Infrastructure as Code (IaC) Security identifies misconfigurations and security risks in infrastructure-as-code files before deployment, helping ensure that cloud environments remain secure and compliant.
Note: For Helm resolution to work correctly, each chart directory must include the charts it depends on. For details, see Chart File Structure in the Helm documentation.

Run block injection

run_block_injection

>

Script block injection

script_block_injection

>

Unpinned actions full length commit SHA

unpinned_actions_full_length_commit_sha

>

Unsecured commands

unsecured_commands

>

>

Always admit admission control plugin set

always_admit_admission_control_plugin_set

>

Always pull images admission control plugin not set

always_pull_images_admission_control_plugin_not_set

>

Anonymous auth is not set to false

anonymous_auth_is_not_set_to_false

>

Audit log maxage not properly set

audit_log_maxage_not_properly_set

>

Audit log maxbackup not properly set

audit_log_maxbackup_not_properly_set

>

Audit log maxsize not properly set

audit_log_maxsize_not_properly_set

>

Audit log path not set

audit_log_path_not_set

>

Audit policy does not cover key security concerns

audit_policy_not_cover_key_security_concerns

>

Audit policy file not defined

audit_policy_file_not_defined

>

Authorization mode node not set

authorization_mode_node_not_set

>

Authorization mode RBAC not set

authorization_mode_rbac_not_set

>

Authorization mode set to always allow

authorization_mode_set_to_always_allow

>

Auto TLS set to true

auto_tls_set_to_true

>

Basic auth file is set

basic_auth_file_is_set

>

Bind address not properly set

bind_address_not_properly_set

>

Certificate authority is not unique

not_unique_certificate_authority

>

Client certificate authentication not set up properly

client_certificate_authentication_not_setup_properly

>

Cluster admin rolebinding with superuser permissions

cluster_admin_role_binding_with_super_user_permissions

>

Cluster allows unsafe sysctls

cluster_allows_unsafe_sysctls

>

CNI plugin does not support network policies

cni_plugin_does_not_support_network_policies

>

Container is privileged

container_is_privileged

>

Container running as root

containers_running_as_root

>

Container with low UID

containers_run_with_low_uid

>

Container with unmasked /proc access

container_runs_unmasked

>

Containers missing drop capabilities

no_drop_capabilities_for_containers

>

Containers with added capabilities

containers_with_added_capabilities

>

Containers with sys admin capabilities

containers_with_sys_admin_capabilities

>

CPU limits not set

cpu_limits_not_set

>

CPU requests not set

cpu_requests_not_set

>

CronJob deadline not configured

cronjob_deadline_not_configured

>

Dashboard is enabled

dashboard_is_enabled

>

Deployment without podAntiAffinity

deployment_has_no_pod_anti_affinity

>

Deployment without PodDisruptionBudget

deployment_without_pod_disruption_budget

>

Docker daemon socket is exposed to containers

docker_daemon_socket_is_exposed_to_containers

>

Encryption provider config is not defined

encryption_provider_config_is_not_defined

>

Encryption provider not properly configured

encryption_provider_not_properly_configured

>

Ensure administrative boundaries between resources

ensure_administrative_boundaries_between_resources

>

etcd client certificate authentication set to false

etcd_client_certificate_authentication_set_to_false

>

etcd client certificate file not defined

etcd_client_certificate_file_not_defined

>

etcd peer client certificate authentication set to false

etcd_peer_client_certificate_authentication_set_to_false

>

etcd peer TLS certificate files not properly set

etcd_peer_tls_certificate_files_not_properly_set

>

etcd TLS certificate files not properly set

etcd_tls_certificate_files_not_properly_set

>

etcd TLS certificate not properly configured

etcd_tls_certificate_not_properly_configured

>

Event rate limit admission control plugin not set

event_rate_limit_admission_control_plugin_not_set

>

HPA targeted deployments with configured replica count

hpa_targeted_deployments_with_configured_replica_count

>

HPA targets invalid object

hpa_targets_invalid_object

>

Image policy webhook admission control plugin not set

image_policy_webhook_admission_control_plugin_not_set

>

Image pull policy of the container is not set to always

image_pull_policy_of_container_is_not_always

>

Image without digest

image_without_digest

>

Incorrect volume claim access mode ReadWriteOnce

incorrect_volume_claim_access_mode_read_write_once

>

Ingress controller exposes workload

ingress_controller_exposes_workload

>

Insecure bind address set

insecure_bind_address_set

>

Insecure port not properly set

insecure_port_not_properly_set

>

Invalid image tag

invalid_image

>

Invalid metadata label

metadata_label_is_invalid

>

Kubelet certificate authority not set

kubelet_certificate_authority_not_set

>

Kubelet client certificate or key not set

kubelet_client_certificate_or_key_not_set

>

Kubelet client periodic certificate switch disabled

kubelet_client_periodic_certificate_switch_disabled

>

Kubelet event QPS not properly set

kubelet_event_qps_not_properly_set

>

Kubelet hostname override is set

kubelet_hostname_override_is_set

>

Kubelet HTTPS set to false

kubelet_https_set_to_false

>

Kubelet not managing IP tables

kubelet_not_managing_ip_tables

>

Kubelet protect-kernel-defaults set to false

kubelet_protect_kernel_defaults_set_to_false

>

Kubelet read-only port is not set to zero

kubelet_read_only_port_is_not_set_to_zero

>

Kubelet streaming connection timeout disabled

kubelet_streaming_connection_timeout_disabled

>

Liveness probe is not defined

liveness_probe_is_not_defined

>

Memory limits not defined

memory_limits_not_defined

>

Memory requests not defined

memory_requests_not_defined

>

Missing AppArmor profile

missing_app_armor_config

>

Namespace lifecycle admission control plugin disabled

namespace_lifecycle_admission_control_plugin_disabled

>

NET_RAW capabilities disabled for PSP

net_raw_capabilities_disabled_for_psp

>

NET_RAW capabilities not dropped

net_raw_capabilities_not_being_dropped

>

Network policy without Pod target

network_policy_is_not_targeting_any_pod

>

Node restriction admission control plugin not set

node_restriction_admission_control_plugin_not_set

>

Non kube-system pod with host mount

non_kube_system_pod_with_host_mount

>

Object is using a deprecated API version

object_is_using_a_deprecated_api_version

>

Peer auto TLS set to true

peer_auto_tls_set_to_true

>

Permissive access to create Pods

permissive_access_to_create_pods

>

Pod misconfigured network policy

pod_misconfigured_network_policy

>

Pod or container without LimitRange

pod_or_container_without_limit_range

>

Pod or container without ResourceQuota

pod_or_container_without_resource_quota

>

Pod or container without security context

pod_or_container_without_security_context

>

Pod security policy admission control plugin not set

pod_security_policy_admission_control_plugin_not_set

>

PodSecurityPolicy allows host network sharing

psp_containers_share_host_network_namespace

>

Privilege escalation allowed

privilege_escalation_allowed

>

Profiling not set to false

profiling_not_set_to_false

>

PSP allows privilege escalation

psp_allows_privilege_escalation

>

PSP allows sharing host IPC

psp_allows_sharing_host_ipc

>

PSP allows sharing host PID

psp_allows_sharing_host_pid

>

PSP set to privileged

psp_set_to_privileged

>

PSP with added capabilities

psp_with_added_capabilities

>

PSP with unrestricted access to host path

psp_with_unrestricted_access_to_host_path

>

RBAC roles allow privilege escalation

rbac_roles_allow_privilege_escalation

>

RBAC roles with attach permission

rbac_roles_with_attach_permission

>

RBAC roles with exec permission

rbac_roles_with_exec_permission

>

RBAC roles with impersonate permission

rbac_roles_with_impersonate_permission

>

RBAC roles with port-forwarding permission

rbac_roles_with_portforwarding_permissions

>

RBAC roles with read secrets permissions

rbac_roles_with_read_secrets_permissions

>

RBAC wildcard in rule

rbac_wildcard_in_rule

>

Readiness probe is not configured

readiness_probe_is_not_configured

>

Request timeout not properly set

request_timeout_not_properly_set

>

Role binding to default service account

role_binding_to_default_service_account

>

Root CA file not defined

root_ca_file_not_defined

>

Root container not mounted as read-only

root_container_not_mounted_as_read_only

>

Root containers admitted

root_containers_admitted

>

Rotate Kubelet server certificate not active

rotate_kubelet_server_certificate_not_active

>

Seccomp profile is not configured

seccomp_profile_is_not_configured

>

Secrets used as environment variables

secrets_as_environment_variables

>

Secure port set to zero

secure_port_set_to_zero

>

Security context deny admission control plugin not set

security_context_deny_admission_control_plugin_not_set

>

Service account admission control plugin disabled

service_account_admission_control_plugin_disabled

>

Service account key file not properly set

service_account_key_file_not_properly_set

>

Service account lookup set to false

service_account_lookup_set_to_false

>

Service account name undefined or empty

service_account_name_undefined_or_empty

>

Service account private key file not defined

service_account_private_key_file_not_defined

>

Service account token auto-mount not disabled

service_account_token_automount_not_disabled

>

Service does not target a Pod

service_does_not_target_pod

>

Service type is NodePort

service_type_is_nodeport

>

Service with external load balancer

service_with_external_load_balancer

>

ServiceAccount allows access to secrets

service_account_allows_access_secrets

>

Shared host IPC namespace

shared_host_ipc_namespace

>

Shared host network namespace

shared_host_network_namespace

>

Shared host PID namespace

shared_host_pid_namespace

>

Shared service account

shared_service_account

>

StatefulSet requests storage

statefulset_requests_storage

>

StatefulSet without podAntiAffinity

statefulset_has_no_pod_anti_affinity

>

StatefulSet without PodDisruptionBudget

statefulset_without_pod_disruption_budget

>

StatefulSet without service name

statefulset_without_service_name

>

Terminated pod garbage collector threshold not properly set

terminated_pod_garbage_collector_threshold_not_properly_set

>

Tiller (Helm v2) deployed

tiller_is_deployed

>

Tiller Deployment accessible within cluster

tiller_deployment_is_accessible_from_within_the_cluster

>

Tiller Service present

tiller_service_is_not_deleted

>

TLS connection certificate not set up

tls_connection_certificate_not_setup

>

Token auth file is set

token_auth_file_is_set

>

Unrestricted capabilities in PodSecurityPolicy

not_limited_capabilities_for_pod_security_policy

>

Use service account credentials not set to true

use_service_account_credentials_not_set_to_true

>

Using Kubernetes native secret management

using_kubernetes_native_secret_management

>

Using unrecommended namespace

using_unrecommended_namespace

>

Volume mount with OS directory write permissions

volume_mount_with_os_directory_write_permissions

>

Weak TLS cipher suites

weak_tls_cipher_suites

>

Workload host port not specified

workload_host_port_not_specified

>

Workload mounting with sensitive OS directory

workload_mounting_with_sensitive_os_directory

>

>

ALB deletion protection disabled

alb_deletion_protection_disabled

>

ALB is not integrated with WAF

alb_is_not_integrated_with_waf

>

ALB listening on HTTP

alb_listening_on_http

>

ALB not dropping invalid headers

alb_not_dropping_invalid_headers

>

Amazon DMS replication instance is publicly accessible

amazon_dms_replication_instance_is_publicly_accessible

>

AmazonMQ broker encryption disabled

amazon_mq_broker_encryption_disabled

>

AMI most recent without owner or filter

ami_owner_missing

>

AMI not encrypted

ami_not_encrypted

>

AMI shared with multiple accounts

ami_shared_with_multiple_accounts

>

API Gateway access logging disabled

api_gateway_access_logging_disabled

>

API Gateway deployment without access log setting

api_gateway_deployment_without_access_log_setting

>

API gateway deployment without API gateway usage plan associated

api_gateway_deployment_without_api_gateway_usage_plan_associated

>

API Gateway endpoint config is not private

api_gateway_endpoint_config_is_not_private

>

API Gateway method does not contains an API key

api_gateway_method_does_not_contains_an_api_key

>

API Gateway method settings cache not encrypted

api_gateway_method_settings_cache_not_encrypted

>

API Gateway stage without API Gateway usage plan associated

api_gateway_stage_without_api_gateway_usage_plan_associated

>

API Gateway with CloudWatch logging disabled

api_gateway_with_cloudwatch_logging_disabled

>

API Gateway with invalid compression

api_gateway_with_invalid_compression

>

API Gateway with open access

api_gateway_with_open_access

>

API Gateway without configured authorizer

api_gateway_without_configured_authorizer

>

API Gateway without security policy

api_gateway_without_security_policy

>

API Gateway without SSL certificate

api_gateway_without_ssl_certificate

>

API Gateway without WAF

api_gateway_without_waf

>

API Gateway X-Ray disabled

api_gateway_xray_disabled

>

Athena database not encrypted

athena_database_not_encrypted

>

Athena workgroup not encrypted

athena_workgroup_not_encrypted

>

Aurora with disabled at rest encryption

aurora_with_disabled_at_rest_encryption

>

Authentication without MFA

authentication_without_mfa

>

Auto scaling group with no associated ELB

auto_scaling_group_with_no_associated_elb

>

Automatic minor upgrades disabled

automatic_minor_upgrades_disabled

>

Autoscaling groups supply tags

autoscaling_groups_supply_tags

>

AWS password policy with unchangeable passwords

aws_password_policy_with_unchangeable_passwords

>

Batch job definition with privileged container properties

batch_job_definition_with_privileged_container_properties

>

CA certificate identifier is outdated

ca_certificate_identifier_is_outdated

>

CDN configuration is missing

cdn_configuration_is_missing

>

Certificate has expired

certificate_has_expired

>

Certificate RSA key bytes lower than 256

certificate_rsa_key_bytes_lower_than_256

>

CloudFront logging disabled

cloudfront_logging_disabled

>

Cloudfront viewer protocol policy allows HTTP

cloudfront_viewer_protocol_policy_allows_http

>

CloudFront without minimum protocol TLS 1.2

cloudfront_without_minimum_protocol_tls_1.2

>

CloudFront without WAF

cloudfront_without_waf

>

CloudTrail log file validation disabled

cloudtrail_log_file_validation_disabled

>

CloudTrail log files not encrypted with KMS

cloudtrail_log_files_not_encrypted_with_kms

>

CloudTrail log files S3 bucket is publicly accessible

cloudtrail_log_files_s3_bucket_is_publicly_accessible

>

CloudTrail log files S3 bucket with logging disabled

cloudtrail_log_files_s3_bucket_with_logging_disabled

>

CloudTrail logging disabled

cloudtrail_logging_disabled

>

CloudTrail multi region disabled

cloudtrail_multi_region_disabled

>

CloudTrail not integrated with CloudWatch

cloudtrail_not_integrated_with_cloudwatch

>

CloudTrail SNS topic name undefined

cloudtrail_sns_topic_name_undefined

>

CloudWatch AWS Config configuration changes alarm missing

cloudwatch_aws_config_configuration_changes_alarm_missing

>

CloudWatch AWS organizations changes missing alarm

cloudwatch_aws_organizations_changes_missing_alarm

>

CloudWatch changes to NACL alarm missing

cloudwatch_changes_to_nacl_alarm_missing

>

Cloudwatch CloudTrail configuration changes alarm missing

cloudwatch_cloudtrail_configuration_changes_alarm_missing

>

CloudWatch console sign-in without MFA alarm missing

cloudwatch_management_console_sign_in_without_mfa_alarm_missing

>

CloudWatch disabling or scheduled deletion of customer created CMK alarm missing

cloudwatch_disabling_or_scheduled_deletion_of_customer_created_cmk_alarm_missing

>

CloudWatch IAM policy changes alarm missing

cloudwatch_iam_policy_changes_alarm_missing

>

CloudWatch log group without KMS

cloudwatch_log_group_not_encrypted

>

CloudWatch logging disabled

cloudwatch_logging_disabled

>

CloudWatch logs destination with vulnerable policy

cloudwatch_logs_destination_with_vulnerable_policy

>

CloudWatch management console auth failed alarm missing

cloudwatch_management_console_auth_failed_alarm_missing

>

CloudWatch metrics disabled

cloudwatch_metrics_disabled

>

CloudWatch network gateways changes alarm missing

cloudwatch_network_gateways_changes_alarm_missing

>

CloudWatch root account use missing

cloudwatch_root_account_use_alarm_missing

>

CloudWatch route table changes alarm missing

cloudwatch_route_table_changes_alarm_missing

>

CloudWatch S3 policy change alarm missing

cloudwatch_s3_policy_change_alarm_missing

>

Cloudwatch security group changes alarm missing

cloudwatch_security_group_changes_alarm_missing

>

CloudWatch unauthorized access alarm missing

cloudwatch_unauthorized_access_defined_alarm_missing

>

CloudWatch VPC changes alarm missing

cloudwatch_vpc_changes_alarm_missing

>

CloudWatch without retention period specified

cloudwatch_without_retention_period_specified

>

CMK is unusable

cmk_is_unusable

>

CMK rotation disabled

cmk_rotation_disabled

>

CodeBuild project encrypted with AWS managed key

codebuild_project_encrypted_with_aws_managed_key

>

Cognito user pool without MFA

cognito_userpool_without_mfa

>

Config rule for encrypted volumes disabled

config_rule_for_encrypted_volumes_is_disabled

>

Configuration aggregator to all regions disabled

config_configuration_aggregator_to_all_regions_disabled

>

Cross-account IAM assume role policy without external id or MFA

cross_account_iam_assume_role_policy_without_external_id_or_mfa

>

DAX cluster not encrypted

dax_cluster_not_encrypted

>

DB instance storage not encrypted

db_instance_storage_not_encrypted

>

DB security group has public interface

db_security_group_has_public_interface

>

DB security group open to large scope

db_security_group_open_to_large_scope

>

DB security group with public scope

db_security_group_with_public_scope

>

DB snapshot is public

db_snapshot_public

>

Default security groups with unrestricted traffic

default_security_groups_with_unrestricted_traffic

>

Default VPC exists

default_vpc_exists

>

DMS endpoints without SSL

dms_endpoint_no_ssl_configured

>

DocumentDB cluster encrypted with AWS managed key

docdb_cluster_encrypted_with_aws_managed_key

>

DocumentDB cluster not encrypted

docdb_cluster_not_encrypted

>

DocumentDB cluster without KMS

docdb_cluster_without_kms

>

DocumentDB logging is disabled

docdb_logging_disabled

>

DynamoDB table not encrypted

dynamodb_table_not_encrypted

>

DynamoDB table Point-in-Time Recovery disabled

dynamodb_table_point_in_time_recovery_disabled

>

Dynamodb VPC endpoint without route table association

dynamodb_vpc_endpoint_without_route_table_association

>

EBS default encryption disabled

ebs_default_encryption_disabled

>

EBS volume encryption disabled

ebs_volume_encryption_disabled

>

EBS volume snapshot not encrypted

ebs_volume_snapshot_not_encrypted

>

EC2 instance has public IP

ec2_instance_has_public_ip

>

EC2 instance monitoring disabled

ec2_instance_monitoring_disabled

>

EC2 instance using API keys

ec2_instance_using_api_keys

>

EC2 instance using default security group

ec2_instance_using_default_security_group

>

EC2 instance using default VPC

ec2_instance_using_default_vpc

>

EC2 not EBS optimized

ec2_not_ebs_optimized

>

ECR image tag not immutable

ecr_image_tag_not_immutable

>

ECR repository is publicly accessible

ecr_repository_is_publicly_accessible

>

ECR repository not encrypted with CMK

ecr_repository_not_encrypted

>

ECR repository without policy

ecr_repository_without_policy

>

ECS cluster with container insights disabled

ecs_cluster_container_insights_disabled

>

ECS service admin role is present

ecs_service_admin_role_is_present

>

ECS service without running tasks

ecs_service_without_running_tasks

>

ECS task definition network mode not recommended

ecs_task_definition_network_mode_not_recommended

>

ECS task definition volume not encrypted

ecs_task_definition_volume_not_encrypted

>

EFS not encrypted

efs_not_encrypted

>

EFS with vulnerable policy

efs_with_vulnerable_policy

>

EFS without KMS

efs_without_kms

>

EKS cluster encryption disabled

eks_cluster_encryption_disabled

>

EKS cluster has public access

eks_cluster_has_public_access

>

EKS cluster has public access CIDRs

eks_cluster_has_public_access_cidrs

>

EKS cluster logging is not enabled

eks_cluster_log_disabled

>

EKS node group remote access disabled

eks_node_group_remote_access_disabled

>

ElastiCache nodes not created across multi AZ

elasticache_nodes_not_created_across_multi_az

>

ElastiCache Redis cluster without backup

elasticache_redis_cluster_without_backup

>

ElastiCache replication group not encrypted at rest

elasticache_replication_group_not_encrypted_at_rest

>

ElastiCache replication group not encrypted at transit

elasticache_replication_group_not_encrypted_at_transit

>

ElastiCache using default port

elasticache_using_default_port

>

ElastiCache without VPC

elasticache_without_vpc

>

Elasticsearch domain not encrypted node to node

elasticsearch_domain_not_encrypted_node_to_node

>

Elasticsearch domain with vulnerable policy

elasticsearch_domain_with_vulnerable_policy

>

Elasticsearch encryption with KMS disabled

elasticsearch_encryption_with_kms_is_disabled

>

Elasticsearch log disabled

elasticsearch_logs_disabled

>

Elasticsearch not encrypted at rest

elasticsearch_not_encrypted_at_rest

>

Elasticsearch uses default security group

elasticsearch_using_default_security_group

>

Elasticsearch with HTTPS disabled

elasticsearch_with_https_disabled

>

Elasticsearch without IAM authentication

elasticsearch_without_iam_authentication

>

Elasticsearch without slow logs

elasticsearch_without_slow_logs

>

ELB access log disabled

elb_access_logging_disabled

>

ELB using insecure protocols

elb_using_insecure_protocols

>

ELB using weak ciphers

elb_using_weak_ciphers

>

EMR without VPC

emr_without_vpc

>

Fine-grained access control disabled for OpenSearch/Elasticsearch

elasticsearch_no_finegrain_access_control

>

Global Accelerator flow logs disabled

global_accelerator_flow_logs_disabled

>

Glue Data Catalog encryption disabled

glue_data_catalog_encryption_disabled

>

Glue security configuration encryption disabled

glue_security_configuration_encryption_disabled

>

Glue with vulnerable policy

glue_with_vulnerable_policy

>

Group with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole'

group_with_privilege_escalation_by_actions_iam_PassRole_and_cloudformation_CreateStack

>

Group with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'

group_with_privilege_escalation_by_actions_iam_PassRole_and_ec2_RunInstances

>

Group with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole'

group_with_privilege_escalation_by_actions_iam_PassRole_and_glue_CreateDevEndpoint

>

Group with privilege escalation by actions 'glue:UpdateDevEndpoint'

group_with_privilege_escalation_by_actions_glue_UpdateDevEndpoint

>

Group with privilege escalation by actions 'iam:AddUserToGroup'

group_with_privilege_escalation_by_actions_iam_AddUserToGroup

>

Group with privilege escalation by actions 'iam:AttachGroupPolicy'

group_with_privilege_escalation_by_actions_iam_AttachGroupPolicy

>

Group with privilege escalation by actions 'iam:AttachRolePolicy'

group_with_privilege_escalation_by_actions_iam_AttachRolePolicy

>

Group with privilege escalation by actions 'iam:AttachUserPolicy'

group_with_privilege_escalation_by_actions_iam_AttachUserPolicy

>

Group with privilege escalation by actions 'iam:CreateAccessKey'

group_with_privilege_escalation_by_actions_iam_CreateAccessKey

>

Group with privilege escalation by actions 'iam:CreateLoginProfile'

group_with_privilege_escalation_by_actions_iam_CreateLoginProfile

>

Group with privilege escalation by actions 'iam:CreatePolicyVersion'

group_with_privilege_escalation_by_actions_iam_CreatePolicyVersion

>

Group with privilege escalation by actions 'iam:PutGroupPolicy'

group_with_privilege_escalation_by_actions_iam_PutGroupPolicy

>

Group with privilege escalation by actions 'iam:PutRolePolicy'

group_with_privilege_escalation_by_actions_iam_PutRolePolicy

>

Group with privilege escalation by actions 'iam:PutUserPolicy'

group_with_privilege_escalation_by_actions_iam_PutUserPolicy

>

Group with privilege escalation by actions 'iam:SetDefaultPolicyVersion'

group_with_privilege_escalation_by_actions_iam_SetDefaultPolicyVersion

>

Group with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole'

group_with_privilege_escalation_by_actions_iam_UpdateAssumeRolePolicy_and_sts_AssumeRole

>

Group with privilege escalation by actions 'iam:UpdateLoginProfile'

group_with_privilege_escalation_by_actions_iam_UpdateLoginProfile

>

Group with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction'

group_with_privilege_escalation_by_actions_iam_PassRole_and_lambda_CreateFunction_and_lambda_InvokeFunction

>

Group with privilege escalation by actions 'lambda:UpdateFunctionCode'

group_with_privilege_escalation_by_actions_lambda_UpdateFunctionCode

>

GuardDuty detector disabled

guardduty_detector_disabled

>

Hardcoded AWS access key

hardcoded_aws_access_key

>

Hardcoded AWS access key in Lambda

hardcoded_aws_access_key_in_lambda

>

HTTP port open to internet

http_port_open

>

IAM access key is exposed

iam_access_key_is_exposed

>

IAM database auth not enabled

iam_database_auth_not_enabled

>

IAM group without users

iam_group_without_users

>

IAM password policy does not require lowercase letter

iam_password_does_not_require_lowercase

>

IAM password policy does not require numbers

iam_password_does_not_require_number

>

IAM password policy does not require symbol

iam_password_does_not_require_symbol

>

IAM password policy does not require uppercase letter

iam_password_does_not_require_uppercase

>

IAM password without minimum length

iam_password_without_minimum_length

>

IAM policies attached to user

iam_policies_attached_to_user

>

IAM policies with full privileges

iam_policies_with_full_privileges

>

IAM policy grants 'AssumeRole' permission across all services

iam_policy_grants_assumerole_permission_across_all_services

>

IAM policy grants full permissions

iam_policy_grants_full_permissions

>

IAM role allows all principals to assume

iam_role_allows_all_principals_to_assume

>

IAM role policy passrole allows all

iam_role_policy_passrole_allows_all

>

IAM role with full privileges

iam_role_with_full_privileges

>

IAM user has too many access keys

iam_user_too_many_access_keys

>

IAM user policy without MFA

iam_user_policy_without_mfa

>

IAM user with access to console

iam_user_with_access_to_console

>

IMDSv1 enabled

imdsv1_is_enabled

>

Instance with no VPC

instance_with_no_vpc

>

Kinesis not encrypted with KMS

kinesis_not_encrypted_with_kms

>

Kinesis SSE not configured

kinesis_sse_not_configured

>

KMS key with no deletion window

kms_key_with_no_deletion_window

>

KMS key with vulnerable policy

kms_key_with_full_permissions

>

Lambda function publicly accessible

lambda_function_publicly_accessible

>

Lambda function with privileged role

lambda_function_with_privileged_role

>

Lambda functions without X-Ray tracing

lambda_functions_without_x-ray_tracing

>

Lambda IAM InvokeFunction misconfigured

lambda_iam_invokefunction_misconfigured

>

Lambda permission misconfigured

lambda_permission_misconfigured

>

Lambda permission principal is wildcard

lambda_permission_principal_is_wildcard

>

Lambda with vulnerable policy

lambda_with_vulnerable_policy

>

Launch configuration is not encrypted

launch_configuration_is_not_encrypted

>

Misconfigured password policy expiration

misconfigured_password_policy_expiration

>

Missing cluster log types

missing_cluster_log_types

>

MQ broker is publicly accessible

mq_broker_is_publicly_accessible

>

MQ broker logging disabled

mq_broker_logging_disabled

>

MSK broker is publicly accessible

msk_broker_is_publicly_accessible

>

MSK cluster encryption disabled

msk_cluster_encryption_disabled

>

MSK cluster logging disabled

msk_cluster_logging_disabled

>

Neptune cluster instance is publicly accessible

neptune_cluster_instance_is_publicly_accessible

>

Neptune cluster snapshot not encrypted

neptune_snapshots_not_encrypted

>

Neptune cluster with IAM database authentication disabled

neptune_cluster_with_iam_database_authentication_disabled

>

Neptune database cluster encryption disabled

neptune_database_cluster_encryption_disabled

>

Neptune logging is disabled

neptune_logging_disabled

>

Network ACL with unrestricted access to RDP

network_acl_with_unrestricted_access_to_rdp

>

Network ACL with unrestricted access to SSH

network_acl_with_unrestricted_access_to_ssh

>

No password policy enabled

no_password_policy_enabled

>

No stack policy

no_stack_policy

>

Password without reuse prevention

password_without_reuse_prevention

>

Policy without principal

policy_without_principal

>

Public and private EC2 share role

public_and_private_ec2_share_role

>

Public Lambda via API Gateway

public_lambda_via_api_gateway

>

RDS associated with public subnet

rds_associated_with_public_subnet

>

RDS cluster with backup disabled

rds_cluster_with_backup_disabled

>

RDS database cluster not encrypted

rds_database_cluster_not_encrypted

>

RDS DB instance publicly accessible

rds_db_instance_publicly_accessible

>

RDS storage not encrypted

rds_storage_not_encrypted

>

RDS using default port

rds_using_default_port

>

RDS with backup disabled

rds_with_backup_disabled

>

RDS without logging

rds_without_logging

>

Redis disabled

redis_disabled

>

Redis not compliant

redis_not_compliant

>

Redshift cluster logging disabled

redshift_cluster_logging_disabled

>

Redshift cluster without VPC

redshift_cluster_without_vpc

>

Redshift not encrypted

redshift_not_encrypted

>

Redshift publicly accessible

redshift_publicly_accessible

>

Redshift using default port

redshift_using_default_port

>

Remote Desktop port open to internet

remote_desktop_port_open_to_internet

>

Resource not using tags

resource_not_using_tags

>

REST API with vulnerable policy

rest_api_with_vulnerable_policy

>

Role with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole'

role_with_privilege_escalation_by_actions_iam_PassRole_and_cloudformation_CreateStack

>

Role with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'

role_with_privilege_escalation_by_actions_iam_PassRole_and_ec2_RunInstances

>

Role with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole'

role_with_privilege_escalation_by_actions_iam_PassRole_and_glue_CreateDevEndpoint

>

Role with privilege escalation by actions 'glue:UpdateDevEndpoint'

role_with_privilege_escalation_by_actions_glue_UpdateDevEndpoint

>

Role with privilege escalation by actions 'iam:AddUserToGroup'

role_with_privilege_escalation_by_actions_iam_AddUserToGroup

>

Role with privilege escalation by actions 'iam:AttachGroupPolicy'

role_with_privilege_escalation_by_actions_iam_AttachGroupPolicy

>

Role with privilege escalation by actions 'iam:AttachRolePolicy'

role_with_privilege_escalation_by_actions_iam_AttachRolePolicy

>

Role with privilege escalation by actions 'iam:AttachUserPolicy'

role_with_privilege_escalation_by_actions_iam_AttachUserPolicy

>

Role with privilege escalation by actions 'iam:CreateAccessKey'

role_with_privilege_escalation_by_actions_iam_CreateAccessKey

>

Role with privilege escalation by actions 'iam:CreateLoginProfile'

role_with_privilege_escalation_by_actions_iam_CreateLoginProfile

>

Role with privilege escalation by actions 'iam:CreatePolicyVersion'

role_with_privilege_escalation_by_actions_iam_CreatePolicyVersion

>

Role with privilege escalation by actions 'iam:PutGroupPolicy'

role_with_privilege_escalation_by_actions_iam_PutGroupPolicy

>

Role with privilege escalation by actions 'iam:PutRolePolicy'

role_with_privilege_escalation_by_actions_iam_PutRolePolicy

>

Role with privilege escalation by actions 'iam:PutUserPolicy'

role_with_privilege_escalation_by_actions_iam_PutUserPolicy

>

Role with privilege escalation by actions 'iam:SetDefaultPolicyVersion'

role_with_privilege_escalation_by_actions_iam_SetDefaultPolicyVersion

>

Role with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole'

role_with_privilege_escalation_by_actions_iam_UpdateAssumeRolePolicy_and_sts_AssumeRole

>

Role with privilege escalation by actions 'iam:UpdateLoginProfile'

role_with_privilege_escalation_by_actions_iam_UpdateLoginProfile

>

Role with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction'

role_with_privilege_escalation_by_actions_iam_PassRole_and_lambda_CreateFunction_lambda_InvokeFunction

>

Role with privilege escalation by actions 'lambda:UpdateFunctionCode'

role_with_privilege_escalation_by_actions_lambda_UpdateFunctionCode

>

Root account has active access keys

root_account_has_active_access_keys

>

Route53 record undefined

route53_record_undefined

>

S3 bucket access to any principal

s3_bucket_access_to_any_principal

>

S3 bucket ACL allows read or write to all users

s3_bucket_acl_allows_read_or_write_to_all_users

>

S3 bucket ACL allows read to any authenticated user

s3_bucket_acl_allows_read_to_any_authenticated_user

>

S3 bucket ACL grants WRITE_ACP permission

s3_bucket_acl_grants_write_acp_permission

>

S3 bucket allows authenticated users access

s3_bucket_allows_access_to_all_authenticated_users

>

S3 bucket allows delete action from all principals

s3_bucket_allows_delete_action_from_all_principals

>

S3 bucket allows get action from all principals

s3_bucket_allows_get_action_from_all_principals

>

S3 bucket allows list action from all principals

s3_bucket_allows_list_action_from_all_principals

>

S3 bucket allows public ACL

s3_bucket_allows_public_acl

>

S3 bucket allows public policy

s3_bucket_with_public_policy

>

S3 bucket allows put action from all principals

s3_bucket_allows_put_action_from_all_principals

>

S3 bucket logging disabled

s3_bucket_logging_disabled

>

S3 bucket object not encrypted

s3_bucket_object_not_encrypted

>

S3 bucket object-level CloudTrail logging disabled

s3_bucket_object_level_cloudtrail_logging_disabled

>

S3 bucket policy accepts HTTP requests

s3_bucket_policy_accepts_http_requests

>

S3 bucket public ACL overridden by public access block

s3_bucket_public_acl_overridden_by_public_access_block

>

S3 bucket with all permissions

s3_bucket_with_all_permissions

>

S3 bucket with unsecured CORS rule

s3_bucket_with_unsecured_cors_rule

>

S3 bucket without enabled MFA delete

s3_bucket_without_enabled_mfa_delete

>

S3 bucket without ignore public ACL

s3_bucket_without_ignore_public_acl

>

S3 bucket without restriction of public bucket

s3_bucket_without_restriction_of_public_bucket

>

S3 bucket without versioning

s3_bucket_without_versioning

>

S3 static website host enabled

s3_static_website_host_enabled

>

SageMaker endpoint configuration encryption disabled

sagemaker_endpoint_configuration_encryption_disabled

>

SageMaker notebook instance without KMS

sagemaker_notebook_instance_without_kms

>

SageMaker notebook internet access enabled

sagemaker_direct_internet_access_enabled

>

Secrets Manager secret encrypted with AWS-managed key

secretsmanager_secret_encrypted_with_aws_managed_key

>

Secrets Manager secret without KMS

secretsmanager_secret_without_kms

>

Secrets Manager with vulnerable policy

secrets_manager_with_vulnerable_policy

>

Secure ciphers disabled

secure_ciphers_disabled

>

Security group not used

security_groups_not_used

>

Security group rule without description

security_group_rules_without_description

>

Security group rule without description

security_group_without_description

>

Security group with unrestricted access to SSH

security_group_with_unrestricted_access_to_ssh

>

Sensitive port is exposed to entire network

sensitive_port_is_exposed_to_entire_network

>

Sensitive port is exposed to small public network

sensitive_port_is_exposed_to_small_public_network

>

Sensitive port is exposed to wide private network

sensitive_port_is_exposed_to_wide_private_network

>

Service control policies disabled

service_control_policies_disabled

>

SES policy with allowed IAM actions

ses_policy_with_allowed_iam_actions

>

Shield Advanced not in use

shield_advanced_not_in_use

>

SNS topic encrypted with AWS managed key

sns_topic_encrypted_with_aws_managed_key

>

SNS topic is publicly accessible

sns_topic_is_publicly_accessible

>

SNS topic not encrypted

sns_topic_not_encrypted

>

SNS topic publicity has allow and NotAction simultaneously

sns_topic_publicity_has_allow_and_not_action_simultaneously

>

SQL analysis services port 2383 (TCP) is publicly accessible

sql_analysis_services_port_2383_is_publicly_accessible

>

SQS policy allows all actions

sqs_policy_allows_all_actions

>

SQS policy with public access

sqs_policy_with_public_access

>

SQS queue exposed

sqs_queue_exposed

>

SQS VPC endpoint without DNS resolution

sqs_vpc_endpoint_without_dns_resolution

>

SQS with SSE disabled

sqs_with_sse_disabled

>

SSM session transit encryption disabled

ssm_session_transit_encryption_disabled

>

SSO identity user unsafe creation

sso_identity_user_unsafe_creation

>

SSO permission with inadequate user session duration

sso_permission_with_inadequate_user_session_duration

>

SSO policy with full privileges

sso_policy_with_full_privileges

>

Stack notifications disabled

stack_notifications_disabled

>

Stack retention disabled

stack_retention_disabled

>

Stack without template

stack_without_template

>

Team tag missing on AWS resource

team_tag_not_present

>

Unknown port exposed to internet

unknown_port_exposed_to_internet

>

Unrestricted security group ingress

unrestricted_security_group_ingress

>

Unscanned ECR image

unscanned_ecr_image

>

User data contains encoded private key

user_data_contains_encoded_private_key

>

User with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole'

user_with_privilege_escalation_by_actions_iam_PassRole_and_cloudformation_CreateStack

>

User with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'

user_with_privilege_escalation_by_actions_iam_PassRole_and_ec2_RunInstances

>

User with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole'

user_with_privilege_escalation_by_actions_iam_PassRole_and_glue_CreateDevEndpoint

>

User with privilege escalation by actions 'glue:UpdateDevEndpoint'

user_with_privilege_escalation_by_actions_glue_UpdateDevEndpoint

>

User with privilege escalation by actions 'iam:AddUserToGroup'

user_with_privilege_escalation_by_actions_iam_AddUserToGroup

>

User with privilege escalation by actions 'iam:AttachGroupPolicy'

user_with_privilege_escalation_by_actions_iam_AttachGroupPolicy

>

User with privilege escalation by actions 'iam:AttachRolePolicy'

user_with_privilege_escalation_by_actions_iam_AttachRolePolicy

>

User with privilege escalation by actions 'iam:AttachUserPolicy'

user_with_privilege_escalation_by_actions_iam_AttachUserPolicy

>

User with privilege escalation by actions 'iam:CreateAccessKey'

user_with_privilege_escalation_by_actions_iam_CreateAccessKey

>

User with privilege escalation by actions 'iam:CreateLoginProfile'

user_with_privilege_escalation_by_actions_iam_CreateLoginProfile

>

User with privilege escalation by actions 'iam:CreatePolicyVersion'

user_with_privilege_escalation_by_actions_iam_CreatePolicyVersion

>

User with privilege escalation by actions 'iam:PutGroupPolicy'

user_with_privilege_escalation_by_actions_iam_PutGroupPolicy

>

User with privilege escalation by actions 'iam:PutRolePolicy'

user_with_privilege_escalation_by_actions_iam_PutRolePolicy

>

User with privilege escalation by actions 'iam:PutUserPolicy'

user_with_privilege_escalation_by_actions_iam_PutUserPolicy

>

User with privilege escalation by actions 'iam:SetDefaultPolicyVersion'

user_with_privilege_escalation_by_actions_iam_SetDefaultPolicyVersion

>

User with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole'

user_with_privilege_escalation_by_actions_iam_UpdateAssumeRolePolicy_and_sts_AssumeRole

>

User with privilege escalation by actions 'iam:UpdateLoginProfile'

user_with_privilege_escalation_by_actions_iam_UpdateLoginProfile

>

User with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction'

user_with_privilege_escalation_by_actions_iam_PassRole_and_lambda_CreateFunction_and_lambda_InvokeFunction

>

User with privilege escalation by actions 'lambda:UpdateFunctionCode'

user_with_privilege_escalation_by_actions_lambda_UpdateFunctionCode

>

VPC default security group accepts all traffic

vpc_default_security_group_accepts_all_traffic

>

VPC Flow Logs disabled

vpc_flowlogs_disabled

>

VPC peering route table with unrestricted CIDR

vpc_peering_route_table_with_unrestricted_cidr

>

VPC subnet assigns public IP

vpc_subnet_assigns_public_ip

>

VPC without Network Firewall

vpc_without_network_firewall

>

Vulnerable default SSL certificate

vulnerable_default_ssl_certificate

>

Workspaces workspace volume not encrypted

workspaces_workspace_volume_not_encrypted

>

>

AD admin not configured for SQL server

ad_admin_not_configured_for_sql_server

>

Admin user enabled for container registry

admin_user_enabled_for_container_registry

>

AKS disk encryption set ID undefined

aks_disk_encryption_set_id_undefined

>

AKS network policy misconfigured

aks_network_policy_misconfigured

>

AKS private cluster disabled

aks_private_cluster_disabled

>

AKS RBAC disabled

aks_rbac_disabled

>

App Service authentication disabled

app_service_authentication_disabled

>

App Service FTPS enforce disabled

app_service_ftps_enforce_disabled

>

App Service HTTP2 disabled

app_service_http2_disabled

>

App Service managed identity disabled

app_service_managed_identity_disabled

>

App Service not using latest TLS encryption version

app_service_not_using_latest_tls_encryption_version

>

App Service without latest PHP version

app_service_without_latest_php_version

>

App Service without latest Python version

app_service_without_latest_python_version

>

Azure Active Directory authentication

azure_active_directory_authentication

>

Azure App Service client certificate disabled

azure_app_service_client_certificate_disabled

>

Azure Cognitive Search public network access enabled

azure_cognitive_search_public_network_access_enabled

>

Azure Container Registry with no locks

azure_container_registry_with_no_locks

>

Azure Front Door WAF disabled

azure_front_door_waf_disabled

>

Azure instance using basic authentication

azure_instance_using_basic_authentication

>

Azure Policy Add-on Disabled in AKS Cluster

aks_uses_azure_policies_addon_disabled

>

Cosmos DB account without tags

cosmos_db_account_without_tags

>

CosmosDB account IP range filter not set

cosmosdb_account_ip_range_filter_not_set

>

Dashboard is enabled

dashboard_is_enabled

>

Default Azure storage account network access is too permissive

default_azure_storage_account_network_access_is_too_permissive

>

Email alerts disabled

email_alerts_disabled

>

Encryption on managed disk disabled

encryption_on_managed_disk_disabled

>

Ensure Azure MariaDB server is using latest TLS (1.2)

mariadb_not_using_latest_tls

>

Ensure MySQL is using the latest version of TLS encryption

mysql_not_using_latest_tls

>

Ensure that Azure cloud resource has a team tag

team_tag_not_present

>

Ensure that PostgreSQL server disables public network access

postgres_sql_server_enables_public_access

>

Ensure that UDP services are restricted from the Internet

udp_services_not_restricted_from_internet

>

Ensure web app is not remotely debuggable

remote_debugging_enabled_app_service

>

Firewall rule allows too many hosts to access Redis Cache

firewall_rule_allows_too_many_hosts_to_access_redis_cache

>

Function App authentication disabled

function_app_authentication_disabled

>

Function App client certificates not required

function_app_client_certificates_unrequired

>

Function App FTPS enforce disabled

function_app_ftps_enforce_disabled

>

Function App HTTP2 disabled

function_app_http2_disabled

>

Function App managed identity disabled

function_app_managed_identity_disabled

>

Function App not using latest TLS encryption version

function_app_not_using_latest_tls_encryption_version

>

Geo redundancy is disabled

geo_redundancy_is_disabled

>

Key expiration not set

key_expiration_not_set

>

Key Vault secrets content type undefined

key_vault_secrets_content_type_undefined

>

Log retention is not set

log_retention_is_not_set

>

MariaDB server geo-redundant backup disabled

mariadb_server_georedundant_backup_disabled

>

MariaDB server public network access enabled

mariadb_public_network_access_enabled

>

MSSQL server auditing disabled

mssql_server_auditing_disabled

>

MSSQL server public network access enabled

mssql_server_public_network_access_enabled

>

MySQL server public access enabled

mysql_server_public_access_enabled

>

MySQL SSL connection disabled

mysql_ssl_connection_disabled

>

Network interfaces IP forwarding enabled

network_interfaces_ip_forwarding_enabled

>

Network interfaces with public IP

network_interfaces_with_public_ip

>

Network watcher flow disabled

network_watcher_flow_disabled

>

PostgreSQL log checkpoints disabled

postgresql_log_checkpoints_disabled

>

PostgreSQL log connections not set

postgresql_log_connections_not_set

>

PostgreSQL log disconnections not set

postgresql_log_disconnections_not_set

>

PostgreSQL log duration not set

postgresql_log_duration_not_set

>

PostgreSQL server infrastructure encryption disabled

postgresql_server_infrastructure_encryption_disabled

>

PostgreSQL Server threat detection policy disabled

postgresql_server_threat_detection_policy_disabled

>

PostgreSQL server without connection throttling

postgresql_server_without_connection_throttling

>

Public storage account

public_storage_account

>

RDP is exposed to the internet

rdp_is_exposed_to_the_internet

>

Redis cache allows non SSL connections

redis_cache_allows_non_ssl_connections

>

Redis entirely accessible

redis_entirely_accessible

>

Redis not updated regularly

redis_not_updated_regularly

>

Redis publicly accessible

redis_publicly_accessible

>

Role assignment not limit guest user permissions

role_assignment_not_limit_guest_users_permissions

>

Role definition allows custom role creation

role_definition_allows_custom_role_creation

>

Secret expiration not set

secret_expiration_not_set

>

Security center pricing tier is not standard

security_center_pricing_tier_is_not_standard

>

Security contact email

security_contact_email

>

Security group is not configured

security_group_is_not_configured

>

Sensitive port is exposed to entire network

sensitive_port_is_exposed_to_entire_network

>

Sensitive port is exposed to small public network

sensitive_port_is_exposed_to_small_public_network

>

Sensitive port is exposed to wide private network

sensitive_port_is_exposed_to_wide_private_network

>

Small activity log retention period

small_activity_log_retention_period

>

Small flow logs retention period

small_flow_logs_retention_period

>

Small MSSQL audit retention period

small_mssql_audit_retention_period

>

Small MSSQL server audit retention

small_msql_server_audit_retention

>

Small PostgreSQL DB server log retention period

small_postgresql_db_server_log_retention_period

>

SQL database audit disabled

sql_database_audit_disabled

>

SQL server alert email disabled

sql_server_alert_email_disabled

>

SQL server auditing disabled

sql_server_auditing_disabled

>

SQL server predictable Active Directory admin account name

sql_server_predictable_active_directory_admin_account_name

>

SQL server predictable admin account name

sql_server_predictable_admin_account_name

>

Sqlserver ingress from any IP

sql_server_ingress_from_any_ip

>

SSH is exposed to the Internet

ssh_is_exposed_to_the_internet

>

SSL enforce disabled

ssl_enforce_is_disabled

>

ssl_enforcement_enabled is not set to ENABLED for MySQL database server

mysql_enforce_ssl_connection_disabled

>

ssl_enforcement_enabled is not set to ENABLED for PostgreSQL database server

postgres_enforce_ssl_connection_disabled

>

Storage account not forcing HTTPS

storage_account_not_forcing_https

>

Storage account not using latest TLS encryption version

storage_account_not_using_latest_tls_encryption_version

>

Storage container is publicly accessible

storage_container_is_publicly_accessible

>

Storage share file allows all ACL permissions

storage_share_file_allows_all_acl_permissions

>

Storage table allows all ACL permissions

storage_table_allows_all_acl_permissions

>

Trusted Microsoft services not enabled

trusted_microsoft_services_not_enabled

>

Unrestricted SQL server access

unrestricted_sql_server_access

>

Vault auditing disabled

vault_auditing_disabled

>

Virtual network with DDoS protection plan disabled

virtual_network_with_ddos_protection_plan_disabled

>

VM not attached to network

vm_not_attached_to_network

>

WAF is disabled for Azure application gateway

waf_is_disabled_for_azure_application_gateway

>

Web app accepting traffic other than HTTPS

web_app_accepting_traffic_other_than_https

>

>

Artifact Registry repo is public

artifact_registry_repository_is_public

>

BigQuery dataset is public

bigquery_dataset_is_public

>

BigQuery table is public

bigquery_table_is_public

>

Cloud DNS without DNSSEC

cloud_dns_without_dnssec

>

Cloud KMS key ring is anonymously or publicly accessible

cloud_kms_key_rings_are_public

>

Cloud Run service is public

cloud_run_service_is_public

>

Cloud Storage bucket is publicly accessible

cloud_storage_bucket_is_publicly_accessible

>

Cloud Storage bucket logging not enabled

cloud_storage_bucket_logging_not_enabled

>

Cloud Storage bucket versioning disabled

cloud_storage_bucket_versioning_disabled

>

Cloud Storage is anonymous or publicly accessible

cloud_storage_anonymous_or_publicly_accessible

>

Cluster labels disabled

cluster_labels_disabled

>

Container Registry repo is public

container_registry_repository_is_public

>

COS node image not used

cos_node_image_not_used

>

Dataproc clusters has public IPs

dataproc_cluster_has_public_ip

>

Dataproc clusters publicly accessible

dataproc_clusters_is_public

>

Disk encryption disabled

disk_encryption_disabled

>

DNSSEC using RSASHA1

dnssec_using_rsasha1

>

Ensure legacy networks do not exist for a project

legacy_networks_exist_for_project

>

Ensure SQL database instance has skip show database flag

sql_database_instance_does_not_have_skip_show_database

>

GKE control plane is public

gke_control_plane_is_public

>

GKE legacy authorization enabled

gke_legacy_authorization_enabled

>

GKE using default service account

gke_using_default_service_account

>

Google Compute firewall ingress allows unrestricted FTP access

firewall_ingress_allows_unrestricted_ftp_access

>

Google Compute firewall ingress allows unrestricted MySQL access

firewall_ingress_allows_unrestricted_mysql_access

>

Google Compute network using default firewall rule

google_compute_network_using_default_firewall_rule

>

Google Compute network using firewall rule that allows all ports

google_compute_network_using_firewall_rule_allows_all_ports

>

Google Compute network using firewall rule that allows port range

google_compute_network_using_firewall_rule_allows_port_range

>

Google Compute SSL policy weak cipher in use

google_compute_ssl_policy_weak_cipher_in_use

>

Google Compute subnetwork logging disabled

google_compute_subnetwork_logging_disabled

>

Google Compute subnetwork with private Google access disabled

google_compute_subnetwork_with_private_google_access_disabled

>

Google Container node pool auto repair disabled

google_container_node_pool_auto_repair_disabled

>

Google project auto create network disabled

google_project_auto_create_network_disabled

>

Google project IAM binding service account has token creator or account user role

google_project_iam_binding_service_account_has_token_creator_or_account_user_role

>

Google project IAM member service account has admin role

google_project_iam_member_service_account_has_admin_role

>

Google project IAM member service account has token creator or account user role

google_project_iam_member_service_account_has_token_creator_or_account_user_role

>

Google Storage bucket level access disabled

google_storage_bucket_level_access_disabled

>

High Google KMS crypto key rotation period

high_google_kms_crypto_key_rotation_period

>

IAM audit not properly configured

iam_audit_not_properly_configured

>

IP aliasing disabled

ip_aliasing_disabled

>

IP forwarding enabled

ip_forwarding_enabled

>

KMS admin and CryptoKey roles in use

kms_admin_and_crypto_key_roles_in_use

>

KMS CryptoKey is publicly accessible

kms_crypto_key_publicly_accessible

>

Legacy client certificate auth enabled

legacy_client_certificate_auth_enabled

>

Network policy disabled

network_policy_disabled

>

Node auto upgrade disabled

node_auto_upgrade_disabled

>

Not proper email account in use

not_proper_email_account_in_use

>

OSLogin disabled

os_login_disabled

>

OSLogin is disabled for VM instance

os_login_is_disabled_for_vm_instance

>

Outdated GKE version

outdated_gke_version

>

Pod security policy disabled

pod_security_policy_disabled

>

Private cluster disabled

private_cluster_disabled

>

Project-wide SSH keys are enabled in VM instances

project_wide_ssh_keys_are_enabled_in_vm_instances

>

Pub/Sub Topics are anonymously or publicly accessible

pubsub_topic_is_public

>

RDP access is not restricted

rdp_access_is_not_restricted

>

Serial ports are enabled for VM instances

vm_serial_ports_are_enabled_for_vm_instances

>

Service account with improper privileges

service_account_with_improper_privileges

>

Shielded GKE nodes disabled

shielded_gke_nodes_disabled

>

Shielded VM disabled

shielded_vm_disabled

>

SQL DB instance backup disabled

sql_db_instance_backup_disabled

>

SQL DB instance publicly accessible

sql_db_instance_is_publicly_accessible

>

SQL DB instance with SSL disabled

sql_db_instance_with_ssl_disabled

>

SQL Server cross DB ownership chaining enabled

sql_database_has_cross_db_ownership_chaining

>

SSH access is not restricted

ssh_access_is_not_restricted

>

Stackdriver Logging disabled

stackdriver_logging_disabled

>

Stackdriver Monitoring disabled

stackdriver_monitoring_disabled

>

Team label missing on GCP resource

team_label_not_present

>

There are non GCP-managed service account keys for a service account

service_has_non_gcp_managed_service_account_keys

>

User with IAM role

user_with_iam_role

>

Using default service account

using_default_service_account

>

VM with full cloud access

vm_with_full_cloud_access

>

>