Infrastructure as Code (IaC) Security identifies misconfigurations and security risks in infrastructure-as-code files before deployment, helping ensure that cloud environments remain secure and compliant.

ALB deletion protection disabled

alb_deletion_protection_disabled

>

ALB is not integrated with WAF

alb_is_not_integrated_with_waf

>

ALB listening on HTTP

alb_listening_on_http

>

ALB not dropping invalid headers

alb_not_dropping_invalid_headers

>

Amazon DMS replication instance is publicly accessible

amazon_dms_replication_instance_is_publicly_accessible

>

AmazonMQ broker encryption disabled

amazon_mq_broker_encryption_disabled

>

AMI most recent without owner or filter

ami_owner_missing

>

AMI not encrypted

ami_not_encrypted

>

AMI shared with multiple accounts

ami_shared_with_multiple_accounts

>

API Gateway access logging disabled

api_gateway_access_logging_disabled

>

API Gateway deployment without access log setting

api_gateway_deployment_without_access_log_setting

>

API gateway deployment without API gateway usage plan associated

api_gateway_deployment_without_api_gateway_usage_plan_associated

>

API Gateway endpoint config is not private

api_gateway_endpoint_config_is_not_private

>

API Gateway method does not contains an API key

api_gateway_method_does_not_contains_an_api_key

>

API Gateway method settings cache not encrypted

api_gateway_method_settings_cache_not_encrypted

>

API Gateway stage without API Gateway usage plan associated

api_gateway_stage_without_api_gateway_usage_plan_associated

>

API Gateway with CloudWatch logging disabled

api_gateway_with_cloudwatch_logging_disabled

>

API Gateway with invalid compression

api_gateway_with_invalid_compression

>

API Gateway with open access

api_gateway_with_open_access

>

API Gateway without configured authorizer

api_gateway_without_configured_authorizer

>

API Gateway without security policy

api_gateway_without_security_policy

>

API Gateway without SSL certificate

api_gateway_without_ssl_certificate

>

API Gateway without WAF

api_gateway_without_waf

>

API Gateway X-Ray disabled

api_gateway_xray_disabled

>

Athena database not encrypted

athena_database_not_encrypted

>

Athena workgroup not encrypted

athena_workgroup_not_encrypted

>

Aurora with disabled at rest encryption

aurora_with_disabled_at_rest_encryption

>

Authentication without MFA

authentication_without_mfa

>

Auto scaling group with no associated ELB

auto_scaling_group_with_no_associated_elb

>

Automatic minor upgrades disabled

automatic_minor_upgrades_disabled

>

Autoscaling groups supply tags

autoscaling_groups_supply_tags

>

AWS password policy with unchangeable passwords

aws_password_policy_with_unchangeable_passwords

>

Batch job definition with privileged container properties

batch_job_definition_with_privileged_container_properties

>

CA certificate identifier is outdated

ca_certificate_identifier_is_outdated

>

CDN configuration is missing

cdn_configuration_is_missing

>

Certificate has expired

certificate_has_expired

>

Certificate RSA key bytes lower than 256

certificate_rsa_key_bytes_lower_than_256

>

CloudFront logging disabled

cloudfront_logging_disabled

>

Cloudfront viewer protocol policy allows HTTP

cloudfront_viewer_protocol_policy_allows_http

>

CloudFront without minimum protocol TLS 1.2

cloudfront_without_minimum_protocol_tls_1.2

>

CloudFront without WAF

cloudfront_without_waf

>

CloudTrail log file validation disabled

cloudtrail_log_file_validation_disabled

>

CloudTrail log files not encrypted with KMS

cloudtrail_log_files_not_encrypted_with_kms

>

CloudTrail log files S3 bucket is publicly accessible

cloudtrail_log_files_s3_bucket_is_publicly_accessible

>

CloudTrail log files S3 bucket with logging disabled

cloudtrail_log_files_s3_bucket_with_logging_disabled

>

CloudTrail logging disabled

cloudtrail_logging_disabled

>

CloudTrail multi region disabled

cloudtrail_multi_region_disabled

>

CloudTrail not integrated with CloudWatch

cloudtrail_not_integrated_with_cloudwatch

>

CloudTrail SNS topic name undefined

cloudtrail_sns_topic_name_undefined

>

CloudWatch AWS Config configuration changes alarm missing

cloudwatch_aws_config_configuration_changes_alarm_missing

>

CloudWatch AWS organizations changes missing alarm

cloudwatch_aws_organizations_changes_missing_alarm

>

CloudWatch changes to NACL alarm missing

cloudwatch_changes_to_nacl_alarm_missing

>

Cloudwatch CloudTrail configuration changes alarm missing

cloudwatch_cloudtrail_configuration_changes_alarm_missing

>

CloudWatch console sign-in without MFA alarm missing

cloudwatch_management_console_sign_in_without_mfa_alarm_missing

>

CloudWatch disabling or scheduled deletion of customer created CMK alarm missing

cloudwatch_disabling_or_scheduled_deletion_of_customer_created_cmk_alarm_missing

>

CloudWatch IAM policy changes alarm missing

cloudwatch_iam_policy_changes_alarm_missing

>

CloudWatch log group without KMS

cloudwatch_log_group_not_encrypted

>

CloudWatch logging disabled

cloudwatch_logging_disabled

>

CloudWatch logs destination with vulnerable policy

cloudwatch_logs_destination_with_vulnerable_policy

>

CloudWatch management console auth failed alarm missing

cloudwatch_management_console_auth_failed_alarm_missing

>

CloudWatch metrics disabled

cloudwatch_metrics_disabled

>

CloudWatch network gateways changes alarm missing

cloudwatch_network_gateways_changes_alarm_missing

>

CloudWatch root account use missing

cloudwatch_root_account_use_alarm_missing

>

CloudWatch route table changes alarm missing

cloudwatch_route_table_changes_alarm_missing

>

CloudWatch S3 policy change alarm missing

cloudwatch_s3_policy_change_alarm_missing

>

Cloudwatch security group changes alarm missing

cloudwatch_security_group_changes_alarm_missing

>

CloudWatch unauthorized access alarm missing

cloudwatch_unauthorized_access_defined_alarm_missing

>

CloudWatch VPC changes alarm missing

cloudwatch_vpc_changes_alarm_missing

>

CloudWatch without retention period specified

cloudwatch_without_retention_period_specified

>

CMK is unusable

cmk_is_unusable

>

CMK rotation disabled

cmk_rotation_disabled

>

CodeBuild project encrypted with AWS managed key

codebuild_project_encrypted_with_aws_managed_key

>

Cognito user pool without MFA

cognito_userpool_without_mfa

>

Config rule for encrypted volumes disabled

config_rule_for_encrypted_volumes_is_disabled

>

Configuration aggregator to all regions disabled

config_configuration_aggregator_to_all_regions_disabled

>

Cross-account IAM assume role policy without external id or MFA

cross_account_iam_assume_role_policy_without_external_id_or_mfa

>

DAX cluster not encrypted

dax_cluster_not_encrypted

>

DB instance storage not encrypted

db_instance_storage_not_encrypted

>

DB security group has public interface

db_security_group_has_public_interface

>

DB security group open to large scope

db_security_group_open_to_large_scope

>

DB security group with public scope

db_security_group_with_public_scope

>

DB snapshot is public

db_snapshot_public

>

Default security groups with unrestricted traffic

default_security_groups_with_unrestricted_traffic

>

Default VPC exists

default_vpc_exists

>

DMS endpoints without SSL

dms_endpoint_no_ssl_configured

>

DocumentDB cluster encrypted with AWS managed key

docdb_cluster_encrypted_with_aws_managed_key

>

DocumentDB cluster not encrypted

docdb_cluster_not_encrypted

>

DocumentDB cluster without KMS

docdb_cluster_without_kms

>

DocumentDB logging is disabled

docdb_logging_disabled

>

DynamoDB table not encrypted

dynamodb_table_not_encrypted

>

DynamoDB table Point-in-Time Recovery disabled

dynamodb_table_point_in_time_recovery_disabled

>

Dynamodb VPC endpoint without route table association

dynamodb_vpc_endpoint_without_route_table_association

>

EBS default encryption disabled

ebs_default_encryption_disabled

>

EBS volume encryption disabled

ebs_volume_encryption_disabled

>

EBS volume snapshot not encrypted

ebs_volume_snapshot_not_encrypted

>

EC2 instance has public IP

ec2_instance_has_public_ip

>

EC2 instance monitoring disabled

ec2_instance_monitoring_disabled

>

EC2 instance using API keys

ec2_instance_using_api_keys

>

EC2 instance using default security group

ec2_instance_using_default_security_group

>

EC2 instance using default VPC

ec2_instance_using_default_vpc

>

EC2 not EBS optimized

ec2_not_ebs_optimized

>

ECR image tag not immutable

ecr_image_tag_not_immutable

>

ECR repository is publicly accessible

ecr_repository_is_publicly_accessible

>

ECR repository not encrypted with CMK

ecr_repository_not_encrypted

>

ECR repository without policy

ecr_repository_without_policy

>

ECS cluster with container insights disabled

ecs_cluster_container_insights_disabled

>

ECS service admin role is present

ecs_service_admin_role_is_present

>

ECS service without running tasks

ecs_service_without_running_tasks

>

ECS task definition network mode not recommended

ecs_task_definition_network_mode_not_recommended

>

ECS task definition volume not encrypted

ecs_task_definition_volume_not_encrypted

>

EFS not encrypted

efs_not_encrypted

>

EFS with vulnerable policy

efs_with_vulnerable_policy

>

EFS without KMS

efs_without_kms

>

EKS cluster encryption disabled

eks_cluster_encryption_disabled

>

EKS cluster has public access

eks_cluster_has_public_access

>

EKS cluster has public access CIDRs

eks_cluster_has_public_access_cidrs

>

EKS cluster logging is not enabled

eks_cluster_log_disabled

>

EKS node group remote access disabled

eks_node_group_remote_access_disabled

>

ElastiCache nodes not created across multi AZ

elasticache_nodes_not_created_across_multi_az

>

ElastiCache Redis cluster without backup

elasticache_redis_cluster_without_backup

>

ElastiCache replication group not encrypted at rest

elasticache_replication_group_not_encrypted_at_rest

>

ElastiCache replication group not encrypted at transit

elasticache_replication_group_not_encrypted_at_transit

>

ElastiCache using default port

elasticache_using_default_port

>

ElastiCache without VPC

elasticache_without_vpc

>

Elasticsearch domain not encrypted node to node

elasticsearch_domain_not_encrypted_node_to_node

>

Elasticsearch domain with vulnerable policy

elasticsearch_domain_with_vulnerable_policy

>

Elasticsearch encryption with KMS disabled

elasticsearch_encryption_with_kms_is_disabled

>

Elasticsearch log disabled

elasticsearch_logs_disabled

>

Elasticsearch not encrypted at rest

elasticsearch_not_encrypted_at_rest

>

Elasticsearch uses default security group

elasticsearch_using_default_security_group

>

Elasticsearch with HTTPS disabled

elasticsearch_with_https_disabled

>

Elasticsearch without IAM authentication

elasticsearch_without_iam_authentication

>

Elasticsearch without slow logs

elasticsearch_without_slow_logs

>

ELB access log disabled

elb_access_logging_disabled

>

ELB using insecure protocols

elb_using_insecure_protocols

>

ELB using weak ciphers

elb_using_weak_ciphers

>

EMR without VPC

emr_without_vpc

>

Fine-grained access control disabled for OpenSearch/Elasticsearch

elasticsearch_no_finegrain_access_control

>

Global Accelerator flow logs disabled

global_accelerator_flow_logs_disabled

>

Glue Data Catalog encryption disabled

glue_data_catalog_encryption_disabled

>

Glue security configuration encryption disabled

glue_security_configuration_encryption_disabled

>

Glue with vulnerable policy

glue_with_vulnerable_policy

>

Group with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole'

group_with_privilege_escalation_by_actions_iam_PassRole_and_cloudformation_CreateStack

>

Group with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'

group_with_privilege_escalation_by_actions_iam_PassRole_and_ec2_RunInstances

>

Group with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole'

group_with_privilege_escalation_by_actions_iam_PassRole_and_glue_CreateDevEndpoint

>

Group with privilege escalation by actions 'glue:UpdateDevEndpoint'

group_with_privilege_escalation_by_actions_glue_UpdateDevEndpoint

>

Group with privilege escalation by actions 'iam:AddUserToGroup'

group_with_privilege_escalation_by_actions_iam_AddUserToGroup

>

Group with privilege escalation by actions 'iam:AttachGroupPolicy'

group_with_privilege_escalation_by_actions_iam_AttachGroupPolicy

>

Group with privilege escalation by actions 'iam:AttachRolePolicy'

group_with_privilege_escalation_by_actions_iam_AttachRolePolicy

>

Group with privilege escalation by actions 'iam:AttachUserPolicy'

group_with_privilege_escalation_by_actions_iam_AttachUserPolicy

>

Group with privilege escalation by actions 'iam:CreateAccessKey'

group_with_privilege_escalation_by_actions_iam_CreateAccessKey

>

Group with privilege escalation by actions 'iam:CreateLoginProfile'

group_with_privilege_escalation_by_actions_iam_CreateLoginProfile

>

Group with privilege escalation by actions 'iam:CreatePolicyVersion'

group_with_privilege_escalation_by_actions_iam_CreatePolicyVersion

>

Group with privilege escalation by actions 'iam:PutGroupPolicy'

group_with_privilege_escalation_by_actions_iam_PutGroupPolicy

>

Group with privilege escalation by actions 'iam:PutRolePolicy'

group_with_privilege_escalation_by_actions_iam_PutRolePolicy

>

Group with privilege escalation by actions 'iam:PutUserPolicy'

group_with_privilege_escalation_by_actions_iam_PutUserPolicy

>

Group with privilege escalation by actions 'iam:SetDefaultPolicyVersion'

group_with_privilege_escalation_by_actions_iam_SetDefaultPolicyVersion

>

Group with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole'

group_with_privilege_escalation_by_actions_iam_UpdateAssumeRolePolicy_and_sts_AssumeRole

>

Group with privilege escalation by actions 'iam:UpdateLoginProfile'

group_with_privilege_escalation_by_actions_iam_UpdateLoginProfile

>

Group with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction'

group_with_privilege_escalation_by_actions_iam_PassRole_and_lambda_CreateFunction_and_lambda_InvokeFunction

>

Group with privilege escalation by actions 'lambda:UpdateFunctionCode'

group_with_privilege_escalation_by_actions_lambda_UpdateFunctionCode

>

GuardDuty detector disabled

guardduty_detector_disabled

>

Hardcoded AWS access key

hardcoded_aws_access_key

>

Hardcoded AWS access key in Lambda

hardcoded_aws_access_key_in_lambda

>

HTTP port open to internet

http_port_open

>

IAM access key is exposed

iam_access_key_is_exposed

>

IAM database auth not enabled

iam_database_auth_not_enabled

>

IAM group without users

iam_group_without_users

>

IAM password policy does not require lowercase letter

iam_password_does_not_require_lowercase

>

IAM password policy does not require numbers

iam_password_does_not_require_number

>

IAM password policy does not require symbol

iam_password_does_not_require_symbol

>

IAM password policy does not require uppercase letter

iam_password_does_not_require_uppercase

>

IAM password without minimum length

iam_password_without_minimum_length

>

IAM policies attached to user

iam_policies_attached_to_user

>

IAM policies with full privileges

iam_policies_with_full_privileges

>

IAM policy grants 'AssumeRole' permission across all services

iam_policy_grants_assumerole_permission_across_all_services

>

IAM policy grants full permissions

iam_policy_grants_full_permissions

>

IAM role allows all principals to assume

iam_role_allows_all_principals_to_assume

>

IAM role policy passrole allows all

iam_role_policy_passrole_allows_all

>

IAM role with full privileges

iam_role_with_full_privileges

>

IAM user has too many access keys

iam_user_too_many_access_keys

>

IAM user policy without MFA

iam_user_policy_without_mfa

>

IAM user with access to console

iam_user_with_access_to_console

>

IMDSv1 enabled

imdsv1_is_enabled

>

Instance with no VPC

instance_with_no_vpc

>

Kinesis not encrypted with KMS

kinesis_not_encrypted_with_kms

>

Kinesis SSE not configured

kinesis_sse_not_configured

>

KMS key with no deletion window

kms_key_with_no_deletion_window

>

KMS key with vulnerable policy

kms_key_with_full_permissions

>

Lambda function publicly accessible

lambda_function_publicly_accessible

>

Lambda function with privileged role

lambda_function_with_privileged_role

>

Lambda functions without X-Ray tracing

lambda_functions_without_x-ray_tracing

>

Lambda IAM InvokeFunction misconfigured

lambda_iam_invokefunction_misconfigured

>

Lambda permission misconfigured

lambda_permission_misconfigured

>

Lambda permission principal is wildcard

lambda_permission_principal_is_wildcard

>

Lambda with vulnerable policy

lambda_with_vulnerable_policy

>

Launch configuration is not encrypted

launch_configuration_is_not_encrypted

>

Misconfigured password policy expiration

misconfigured_password_policy_expiration

>

Missing cluster log types

missing_cluster_log_types

>

MQ broker is publicly accessible

mq_broker_is_publicly_accessible

>

MQ broker logging disabled

mq_broker_logging_disabled

>

MSK broker is publicly accessible

msk_broker_is_publicly_accessible

>

MSK cluster encryption disabled

msk_cluster_encryption_disabled

>

MSK cluster logging disabled

msk_cluster_logging_disabled

>

Neptune cluster instance is publicly accessible

neptune_cluster_instance_is_publicly_accessible

>

Neptune cluster snapshot not encrypted

neptune_snapshots_not_encrypted

>

Neptune cluster with IAM database authentication disabled

neptune_cluster_with_iam_database_authentication_disabled

>

Neptune database cluster encryption disabled

neptune_database_cluster_encryption_disabled

>

Neptune logging is disabled

neptune_logging_disabled

>

Network ACL with unrestricted access to RDP

network_acl_with_unrestricted_access_to_rdp

>

Network ACL with unrestricted access to SSH

network_acl_with_unrestricted_access_to_ssh

>

No password policy enabled

no_password_policy_enabled

>

No stack policy

no_stack_policy

>

Password without reuse prevention

password_without_reuse_prevention

>

Policy without principal

policy_without_principal

>

Public and private EC2 share role

public_and_private_ec2_share_role

>

Public Lambda via API Gateway

public_lambda_via_api_gateway

>

RDS associated with public subnet

rds_associated_with_public_subnet

>

RDS cluster with backup disabled

rds_cluster_with_backup_disabled

>

RDS database cluster not encrypted

rds_database_cluster_not_encrypted

>

RDS DB instance publicly accessible

rds_db_instance_publicly_accessible

>

RDS storage not encrypted

rds_storage_not_encrypted

>

RDS using default port

rds_using_default_port

>

RDS with backup disabled

rds_with_backup_disabled

>

RDS without logging

rds_without_logging

>

Redis disabled

redis_disabled

>

Redis not compliant

redis_not_compliant

>

Redshift cluster logging disabled

redshift_cluster_logging_disabled

>

Redshift cluster without VPC

redshift_cluster_without_vpc

>

Redshift not encrypted

redshift_not_encrypted

>

Redshift publicly accessible

redshift_publicly_accessible

>

Redshift using default port

redshift_using_default_port

>

Remote Desktop port open to internet

remote_desktop_port_open_to_internet

>

Resource not using tags

resource_not_using_tags

>

REST API with vulnerable policy

rest_api_with_vulnerable_policy

>

Role with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole'

role_with_privilege_escalation_by_actions_iam_PassRole_and_cloudformation_CreateStack

>

Role with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'

role_with_privilege_escalation_by_actions_iam_PassRole_and_ec2_RunInstances

>

Role with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole'

role_with_privilege_escalation_by_actions_iam_PassRole_and_glue_CreateDevEndpoint

>

Role with privilege escalation by actions 'glue:UpdateDevEndpoint'

role_with_privilege_escalation_by_actions_glue_UpdateDevEndpoint

>

Role with privilege escalation by actions 'iam:AddUserToGroup'

role_with_privilege_escalation_by_actions_iam_AddUserToGroup

>

Role with privilege escalation by actions 'iam:AttachGroupPolicy'

role_with_privilege_escalation_by_actions_iam_AttachGroupPolicy

>

Role with privilege escalation by actions 'iam:AttachRolePolicy'

role_with_privilege_escalation_by_actions_iam_AttachRolePolicy

>

Role with privilege escalation by actions 'iam:AttachUserPolicy'

role_with_privilege_escalation_by_actions_iam_AttachUserPolicy

>

Role with privilege escalation by actions 'iam:CreateAccessKey'

role_with_privilege_escalation_by_actions_iam_CreateAccessKey

>

Role with privilege escalation by actions 'iam:CreateLoginProfile'

role_with_privilege_escalation_by_actions_iam_CreateLoginProfile

>

Role with privilege escalation by actions 'iam:CreatePolicyVersion'

role_with_privilege_escalation_by_actions_iam_CreatePolicyVersion

>

Role with privilege escalation by actions 'iam:PutGroupPolicy'

role_with_privilege_escalation_by_actions_iam_PutGroupPolicy

>

Role with privilege escalation by actions 'iam:PutRolePolicy'

role_with_privilege_escalation_by_actions_iam_PutRolePolicy

>

Role with privilege escalation by actions 'iam:PutUserPolicy'

role_with_privilege_escalation_by_actions_iam_PutUserPolicy

>

Role with privilege escalation by actions 'iam:SetDefaultPolicyVersion'

role_with_privilege_escalation_by_actions_iam_SetDefaultPolicyVersion

>

Role with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole'

role_with_privilege_escalation_by_actions_iam_UpdateAssumeRolePolicy_and_sts_AssumeRole

>

Role with privilege escalation by actions 'iam:UpdateLoginProfile'

role_with_privilege_escalation_by_actions_iam_UpdateLoginProfile

>

Role with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction'

role_with_privilege_escalation_by_actions_iam_PassRole_and_lambda_CreateFunction_lambda_InvokeFunction

>

Role with privilege escalation by actions 'lambda:UpdateFunctionCode'

role_with_privilege_escalation_by_actions_lambda_UpdateFunctionCode

>

Root account has active access keys

root_account_has_active_access_keys

>

Route53 record undefined

route53_record_undefined

>

S3 bucket access to any principal

s3_bucket_access_to_any_principal

>

S3 bucket ACL allows read or write to all users

s3_bucket_acl_allows_read_or_write_to_all_users

>

S3 bucket ACL allows read to any authenticated user

s3_bucket_acl_allows_read_to_any_authenticated_user

>

S3 bucket ACL grants WRITE_ACP permission

s3_bucket_acl_grants_write_acp_permission

>

S3 bucket allows authenticated users access

s3_bucket_allows_access_to_all_authenticated_users

>

S3 bucket allows delete action from all principals

s3_bucket_allows_delete_action_from_all_principals

>

S3 bucket allows get action from all principals

s3_bucket_allows_get_action_from_all_principals

>

S3 bucket allows list action from all principals

s3_bucket_allows_list_action_from_all_principals

>

S3 bucket allows public ACL

s3_bucket_allows_public_acl

>

S3 bucket allows public policy

s3_bucket_with_public_policy

>

S3 bucket allows put action from all principals

s3_bucket_allows_put_action_from_all_principals

>

S3 bucket logging disabled

s3_bucket_logging_disabled

>

S3 bucket object not encrypted

s3_bucket_object_not_encrypted

>

S3 bucket object-level CloudTrail logging disabled

s3_bucket_object_level_cloudtrail_logging_disabled

>

S3 bucket policy accepts HTTP requests

s3_bucket_policy_accepts_http_requests

>

S3 bucket public ACL overridden by public access block

s3_bucket_public_acl_overridden_by_public_access_block

>

S3 bucket with all permissions

s3_bucket_with_all_permissions

>

S3 bucket with unsecured CORS rule

s3_bucket_with_unsecured_cors_rule

>

S3 bucket without enabled MFA delete

s3_bucket_without_enabled_mfa_delete

>

S3 bucket without ignore public ACL

s3_bucket_without_ignore_public_acl

>

S3 bucket without restriction of public bucket

s3_bucket_without_restriction_of_public_bucket

>

S3 bucket without versioning

s3_bucket_without_versioning

>

S3 static website host enabled

s3_static_website_host_enabled

>

SageMaker endpoint configuration encryption disabled

sagemaker_endpoint_configuration_encryption_disabled

>

SageMaker notebook instance without KMS

sagemaker_notebook_instance_without_kms

>

SageMaker notebook internet access enabled

sagemaker_direct_internet_access_enabled

>

Secrets Manager secret encrypted with AWS-managed key

secretsmanager_secret_encrypted_with_aws_managed_key

>

Secrets Manager secret without KMS

secretsmanager_secret_without_kms

>

Secrets Manager with vulnerable policy

secrets_manager_with_vulnerable_policy

>

Secure ciphers disabled

secure_ciphers_disabled

>

Security group not used

security_groups_not_used

>

Security group rule without description

security_group_rules_without_description

>

Security group rule without description

security_group_without_description

>

Security group with unrestricted access to SSH

security_group_with_unrestricted_access_to_ssh

>

Sensitive port is exposed to entire network

sensitive_port_is_exposed_to_entire_network

>

Sensitive port is exposed to small public network

sensitive_port_is_exposed_to_small_public_network

>

Sensitive port is exposed to wide private network

sensitive_port_is_exposed_to_wide_private_network

>

Service control policies disabled

service_control_policies_disabled

>

SES policy with allowed IAM actions

ses_policy_with_allowed_iam_actions

>

Shield Advanced not in use

shield_advanced_not_in_use

>

SNS topic encrypted with AWS managed key

sns_topic_encrypted_with_aws_managed_key

>

SNS topic is publicly accessible

sns_topic_is_publicly_accessible

>

SNS topic not encrypted

sns_topic_not_encrypted

>

SNS topic publicity has allow and NotAction simultaneously

sns_topic_publicity_has_allow_and_not_action_simultaneously

>

SQL analysis services port 2383 (TCP) is publicly accessible

sql_analysis_services_port_2383_is_publicly_accessible

>

SQS policy allows all actions

sqs_policy_allows_all_actions

>

SQS policy with public access

sqs_policy_with_public_access

>

SQS queue exposed

sqs_queue_exposed

>

SQS VPC endpoint without DNS resolution

sqs_vpc_endpoint_without_dns_resolution

>

SQS with SSE disabled

sqs_with_sse_disabled

>

SSM session transit encryption disabled

ssm_session_transit_encryption_disabled

>

SSO identity user unsafe creation

sso_identity_user_unsafe_creation

>

SSO permission with inadequate user session duration

sso_permission_with_inadequate_user_session_duration

>

SSO policy with full privileges

sso_policy_with_full_privileges

>

Stack notifications disabled

stack_notifications_disabled

>

Stack retention disabled

stack_retention_disabled

>

Stack without template

stack_without_template

>

Team tag missing

team_tag_not_present

>

Unknown port exposed to internet

unknown_port_exposed_to_internet

>

Unrestricted security group ingress

unrestricted_security_group_ingress

>

Unscanned ECR image

unscanned_ecr_image

>

User data contains encoded private key

user_data_contains_encoded_private_key

>

User with privilege escalation by actions 'cloudformation:CreateStack' and 'iam:PassRole'

user_with_privilege_escalation_by_actions_iam_PassRole_and_cloudformation_CreateStack

>

User with privilege escalation by actions 'ec2:RunInstances' and 'iam:PassRole'

user_with_privilege_escalation_by_actions_iam_PassRole_and_ec2_RunInstances

>

User with privilege escalation by actions 'glue:CreateDevEndpoint' and 'iam:PassRole'

user_with_privilege_escalation_by_actions_iam_PassRole_and_glue_CreateDevEndpoint

>

User with privilege escalation by actions 'glue:UpdateDevEndpoint'

user_with_privilege_escalation_by_actions_glue_UpdateDevEndpoint

>

User with privilege escalation by actions 'iam:AddUserToGroup'

user_with_privilege_escalation_by_actions_iam_AddUserToGroup

>

User with privilege escalation by actions 'iam:AttachGroupPolicy'

user_with_privilege_escalation_by_actions_iam_AttachGroupPolicy

>

User with privilege escalation by actions 'iam:AttachRolePolicy'

user_with_privilege_escalation_by_actions_iam_AttachRolePolicy

>

User with privilege escalation by actions 'iam:AttachUserPolicy'

user_with_privilege_escalation_by_actions_iam_AttachUserPolicy

>

User with privilege escalation by actions 'iam:CreateAccessKey'

user_with_privilege_escalation_by_actions_iam_CreateAccessKey

>

User with privilege escalation by actions 'iam:CreateLoginProfile'

user_with_privilege_escalation_by_actions_iam_CreateLoginProfile

>

User with privilege escalation by actions 'iam:CreatePolicyVersion'

user_with_privilege_escalation_by_actions_iam_CreatePolicyVersion

>

User with privilege escalation by actions 'iam:PutGroupPolicy'

user_with_privilege_escalation_by_actions_iam_PutGroupPolicy

>

User with privilege escalation by actions 'iam:PutRolePolicy'

user_with_privilege_escalation_by_actions_iam_PutRolePolicy

>

User with privilege escalation by actions 'iam:PutUserPolicy'

user_with_privilege_escalation_by_actions_iam_PutUserPolicy

>

User with privilege escalation by actions 'iam:SetDefaultPolicyVersion'

user_with_privilege_escalation_by_actions_iam_SetDefaultPolicyVersion

>

User with privilege escalation by actions 'iam:UpdateAssumeRolePolicy' and 'sts:AssumeRole'

user_with_privilege_escalation_by_actions_iam_UpdateAssumeRolePolicy_and_sts_AssumeRole

>

User with privilege escalation by actions 'iam:UpdateLoginProfile'

user_with_privilege_escalation_by_actions_iam_UpdateLoginProfile

>

User with privilege escalation by actions 'lambda:CreateFunction' and 'iam:PassRole' and 'lambda:InvokeFunction'

user_with_privilege_escalation_by_actions_iam_PassRole_and_lambda_CreateFunction_and_lambda_InvokeFunction

>

User with privilege escalation by actions 'lambda:UpdateFunctionCode'

user_with_privilege_escalation_by_actions_lambda_UpdateFunctionCode

>

VPC default security group accepts all traffic

vpc_default_security_group_accepts_all_traffic

>

VPC Flow Logs disabled

vpc_flowlogs_disabled

>

VPC peering route table with unrestricted CIDR

vpc_peering_route_table_with_unrestricted_cidr

>

VPC subnet assigns public IP

vpc_subnet_assigns_public_ip

>

VPC without Network Firewall

vpc_without_network_firewall

>

Vulnerable default SSL certificate

vulnerable_default_ssl_certificate

>

Workspaces workspace volume not encrypted

workspaces_workspace_volume_not_encrypted

>

>

AD admin not configured for SQL server

ad_admin_not_configured_for_sql_server

>

Admin user enabled for container registry

admin_user_enabled_for_container_registry

>

AKS disk encryption set ID undefined

aks_disk_encryption_set_id_undefined

>

AKS network policy misconfigured

aks_network_policy_misconfigured

>

AKS private cluster disabled

aks_private_cluster_disabled

>

AKS RBAC disabled

aks_rbac_disabled

>

App Service authentication disabled

app_service_authentication_disabled

>

App Service FTPS enforce disabled

app_service_ftps_enforce_disabled

>

App Service HTTP2 disabled

app_service_http2_disabled

>

App Service managed identity disabled

app_service_managed_identity_disabled

>

App Service not using latest TLS encryption version

app_service_not_using_latest_tls_encryption_version

>

App Service without latest PHP version

app_service_without_latest_php_version

>

App Service without latest Python version

app_service_without_latest_python_version

>

Azure Active Directory authentication

azure_active_directory_authentication

>

Azure App Service client certificate disabled

azure_app_service_client_certificate_disabled

>

Azure Cognitive Search public network access enabled

azure_cognitive_search_public_network_access_enabled

>

Azure Container Registry with no locks

azure_container_registry_with_no_locks

>

Azure Front Door WAF disabled

azure_front_door_waf_disabled

>

Azure instance using basic authentication

azure_instance_using_basic_authentication

>

Azure Policy Add-on Disabled in AKS Cluster

aks_uses_azure_policies_addon_disabled

>

Cosmos DB account without tags

cosmos_db_account_without_tags

>

CosmosDB account IP range filter not set

cosmosdb_account_ip_range_filter_not_set

>

Dashboard is enabled

dashboard_is_enabled

>

Default Azure storage account network access is too permissive

default_azure_storage_account_network_access_is_too_permissive

>

Email alerts disabled

email_alerts_disabled

>

Encryption on managed disk disabled

encryption_on_managed_disk_disabled

>

Ensure Azure MariaDB server is using latest TLS (1.2)

mariadb_not_using_latest_tls

>

Ensure MySQL is using the latest version of TLS encryption

mysql_not_using_latest_tls

>

Ensure that cloud resource has a team tag

team_tag_not_present

>

Ensure that PostgreSQL server disables public network access

postgres_sql_server_enables_public_access

>

Ensure that UDP services are restricted from the Internet

udp_services_not_restricted_from_internet

>

Ensure web app is not remotely debuggable

remote_debugging_enabled_app_service

>

Firewall rule allows too many hosts to access Redis Cache

firewall_rule_allows_too_many_hosts_to_access_redis_cache

>

Function App authentication disabled

function_app_authentication_disabled

>

Function App client certificates not required

function_app_client_certificates_unrequired

>

Function App FTPS enforce disabled

function_app_ftps_enforce_disabled

>

Function App HTTP2 disabled

function_app_http2_disabled

>

Function App managed identity disabled

function_app_managed_identity_disabled

>

Function App not using latest TLS encryption version

function_app_not_using_latest_tls_encryption_version

>

Geo redundancy is disabled

geo_redundancy_is_disabled

>

Key expiration not set

key_expiration_not_set

>

Key Vault secrets content type undefined

key_vault_secrets_content_type_undefined

>

Log retention is not set

log_retention_is_not_set

>

MariaDB server geo-redundant backup disabled

mariadb_server_georedundant_backup_disabled

>

MariaDB server public network access enabled

mariadb_public_network_access_enabled

>

MSSQL server auditing disabled

mssql_server_auditing_disabled

>

MSSQL server public network access enabled

mssql_server_public_network_access_enabled

>

MySQL server public access enabled

mysql_server_public_access_enabled

>

MySQL SSL connection disabled

mysql_ssl_connection_disabled

>

Network interfaces IP forwarding enabled

network_interfaces_ip_forwarding_enabled

>

Network interfaces with public IP

network_interfaces_with_public_ip

>

Network watcher flow disabled

network_watcher_flow_disabled

>

PostgreSQL log checkpoints disabled

postgresql_log_checkpoints_disabled

>

PostgreSQL log connections not set

postgresql_log_connections_not_set

>

PostgreSQL log disconnections not set

postgresql_log_disconnections_not_set

>

PostgreSQL log duration not set

postgresql_log_duration_not_set

>

PostgreSQL server infrastructure encryption disabled

postgresql_server_infrastructure_encryption_disabled

>

PostgreSQL Server threat detection policy disabled

postgresql_server_threat_detection_policy_disabled

>

PostgreSQL server without connection throttling

postgresql_server_without_connection_throttling

>

Public storage account

public_storage_account

>

RDP is exposed to the internet

rdp_is_exposed_to_the_internet

>

Redis cache allows non SSL connections

redis_cache_allows_non_ssl_connections

>

Redis entirely accessible

redis_entirely_accessible

>

Redis not updated regularly

redis_not_updated_regularly

>

Redis publicly accessible

redis_publicly_accessible

>

Role assignment not limit guest user permissions

role_assignment_not_limit_guest_users_permissions

>

Role definition allows custom role creation

role_definition_allows_custom_role_creation

>

Secret expiration not set

secret_expiration_not_set

>

Security center pricing tier is not standard

security_center_pricing_tier_is_not_standard

>

Security contact email

security_contact_email

>

Security group is not configured

security_group_is_not_configured

>

Sensitive port is exposed to entire network

sensitive_port_is_exposed_to_entire_network

>

Sensitive port is exposed to small public network

sensitive_port_is_exposed_to_small_public_network

>

Sensitive port is exposed to wide private network

sensitive_port_is_exposed_to_wide_private_network

>

Small activity log retention period

small_activity_log_retention_period

>

Small flow logs retention period

small_flow_logs_retention_period

>

Small MSSQL audit retention period

small_mssql_audit_retention_period

>

Small MSSQL server audit retention

small_msql_server_audit_retention

>

Small PostgreSQL DB server log retention period

small_postgresql_db_server_log_retention_period

>

SQL database audit disabled

sql_database_audit_disabled

>

SQL server alert email disabled

sql_server_alert_email_disabled

>

SQL server auditing disabled

sql_server_auditing_disabled

>

SQL server predictable Active Directory admin account name

sql_server_predictable_active_directory_admin_account_name

>

SQL server predictable admin account name

sql_server_predictable_admin_account_name

>

Sqlserver ingress from any IP

sql_server_ingress_from_any_ip

>

SSH is exposed to the Internet

ssh_is_exposed_to_the_internet

>

SSL enforce disabled

ssl_enforce_is_disabled

>

ssl_enforcement_enabled is not set to ENABLED for MySQL database server

mysql_enforce_ssl_connection_disabled

>

ssl_enforcement_enabled is not set to ENABLED for PostgreSQL database server

postgres_enforce_ssl_connection_disabled

>

Storage account not forcing HTTPS

storage_account_not_forcing_https

>

Storage account not using latest TLS encryption version

storage_account_not_using_latest_tls_encryption_version

>

Storage container is publicly accessible

storage_container_is_publicly_accessible

>

Storage share file allows all ACL permissions

storage_share_file_allows_all_acl_permissions

>

Storage table allows all ACL permissions

storage_table_allows_all_acl_permissions

>

Trusted Microsoft services not enabled

trusted_microsoft_services_not_enabled

>

Unrestricted SQL server access

unrestricted_sql_server_access

>

Vault auditing disabled

vault_auditing_disabled

>

Virtual network with DDoS protection plan disabled

virtual_network_with_ddos_protection_plan_disabled

>

VM not attached to network

vm_not_attached_to_network

>

WAF is disabled for Azure application gateway

waf_is_disabled_for_azure_application_gateway

>

Web app accepting traffic other than HTTPS

web_app_accepting_traffic_other_than_https

>

>

Artifact Registry repo is public

artifact_registry_repository_is_public

>

BigQuery dataset is public

bigquery_dataset_is_public

>

BigQuery table is public

bigquery_table_is_public

>

Cloud DNS without DNSSEC

cloud_dns_without_dnssec

>

Cloud KMS key ring is anonymously or publicly accessible

cloud_kms_key_rings_are_public

>

Cloud Run service is public

cloud_run_service_is_public

>

Cloud Storage bucket is publicly accessible

cloud_storage_bucket_is_publicly_accessible

>

Cloud Storage bucket logging not enabled

cloud_storage_bucket_logging_not_enabled

>

Cloud Storage bucket versioning disabled

cloud_storage_bucket_versioning_disabled

>

Cloud Storage is anonymous or publicly accessible

cloud_storage_anonymous_or_publicly_accessible

>

Cluster labels disabled

cluster_labels_disabled

>

Container Registry repo is public

container_registry_repository_is_public

>

COS node image not used

cos_node_image_not_used

>

Dataproc clusters has public IPs

dataproc_cluster_has_public_ip

>

Dataproc clusters publicly accessible

dataproc_clusters_is_public

>

Disk encryption disabled

disk_encryption_disabled

>

DNSSEC using RSASHA1

dnssec_using_rsasha1

>

Ensure legacy networks do not exist for a project

legacy_networks_exist_for_project

>

Ensure SQL database instance has skip show database flag

sql_database_instance_does_not_have_skip_show_database

>

GKE control plane is public

gke_control_plane_is_public

>

GKE legacy authorization enabled

gke_legacy_authorization_enabled

>

GKE using default service account

gke_using_default_service_account

>

Google Compute firewall ingress allows unrestricted FTP access

firewall_ingress_allows_unrestricted_ftp_access

>

Google Compute firewall ingress allows unrestricted MySQL access

firewall_ingress_allows_unrestricted_mysql_access

>

Google Compute network using default firewall rule

google_compute_network_using_default_firewall_rule

>

Google Compute network using firewall rule that allows all ports

google_compute_network_using_firewall_rule_allows_all_ports

>

Google Compute network using firewall rule that allows port range

google_compute_network_using_firewall_rule_allows_port_range

>

Google Compute SSL policy weak cipher in use

google_compute_ssl_policy_weak_cipher_in_use

>

Google Compute subnetwork logging disabled

google_compute_subnetwork_logging_disabled

>

Google Compute subnetwork with private Google access disabled

google_compute_subnetwork_with_private_google_access_disabled

>

Google Container node pool auto repair disabled

google_container_node_pool_auto_repair_disabled

>

Google project auto create network disabled

google_project_auto_create_network_disabled

>

Google project IAM binding service account has token creator or account user role

google_project_iam_binding_service_account_has_token_creator_or_account_user_role

>

Google project IAM member service account has admin role

google_project_iam_member_service_account_has_admin_role

>

Google project IAM member service account has token creator or account user role

google_project_iam_member_service_account_has_token_creator_or_account_user_role

>

Google Storage bucket level access disabled

google_storage_bucket_level_access_disabled

>

High Google KMS crypto key rotation period

high_google_kms_crypto_key_rotation_period

>

IAM audit not properly configured

iam_audit_not_properly_configured

>

IP aliasing disabled

ip_aliasing_disabled

>

IP forwarding enabled

ip_forwarding_enabled

>

KMS admin and CryptoKey roles in use

kms_admin_and_crypto_key_roles_in_use

>

KMS CryptoKey is publicly accessible

kms_crypto_key_publicly_accessible

>

Legacy client certificate auth enabled

legacy_client_certificate_auth_enabled

>

Network policy disabled

network_policy_disabled

>

Node auto upgrade disabled

node_auto_upgrade_disabled

>

Not proper email account in use

not_proper_email_account_in_use

>

OSLogin disabled

os_login_disabled

>

OSLogin is disabled for VM instance

os_login_is_disabled_for_vm_instance

>

Outdated GKE version

outdated_gke_version

>

Pod security policy disabled

pod_security_policy_disabled

>

Private cluster disabled

private_cluster_disabled

>

Project-wide SSH keys are enabled in VM instances

project_wide_ssh_keys_are_enabled_in_vm_instances

>

Pub/Sub Topics are anonymously or publicly accessible

pubsub_topic_is_public

>

RDP access is not restricted

rdp_access_is_not_restricted

>

Serial ports are enabled for VM instances

vm_serial_ports_are_enabled_for_vm_instances

>

Service account with improper privileges

service_account_with_improper_privileges

>

Shielded GKE nodes disabled

shielded_gke_nodes_disabled

>

Shielded VM disabled

shielded_vm_disabled

>

SQL DB instance backup disabled

sql_db_instance_backup_disabled

>

SQL DB instance publicly accessible

sql_db_instance_is_publicly_accessible

>

SQL DB instance with SSL disabled

sql_db_instance_with_ssl_disabled

>

SQL Server cross DB ownership chaining enabled

sql_database_has_cross_db_ownership_chaining

>

SSH access is not restricted

ssh_access_is_not_restricted

>

Stackdriver Logging disabled

stackdriver_logging_disabled

>

Stackdriver Monitoring disabled

stackdriver_monitoring_disabled

>

Team label missing

team_label_not_present

>

There are non GCP-managed service account keys for a service account

service_has_non_gcp_managed_service_account_keys

>

User with IAM role

user_with_iam_role

>

Using default service account

using_default_service_account

>

VM with full cloud access

vm_with_full_cloud_access

>

>

Further Reading

Additional helpful documentation, links, and articles:

Set up IaC SecurityDOCUMENTATION Configure IaC Security ExclusionsDOCUMENTATION