-createaccesskey
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:CreateLoginProfile'
terraform-aws-role-with-privilege-escalation-by-actions-iam-createloginprofile
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:CreatePolicyVersion'
terraform-aws-role-with-privilege-escalation-by-actions-iam-createpolicyversion
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:PutGroupPolicy'
terraform-aws-role-with-privilege-escalation-by-actions-iam-putgrouppolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:PutRolePolicy'
terraform-aws-role-with-privilege-escalation-by-actions-iam-putrolepolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:PutUserPolicy'
terraform-aws-role-with-privilege-escalation-by-actions-iam-putuserpolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:SetDefaultPolicyVersion'
terraform-aws-role-with-privilege-escalation-by-actions-iam-setdefaultpolicyversion
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole'
terraform-aws-role-with-privilege-escalation-by-actions-iam-updateassumerolepolicy-and-sts-assumerole
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'iam:UpdateLoginProfile'
terraform-aws-role-with-privilege-escalation-by-actions-iam-updateloginprofile
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction'
terraform-aws-role-with-privilege-escalation-by-actions-iam-passrole-and-lambda-createfunction-lambda-invokefunction
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Role with privilege escalation by actions 'lambda:UpdateFunctionCode'
terraform-aws-role-with-privilege-escalation-by-actions-lambda-updatefunctioncode
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Root account has active access keys
terraform-aws-root-account-has-active-access-keys
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Route53 record undefined
terraform-aws-route53-record-undefined
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket access to any principal
terraform-aws-s3-bucket-access-to-any-principal
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket ACL allows read or write to all users
terraform-aws-s3-bucket-acl-allows-read-or-write-to-all-users
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket ACL allows read to any authenticated user
terraform-aws-s3-bucket-acl-allows-read-to-any-authenticated-user
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket ACL grants WRITE_ACP permission
terraform-aws-s3-bucket-acl-grants-write-acp-permission
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows authenticated users access
terraform-aws-s3-bucket-allows-access-to-all-authenticated-users
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows delete action from all principals
terraform-aws-s3-bucket-allows-delete-action-from-all-principals
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows get action from all principals
terraform-aws-s3-bucket-allows-get-action-from-all-principals
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows list action from all principals
terraform-aws-s3-bucket-allows-list-action-from-all-principals
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows public ACL
terraform-aws-s3-bucket-allows-public-acl
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows public policy
terraform-aws-s3-bucket-with-public-policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket allows put action from all principals
terraform-aws-s3-bucket-allows-put-action-from-all-principals
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket logging disabled
terraform-aws-s3-bucket-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket object not encrypted
terraform-aws-s3-bucket-object-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket object-level CloudTrail logging disabled
terraform-aws-s3-bucket-object-level-cloudtrail-logging-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket policy accepts HTTP requests
terraform-aws-s3-bucket-policy-accepts-http-requests
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket public ACL overridden by public access block
terraform-aws-s3-bucket-public-acl-overridden-by-public-access-block
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket with all permissions
terraform-aws-s3-bucket-with-all-permissions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket with unsecured CORS rule
terraform-aws-s3-bucket-with-unsecured-cors-rule
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket without enabled MFA delete
terraform-aws-s3-bucket-without-enabled-mfa-delete
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket without ignore public ACL
terraform-aws-s3-bucket-without-ignore-public-acl
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket without restriction of public bucket
terraform-aws-s3-bucket-without-restriction-of-public-bucket
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 bucket without versioning
terraform-aws-s3-bucket-without-versioning
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg S3 static website host enabled
terraform-aws-s3-static-website-host-enabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SageMaker endpoint configuration encryption disabled
terraform-aws-sagemaker-endpoint-configuration-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SageMaker notebook instance without KMS
terraform-aws-sagemaker-notebook-instance-without-kms
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SageMaker notebook internet access enabled
terraform-aws-sagemaker-direct-internet-access-enabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Secrets Manager secret encrypted with AWS-managed key
terraform-aws-secretsmanager-secret-encrypted-with-aws-managed-key
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Secrets Manager secret without KMS
terraform-aws-secretsmanager-secret-without-kms
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Secrets Manager with vulnerable policy
terraform-aws-secrets-manager-with-vulnerable-policy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Secure ciphers disabled
terraform-aws-secure-ciphers-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security group not used
terraform-aws-security-groups-not-used
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security group rule without description
terraform-aws-security-group-rules-without-description
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security group rule without description
terraform-aws-security-group-without-description
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Security group with unrestricted access to SSH
terraform-aws-security-group-with-unrestricted-access-to-ssh
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Sensitive port is exposed to entire network
terraform-aws-sensitive-port-is-exposed-to-entire-network
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Sensitive port is exposed to small public network
terraform-aws-sensitive-port-is-exposed-to-small-public-network
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Sensitive port is exposed to wide private network
terraform-aws-sensitive-port-is-exposed-to-wide-private-network
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Service control policies disabled
terraform-aws-service-control-policies-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SES policy with allowed IAM actions
terraform-aws-ses-policy-with-allowed-iam-actions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Shield Advanced not in use
terraform-aws-shield-advanced-not-in-use
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SNS topic encrypted with AWS managed key
terraform-aws-sns-topic-encrypted-with-aws-managed-key
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SNS topic is publicly accessible
terraform-aws-sns-topic-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SNS topic not encrypted
terraform-aws-sns-topic-not-encrypted
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SNS topic publicity has allow and NotAction simultaneously
terraform-aws-sns-topic-publicity-has-allow-and-not-action-simultaneously
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SQL analysis services port 2383 (TCP) is publicly accessible
terraform-aws-sql-analysis-services-port-2383-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SQS policy allows all actions
terraform-aws-sqs-policy-allows-all-actions
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SQS policy with public access
terraform-aws-sqs-policy-with-public-access
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SQS queue exposed
terraform-aws-sqs-queue-exposed
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SQS VPC endpoint without DNS resolution
terraform-aws-sqs-vpc-endpoint-without-dns-resolution
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SQS with SSE disabled
terraform-aws-sqs-with-sse-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SSM session transit encryption disabled
terraform-aws-ssm-session-transit-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SSO identity user unsafe creation
terraform-aws-sso-identity-user-unsafe-creation
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SSO permission with inadequate user session duration
terraform-aws-sso-permission-with-inadequate-user-session-duration
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg SSO policy with full privileges
terraform-aws-sso-policy-with-full-privileges
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Stack notifications disabled
terraform-aws-stack-notifications-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Stack retention disabled
terraform-aws-stack-retention-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Stack without template
terraform-aws-stack-without-template
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Team tag missing on AWS resource
terraform-aws-team-tag-not-present
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Unknown port exposed to internet
terraform-aws-unknown-port-exposed-to-internet
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Unrestricted security group ingress
terraform-aws-unrestricted-security-group-ingress
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Unscanned ECR image
terraform-aws-unscanned-ecr-image
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User data contains encoded private key
terraform-aws-user-data-contains-encoded-private-key
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole'
terraform-aws-user-with-privilege-escalation-by-actions-iam-passrole-and-cloudformation-createstack
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'
terraform-aws-user-with-privilege-escalation-by-actions-iam-passrole-and-ec2-runinstances
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole'
terraform-aws-user-with-privilege-escalation-by-actions-iam-passrole-and-glue-createdevendpoint
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'glue:UpdateDevEndpoint'
terraform-aws-user-with-privilege-escalation-by-actions-glue-updatedevendpoint
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:AddUserToGroup'
terraform-aws-user-with-privilege-escalation-by-actions-iam-addusertogroup
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:AttachGroupPolicy'
terraform-aws-user-with-privilege-escalation-by-actions-iam-attachgrouppolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:AttachRolePolicy'
terraform-aws-user-with-privilege-escalation-by-actions-iam-attachrolepolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:AttachUserPolicy'
terraform-aws-user-with-privilege-escalation-by-actions-iam-attachuserpolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:CreateAccessKey'
terraform-aws-user-with-privilege-escalation-by-actions-iam-createaccesskey
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:CreateLoginProfile'
terraform-aws-user-with-privilege-escalation-by-actions-iam-createloginprofile
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:CreatePolicyVersion'
terraform-aws-user-with-privilege-escalation-by-actions-iam-createpolicyversion
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:PutGroupPolicy'
terraform-aws-user-with-privilege-escalation-by-actions-iam-putgrouppolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:PutRolePolicy'
terraform-aws-user-with-privilege-escalation-by-actions-iam-putrolepolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:PutUserPolicy'
terraform-aws-user-with-privilege-escalation-by-actions-iam-putuserpolicy
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:SetDefaultPolicyVersion'
terraform-aws-user-with-privilege-escalation-by-actions-iam-setdefaultpolicyversion
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole'
terraform-aws-user-with-privilege-escalation-by-actions-iam-updateassumerolepolicy-and-sts-assumerole
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'iam:UpdateLoginProfile'
terraform-aws-user-with-privilege-escalation-by-actions-iam-updateloginprofile
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction'
terraform-aws-user-with-privilege-escalation-by-actions-iam-passrole-and-lambda-createfunction-and-lambda-invokefunction
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg User with privilege escalation by actions 'lambda:UpdateFunctionCode'
terraform-aws-user-with-privilege-escalation-by-actions-lambda-updatefunctioncode
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg VPC default security group accepts all traffic
terraform-aws-vpc-default-security-group-accepts-all-traffic
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg VPC Flow Logs disabled
terraform-aws-vpc-flowlogs-disabled
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg VPC peering route table with unrestricted CIDR
terraform-aws-vpc-peering-route-table-with-unrestricted-cidr
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg VPC subnet assigns public IP
terraform-aws-vpc-subnet-assigns-public-ip
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg VPC without Network Firewall
terraform-aws-vpc-without-network-firewall
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Vulnerable default SSL certificate
terraform-aws-vulnerable-default-ssl-certificate
>
https://static.datadoghq.com/static/images/logos/amazon-web-services_avatar.svg Workspaces workspace volume not encrypted
terraform-aws-workspaces-workspace-volume-not-encrypted
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg AD admin not configured for SQL server
terraform-azure-ad-admin-not-configured-for-sql-server
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Admin user enabled for container registry
terraform-azure-admin-user-enabled-for-container-registry
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg AKS disk encryption set ID undefined
terraform-azure-aks-disk-encryption-set-id-undefined
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg AKS network policy misconfigured
terraform-azure-aks-network-policy-misconfigured
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg AKS private cluster disabled
terraform-azure-aks-private-cluster-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg AKS RBAC disabled
terraform-azure-aks-rbac-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg App Service authentication disabled
terraform-azure-app-service-authentication-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg App Service FTPS enforce disabled
terraform-azure-app-service-ftps-enforce-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg App Service HTTP2 disabled
terraform-azure-app-service-http2-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg App Service managed identity disabled
terraform-azure-app-service-managed-identity-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg App Service not using latest TLS encryption version
terraform-azure-app-service-not-using-latest-tls-encryption-version
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg App Service without latest PHP version
terraform-azure-app-service-without-latest-php-version
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg App Service without latest Python version
terraform-azure-app-service-without-latest-python-version
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Azure Active Directory authentication
terraform-azure-azure-active-directory-authentication
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Azure App Service client certificate disabled
terraform-azure-azure-app-service-client-certificate-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Azure Cognitive Search public network access enabled
terraform-azure-azure-cognitive-search-public-network-access-enabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Azure Container Registry with no locks
terraform-azure-azure-container-registry-with-no-locks
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Azure Front Door WAF disabled
terraform-azure-azure-front-door-waf-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Azure instance using basic authentication
terraform-azure-azure-instance-using-basic-authentication
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Azure Policy Add-on Disabled in AKS Cluster
terraform-azure-aks-uses-azure-policies-addon-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Cosmos DB account without tags
terraform-azure-cosmos-db-account-without-tags
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg CosmosDB account IP range filter not set
terraform-azure-cosmosdb-account-ip-range-filter-not-set
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Dashboard is enabled
terraform-azure-dashboard-is-enabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Default Azure storage account network access is too permissive
terraform-azure-default-azure-storage-account-network-access-is-too-permissive
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Email alerts disabled
terraform-azure-email-alerts-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Encryption on managed disk disabled
terraform-azure-encryption-on-managed-disk-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Ensure Azure MariaDB server is using latest TLS (1.2)
terraform-azure-mariadb-not-using-latest-tls
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Ensure MySQL is using the latest version of TLS encryption
terraform-azure-mysql-not-using-latest-tls
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Ensure that Azure cloud resource has a team tag
terraform-azure-team-tag-not-present
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Ensure that PostgreSQL server disables public network access
terraform-azure-postgres-sql-server-enables-public-access
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Ensure that UDP services are restricted from the Internet
terraform-azure-udp-services-not-restricted-from-internet
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Ensure web app is not remotely debuggable
terraform-azure-remote-debugging-enabled-app-service
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Firewall rule allows too many hosts to access Redis Cache
terraform-azure-firewall-rule-allows-too-many-hosts-to-access-redis-cache
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Function App authentication disabled
terraform-azure-function-app-authentication-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Function App client certificates not required
terraform-azure-function-app-client-certificates-unrequired
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Function App FTPS enforce disabled
terraform-azure-function-app-ftps-enforce-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Function App HTTP2 disabled
terraform-azure-function-app-http2-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Function App managed identity disabled
terraform-azure-function-app-managed-identity-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Function App not using latest TLS encryption version
terraform-azure-function-app-not-using-latest-tls-encryption-version
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Geo redundancy is disabled
terraform-azure-geo-redundancy-is-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Key expiration not set
terraform-azure-key-expiration-not-set
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Key Vault secrets content type undefined
terraform-azure-key-vault-secrets-content-type-undefined
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Log retention is not set
terraform-azure-log-retention-is-not-set
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg MariaDB server geo-redundant backup disabled
terraform-azure-mariadb-server-georedundant-backup-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg MariaDB server public network access enabled
terraform-azure-mariadb-public-network-access-enabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg MSSQL server auditing disabled
terraform-azure-mssql-server-auditing-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg MSSQL server public network access enabled
terraform-azure-mssql-server-public-network-access-enabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg MySQL server public access enabled
terraform-azure-mysql-server-public-access-enabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg MySQL SSL connection disabled
terraform-azure-mysql-ssl-connection-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Network interfaces IP forwarding enabled
terraform-azure-network-interfaces-ip-forwarding-enabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Network interfaces with public IP
terraform-azure-network-interfaces-with-public-ip
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Network watcher flow disabled
terraform-azure-network-watcher-flow-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg PostgreSQL log checkpoints disabled
terraform-azure-postgresql-log-checkpoints-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg PostgreSQL log connections not set
terraform-azure-postgresql-log-connections-not-set
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg PostgreSQL log disconnections not set
terraform-azure-postgresql-log-disconnections-not-set
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg PostgreSQL log duration not set
terraform-azure-postgresql-log-duration-not-set
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg PostgreSQL server infrastructure encryption disabled
terraform-azure-postgresql-server-infrastructure-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg PostgreSQL Server threat detection policy disabled
terraform-azure-postgresql-server-threat-detection-policy-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg PostgreSQL server without connection throttling
terraform-azure-postgresql-server-without-connection-throttling
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Public storage account
terraform-azure-public-storage-account
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg RDP is exposed to the internet
terraform-azure-rdp-is-exposed-to-the-internet
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Redis cache allows non SSL connections
terraform-azure-redis-cache-allows-non-ssl-connections
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Redis entirely accessible
terraform-azure-redis-entirely-accessible
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Redis not updated regularly
terraform-azure-redis-not-updated-regularly
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Redis publicly accessible
terraform-azure-redis-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Role assignment not limit guest user permissions
terraform-azure-role-assignment-not-limit-guest-users-permissions
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Role definition allows custom role creation
terraform-azure-role-definition-allows-custom-role-creation
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Secret expiration not set
terraform-azure-secret-expiration-not-set
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Security center pricing tier is not standard
terraform-azure-security-center-pricing-tier-is-not-standard
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Security contact email
terraform-azure-security-contact-email
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Security group is not configured
terraform-azure-security-group-is-not-configured
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Sensitive port is exposed to entire network
terraform-azure-sensitive-port-is-exposed-to-entire-network
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Sensitive port is exposed to small public network
terraform-azure-sensitive-port-is-exposed-to-small-public-network
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Sensitive port is exposed to wide private network
terraform-azure-sensitive-port-is-exposed-to-wide-private-network
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Small activity log retention period
terraform-azure-small-activity-log-retention-period
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Small flow logs retention period
terraform-azure-small-flow-logs-retention-period
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Small MSSQL audit retention period
terraform-azure-small-mssql-audit-retention-period
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Small MSSQL server audit retention
terraform-azure-small-msql-server-audit-retention
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Small PostgreSQL DB server log retention period
terraform-azure-small-postgresql-db-server-log-retention-period
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg SQL database audit disabled
terraform-azure-sql-database-audit-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg SQL server alert email disabled
terraform-azure-sql-server-alert-email-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg SQL server auditing disabled
terraform-azure-sql-server-auditing-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg SQL server predictable Active Directory admin account name
terraform-azure-sql-server-predictable-active-directory-admin-account-name
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg SQL server predictable admin account name
terraform-azure-sql-server-predictable-admin-account-name
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Sqlserver ingress from any IP
terraform-azure-sql-server-ingress-from-any-ip
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg SSH is exposed to the Internet
terraform-azure-ssh-is-exposed-to-the-internet
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg SSL enforce disabled
terraform-azure-ssl-enforce-is-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg ssl_enforcement_enabled is not set to ENABLED for MySQL database server
terraform-azure-mysql-enforce-ssl-connection-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg ssl_enforcement_enabled is not set to ENABLED for PostgreSQL database server
terraform-azure-postgres-enforce-ssl-connection-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Storage account not forcing HTTPS
terraform-azure-storage-account-not-forcing-https
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Storage account not using latest TLS encryption version
terraform-azure-storage-account-not-using-latest-tls-encryption-version
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Storage container is publicly accessible
terraform-azure-storage-container-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Storage share file allows all ACL permissions
terraform-azure-storage-share-file-allows-all-acl-permissions
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Storage table allows all ACL permissions
terraform-azure-storage-table-allows-all-acl-permissions
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Trusted Microsoft services not enabled
terraform-azure-trusted-microsoft-services-not-enabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Unrestricted SQL server access
terraform-azure-unrestricted-sql-server-access
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Vault auditing disabled
terraform-azure-vault-auditing-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Virtual network with DDoS protection plan disabled
terraform-azure-virtual-network-with-ddos-protection-plan-disabled
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg VM not attached to network
terraform-azure-vm-not-attached-to-network
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg WAF is disabled for Azure application gateway
terraform-azure-waf-is-disabled-for-azure-application-gateway
>
https://static.datadoghq.com/static/images/logos/azure_avatar.svg Web app accepting traffic other than HTTPS
terraform-azure-web-app-accepting-traffic-other-than-https
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Artifact Registry repo is public
terraform-gcp-artifact-registry-repository-is-public
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg BigQuery dataset is public
terraform-gcp-bigquery-dataset-is-public
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg BigQuery table is public
terraform-gcp-bigquery-table-is-public
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud DNS without DNSSEC
terraform-gcp-cloud-dns-without-dnssec
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud KMS key ring is anonymously or publicly accessible
terraform-gcp-cloud-kms-key-rings-are-public
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud Run service is public
terraform-gcp-cloud-run-service-is-public
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud Storage bucket is publicly accessible
terraform-gcp-cloud-storage-bucket-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud Storage bucket logging not enabled
terraform-gcp-cloud-storage-bucket-logging-not-enabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud Storage bucket versioning disabled
terraform-gcp-cloud-storage-bucket-versioning-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cloud Storage is anonymous or publicly accessible
terraform-gcp-cloud-storage-anonymous-or-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Cluster labels disabled
terraform-gcp-cluster-labels-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Container Registry repo is public
terraform-gcp-container-registry-repository-is-public
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg COS node image not used
terraform-gcp-cos-node-image-not-used
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Dataproc clusters has public IPs
terraform-gcp-dataproc-cluster-has-public-ip
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Dataproc clusters publicly accessible
terraform-gcp-dataproc-clusters-is-public
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Disk encryption disabled
terraform-gcp-disk-encryption-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg DNSSEC using RSASHA1
terraform-gcp-dnssec-using-rsasha1
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Ensure legacy networks do not exist for a project
terraform-gcp-legacy-networks-exist-for-project
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Ensure SQL database instance has skip show database flag
terraform-gcp-sql-database-instance-does-not-have-skip-show-database
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg GKE control plane is public
terraform-gcp-gke-control-plane-is-public
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg GKE legacy authorization enabled
terraform-gcp-gke-legacy-authorization-enabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg GKE using default service account
terraform-gcp-gke-using-default-service-account
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute firewall ingress allows unrestricted FTP access
terraform-gcp-firewall-ingress-allows-unrestricted-ftp-access
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute firewall ingress allows unrestricted MySQL access
terraform-gcp-firewall-ingress-allows-unrestricted-mysql-access
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute network using default firewall rule
terraform-gcp-google-compute-network-using-default-firewall-rule
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute network using firewall rule that allows all ports
terraform-gcp-google-compute-network-using-firewall-rule-allows-all-ports
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute network using firewall rule that allows port range
terraform-gcp-google-compute-network-using-firewall-rule-allows-port-range
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute SSL policy weak cipher in use
terraform-gcp-google-compute-ssl-policy-weak-cipher-in-use
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute subnetwork logging disabled
terraform-gcp-google-compute-subnetwork-logging-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Compute subnetwork with private Google access disabled
terraform-gcp-google-compute-subnetwork-with-private-google-access-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Container node pool auto repair disabled
terraform-gcp-google-container-node-pool-auto-repair-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google project auto create network disabled
terraform-gcp-google-project-auto-create-network-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google project IAM binding service account has token creator or account user role
terraform-gcp-google-project-iam-binding-service-account-has-token-creator-or-account-user-role
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google project IAM member service account has admin role
terraform-gcp-google-project-iam-member-service-account-has-admin-role
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google project IAM member service account has token creator or account user role
terraform-gcp-google-project-iam-member-service-account-has-token-creator-or-account-user-role
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Google Storage bucket level access disabled
terraform-gcp-google-storage-bucket-level-access-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg High Google KMS crypto key rotation period
terraform-gcp-high-google-kms-crypto-key-rotation-period
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg IAM audit not properly configured
terraform-gcp-iam-audit-not-properly-configured
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg IP aliasing disabled
terraform-gcp-ip-aliasing-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg IP forwarding enabled
terraform-gcp-ip-forwarding-enabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg KMS admin and CryptoKey roles in use
terraform-gcp-kms-admin-and-crypto-key-roles-in-use
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg KMS CryptoKey is publicly accessible
terraform-gcp-kms-crypto-key-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Legacy client certificate auth enabled
terraform-gcp-legacy-client-certificate-auth-enabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Network policy disabled
terraform-gcp-network-policy-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Node auto upgrade disabled
terraform-gcp-node-auto-upgrade-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Not proper email account in use
terraform-gcp-not-proper-email-account-in-use
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg OSLogin disabled
terraform-gcp-os-login-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg OSLogin is disabled for VM instance
terraform-gcp-os-login-is-disabled-for-vm-instance
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Outdated GKE version
terraform-gcp-outdated-gke-version
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Pod security policy disabled
terraform-gcp-pod-security-policy-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Private cluster disabled
terraform-gcp-private-cluster-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Project-wide SSH keys are enabled in VM instances
terraform-gcp-project-wide-ssh-keys-are-enabled-in-vm-instances
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Pub/Sub Topics are anonymously or publicly accessible
terraform-gcp-pubsub-topic-is-public
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg RDP access is not restricted
terraform-gcp-rdp-access-is-not-restricted
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Serial ports are enabled for VM instances
terraform-gcp-vm-serial-ports-are-enabled-for-vm-instances
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Service account with improper privileges
terraform-gcp-service-account-with-improper-privileges
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Shielded GKE nodes disabled
terraform-gcp-shielded-gke-nodes-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Shielded VM disabled
terraform-gcp-shielded-vm-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg SQL DB instance backup disabled
terraform-gcp-sql-db-instance-backup-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg SQL DB instance publicly accessible
terraform-gcp-sql-db-instance-is-publicly-accessible
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg SQL DB instance with SSL disabled
terraform-gcp-sql-db-instance-with-ssl-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg SQL Server cross DB ownership chaining enabled
terraform-gcp-sql-database-has-cross-db-ownership-chaining
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg SSH access is not restricted
terraform-gcp-ssh-access-is-not-restricted
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Stackdriver Logging disabled
terraform-gcp-stackdriver-logging-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Stackdriver Monitoring disabled
terraform-gcp-stackdriver-monitoring-disabled
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Team label missing on GCP resource
terraform-gcp-team-label-not-present
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg There are non GCP-managed service account keys for a service account
terraform-gcp-service-has-non-gcp-managed-service-account-keys
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg User with IAM role
terraform-gcp-user-with-iam-role
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg Using default service account
terraform-gcp-using-default-service-account
>
https://static.datadoghq.com/static/images/logos/google-cloud-platform_avatar.svg VM with full cloud access
terraform-gcp-vm-with-full-cloud-access
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Cluster admin rolebinding with superuser permissions
terraform-kubernetes-cluster-admin-role-binding-with-super-user-permissions
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Cluster allows unsafe sysctls
terraform-kubernetes-cluster-allows-unsafe-sysctls
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Container host PID is true
terraform-kubernetes-container-host-pid-is-true
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Container is privileged
terraform-kubernetes-container-is-privileged
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Container resources limits undefined
terraform-kubernetes-container-resources-limits-undefined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Container runs unmasked
terraform-kubernetes-container-runs-unmasked
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Containers with added capabilities
terraform-kubernetes-container-with-added-capabilities
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Containers with sys admin capabilities
terraform-kubernetes-containers-with-sys-admin-capabilities
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg CPU limits not set
terraform-kubernetes-cpu-limits-not-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg CPU requests not set
terraform-kubernetes-cpu-requests-not-set
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg CronJob deadline not configured
terraform-kubernetes-cronjob-deadline-not-configured
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Default service account in use
terraform-kubernetes-default-service-account-in-use
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Deployment has no podAntiAffinity
terraform-kubernetes-deployment-has-no-pod-anti-affinity
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Deployment without PodDisruptionBudget
terraform-kubernetes-deployment-without-pod-disruption-budget
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Docker daemon socket is exposed to containers
terraform-kubernetes-docker-daemon-socket-is-exposed-to-containers
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg HPA targets invalid object
terraform-kubernetes-hpa-targets-invalid-object
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Image pull policy of the container is not set to always
terraform-kubernetes-image-pull-policy-of-container-is-not-always
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Image without digest
terraform-kubernetes-image-without-digest
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Incorrect volume claim access mode ReadWriteOnce
terraform-kubernetes-incorrect-volume-claim-access-mode-read-write-once
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Ingress controller exposes workload
terraform-kubernetes-ingress-controller-exposes-workload
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Invalid image
terraform-kubernetes-invalid-image
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Liveness probe is not defined
terraform-kubernetes-liveness-probe-is-not-defined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Memory limits not defined
terraform-kubernetes-memory-limits-not-defined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Memory requests not defined
terraform-kubernetes-memory-requests-not-defined
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Metadata label is invalid
terraform-kubernetes-metadata-label-is-invalid
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Missing AppArmor config
terraform-kubernetes-missing-app-armor-config
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg NET_RAW capabilities disabled for PSP
terraform-kubernetes-net-raw-capabilities-disabled-for-psp
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg NET_RAW capabilities not being dropped
terraform-kubernetes-net-raw-capabilities-not-being-dropped
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Network policy is not targeting any pod
terraform-kubernetes-network-policy-is-not-targeting-any-pod
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg No drop capabilities for containers
terraform-kubernetes-no-drop-capabilities-for-containers
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Non kube system pod with host mount
terraform-kubernetes-non-kube-system-pod-with-host-mount
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Permissive access to create pods
terraform-kubernetes-permissive-access-to-create-pods
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Pod or container without security context
terraform-kubernetes-pod-or-container-without-security-context
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Privilege escalation allowed
terraform-kubernetes-privilege-escalation-allowed
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg PSP allows containers to share the host network namespace
terraform-kubernetes-psp-allows-containers-to-share-the-host-network-namespace
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg PSP allows privilege escalation
terraform-kubernetes-psp-allows-privilege-escalation
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg PSP allows sharing host IPC
terraform-kubernetes-psp-allows-sharing-host-ipc
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg PSP set to privileged
terraform-kubernetes-psp-set-to-privileged
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg PSP with added capabilities
terraform-kubernetes-psp-with-added-capabilities
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg RBAC roles with read secrets permissions
terraform-kubernetes-rbac-roles-with-read-secrets-permissions
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Readiness probe is not configured
terraform-kubernetes-readiness-probe-is-not-configured
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Role binding to default service account
terraform-kubernetes-role-binding-to-default-service-account
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Root container not mounted as read-only
terraform-kubernetes-root-container-not-mounted-as-read-only
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Root containers admitted
terraform-kubernetes-root-containers-admitted
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Seccomp profile is not configured
terraform-kubernetes-seccomp-profile-is-not-configured
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Secrets as environment variables
terraform-kubernetes-secrets-as-environment-variables
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service account allows access secrets
terraform-kubernetes-service-account-allows-access-secrets
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service account name undefined or empty
terraform-kubernetes-service-account-name-undefined-or-empty
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service account token automount not disabled
terraform-kubernetes-service-account-token-automount-not-disabled
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service type is NodePort
terraform-kubernetes-service-type-is-nodeport
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Service with external load balancer
terraform-kubernetes-service-with-external-load-balancer
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Shared host IPC namespace
terraform-kubernetes-shared-host-ipc-namespace
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Shared host network namespace
terraform-kubernetes-shared-host-network-namespace
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Shared service account
terraform-kubernetes-shared-service-account
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg StatefulSet requests storage
terraform-kubernetes-statefulset-requests-storage
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg StatefulSet without PodDisruptionBudget
terraform-kubernetes-statefulset-without-pod-disruption-budget
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg StatefulSet without service name
terraform-kubernetes-statefulset-without-service-name
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Tiller (Helm v2) is deployed
terraform-kubernetes-tiller-is-deployed
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Using default namespace
terraform-kubernetes-using-default-namespace
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Volume mount with OS directory write permissions
terraform-kubernetes-volume-mount-with-os-directory-write-permissions
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Workload host port not specified
terraform-kubernetes-workload-host-port-not-specified
>
https://static.datadoghq.com/static/images/logos/kubernetes_avatar.svg Workload mounting with sensitive OS directory
terraform-kubernetes-workload-mounting-with-sensitive-os-directory
>
NIFCLOUD computing has common private network
terraform-nifcloud-computing-instance-has-common-private
>
NIFCLOUD computing has public ingress security group rule
terraform-nifcloud-computing-instance-has-public-ingress-sgr
>
NIFCLOUD computing undefined description to security group
terraform-nifcloud-computing-security-group-description-undefined
>
NIFCLOUD computing undefined description to security group rule
terraform-nifcloud-computing-security-group-rule-description-undefined
>
NIFCLOUD computing undefined security group to instance
terraform-nifcloud-computing-instance-security-group-undefined
>
NIFCLOUD DNS has verified record
terraform-nifcloud-dns-has-verified-record
>
NIFCLOUD ELB has common private network
terraform-nifcloud-elb-has-common-private
>
NIFCLOUD ELB listener using HTTP protocol
terraform-nifcloud-elb-listener-use-http
>
NIFCLOUD ELB using HTTP protocol
terraform-nifcloud-elb-use-http
>
NIFCLOUD LB listener using HTTP port
terraform-nifcloud-load-balancer-listener-use-http
>
NIFCLOUD LB using HTTP port
terraform-nifcloud-load-balancer-use-http
>
NIFCLOUD LB using insecure TLS policy ID
terraform-nifcloud-load-balancer-use-insecure-tls-policy-id
>
NIFCLOUD LB using insecure TLS policy name
terraform-nifcloud-load-balancer-use-insecure-tls-policy-name
>
NIFCLOUD NAS has common private network
terraform-nifcloud-nas-instance-has-common-private
>
NIFCLOUD NAS has public ingress NAS security group rule
terraform-nifcloud-nas-security-group-has-public-ingress-sgr
>
NIFCLOUD NAS undefined description to NAS security group
terraform-nifcloud-nas-security-group-description-undefined
>
NIFCLOUD RDB backup retention period below 7 days
terraform-nifcloud-db-does-not-have-long-backup-retention
>
NIFCLOUD RDB has common private network
terraform-nifcloud-db-instance-has-common-private
>
NIFCLOUD RDB has public DB access
terraform-nifcloud-db-has-public-access
>
NIFCLOUD RDB has public DB ingress security group rule
terraform-nifcloud-db-security-group-has-public-ingress-sgr
>
NIFCLOUD RDB undefined description to DB security group
terraform-nifcloud-db-security-group-description-undefined
>
NIFCLOUD router has common private network
terraform-nifcloud-router-has-common-private
>
NIFCLOUD router undefined security group
terraform-nifcloud-router-security-group-undefined
>
NIFCLOUD VPN gateway undefined security group
terraform-nifcloud-vpn-gateway-security-group-undefined
>

Further Reading

추가 유용한 문서, 링크 및 기사:

IaC 보안 설정설명서 more more IaC 보안 구성설명서 more more