Rules
301 checks for AWS Terraform and CloudFormation, read from the same catalog the engine runs. Each page says what the check looks at and how to fix it.
Severity:
all
criticalhighmediumlow
Format:
Terraform (all)
CloudFormation
301 shown.
ACM
| AWS_ACM_001 | ACM certificate should use DNS validation instead of email validation | MEDIUM |
| AWS_ACM_002 | ACM certificate should use RSA 2048 or ECDSA P-256 key algorithm | LOW |
APIGW
| AWS_APIGW_001 | API Gateway REST stage should have access logging enabled | MEDIUM |
| AWS_APIGW_002 | API Gateway stage should have X-Ray tracing enabled | LOW |
| AWS_APIGW_005 | API Gateway stage has neither X-Ray nor access logs | MEDIUM |
| AWS_APIGW_006 | API Gateway custom domain should not use the legacy TLS 1.0 security policy | MEDIUM |
| AWS_APIGW_007 | API Gateway method cache should be encrypted when caching is enabled | MEDIUM |
ATHENA
| AWS_ATHENA_001 | Athena workgroup should enforce workgroup configuration and encrypt query results | MEDIUM |
BACKUP
| AWS_BACKUP_001 | AWS Backup vault should have Vault Lock enabled for immutable backups | MEDIUM |
| AWS_BACKUP_002 | Backup Vault Lock governance mode remains removable | LOW |
BATCH
| AWS_BATCH_001 | AWS Batch job definition should not run privileged containers | HIGH |
BEDROCK
| AWS_BEDROCK_001 | Bedrock service role trust policy lacks aws:SourceArn scoping | HIGH |
| AWS_BEDROCK_002 | Bedrock agent conversation data not encrypted with a customer-managed key | MEDIUM |
| AWS_BEDROCK_003 | Bedrock agent idle session TTL exceeds one hour | LOW |
| AWS_BEDROCK_004 | Bedrock AgentCore code interpreter has public internet access | HIGH |
| AWS_BEDROCK_005 | Bedrock AgentCore browser has public internet access | HIGH |
| AWS_BEDROCK_006 | Bedrock AgentCore memory not encrypted with a customer-managed key | MEDIUM |
| AWS_BEDROCK_007 | Bedrock AgentCore gateway not encrypted with a customer-managed key | MEDIUM |
CLOUDFRONT
| AWS_CLOUDFRONT_001 | CloudFront distribution viewer protocol policy should redirect HTTP to HTTPS | HIGH |
| AWS_CLOUDFRONT_002 | CloudFront distribution should enforce a minimum TLS version of TLSv1.2 | MEDIUM |
| AWS_CLOUDFRONT_003 | CloudFront origin should use HTTPS — not HTTP | HIGH |
| AWS_CLOUDFRONT_004 | CloudFront distribution should have access logging configured | LOW |
| AWS_CLOUDFRONT_005 | CloudFront distribution should have a WAF web ACL associated | MEDIUM |
| AWS_CLOUDFRONT_006 | CloudFront distribution should have access logging enabled | MEDIUM |
| AWS_CLOUDFRONT_007 | CloudFront Field Level Encryption profile is configured but not assigned to cache behavior | MEDIUM |
CODEBUILD
| AWS_CODEBUILD_001 | CodeBuild project should not run builds in privileged mode | HIGH |
| AWS_CODEBUILD_002 | CodeBuild project environment variables should not contain plaintext secrets | HIGH |
| AWS_CODEBUILD_004 | CodeBuild project build artifact encryption should be enabled | MEDIUM |
COGNITO
| AWS_COGNITO_001 | Cognito user pool should have advanced security mode set to ENFORCED | HIGH |
| AWS_COGNITO_002 | Cognito user pool should enable MFA | MEDIUM |
CT
| AWS_CT_001 | CloudTrail trail should be multi-region | HIGH |
| AWS_CT_002 | CloudTrail trail should have log file validation enabled | MEDIUM |
| AWS_CT_003 | CloudTrail trail should integrate with CloudWatch Logs | MEDIUM |
| AWS_CT_005 | CloudTrail trail should encrypt logs with a KMS key (SSE-KMS) | MEDIUM |
| AWS_CT_006 | CloudTrail trail should have logging enabled | HIGH |
DAX
| AWS_DAX_001 | DynamoDB Accelerator (DAX) cluster should have encryption at rest enabled | HIGH |
DDB
| AWS_DDB_001 | DynamoDB table should have Point-in-Time Recovery (PITR) enabled | MEDIUM |
| AWS_DDB_002 | DynamoDB table should use a customer-managed KMS key for encryption | LOW |
| AWS_DDB_003 | DynamoDB table should have deletion protection enabled | MEDIUM |
DMS
| AWS_DMS_001 | DMS replication instance should not be publicly accessible | CRITICAL |
DOCDB
| AWS_DOCDB_001 | DocumentDB cluster should have storage encryption enabled | HIGH |
| AWS_DOCDB_002 | DocumentDB cluster should export audit logs to CloudWatch | MEDIUM |
| AWS_DOCDB_003 | DocumentDB global cluster does not encrypt storage | HIGH |
EBS
| AWS_EBS_001 | Account-level default EBS encryption should not be disabled | HIGH |
EC2
| AWS_EC2_001 | EC2 instance should require IMDSv2 (token-based metadata access) | HIGH |
| AWS_EC2_002 | EC2 instance should have EBS root volume encryption enabled | HIGH |
| AWS_EC2_003 | Security group should not allow 0.0.0.0/0 ingress on SSH (port 22) or RDP (port 3389) | CRITICAL |
| AWS_EC2_004 | EC2 instance uses a GPU or compute-intensive type without a shutdown schedule | MEDIUM |
| AWS_EC2_005 | EC2 instance uses an oversized compute type (24xlarge or 32xlarge) | LOW |
| AWS_EC2_006 | EC2 instance has no metadata options block — IMDSv2 not configured | HIGH |
| AWS_EC2_008 | EBS volume should have encryption enabled | HIGH |
| AWS_EC2_009 | EC2 instance has detailed monitoring explicitly disabled | HIGH |
| AWS_EC2_010 | Network ACL should not allow 0.0.0.0/0 ingress on SSH (22) or RDP (3389) | HIGH |
| AWS_EC2_011 | IMDS hop limit above 1 exposes the instance role to containers on the host | MEDIUM |
| AWS_EC2_013 | EC2 root volume is unencrypted because EBS encryption by default is turned off | MEDIUM |
ECR
| AWS_ECR_001 | ECR repository should have scan-on-push enabled | MEDIUM |
| AWS_ECR_002 | ECR repository should have image tag immutability enabled | MEDIUM |
| AWS_ECR_003 | ECR repository should use KMS encryption rather than AES256 | LOW |
| AWS_ECR_004 | ECR repository should have a lifecycle policy to expire old images | LOW |
ECS
| AWS_ECS_001 | ECS task definition should not run containers in privileged mode | HIGH |
| AWS_ECS_002 | ECS task definition container should use a read-only root filesystem | MEDIUM |
| AWS_ECS_003 | ECS cluster should have Container Insights enabled | LOW |
| AWS_ECS_004 | ECS task definition should specify a task role for fine-grained IAM access | MEDIUM |
| AWS_ECS_005 | ECS task definition should configure log driver for audit containers | MEDIUM |
| AWS_ECS_006 | ECS Exec (SSM-based shell access) should log to CloudWatch or S3 | MEDIUM |
| AWS_ECS_008 | ECS task definition EFS volume has transit encryption disabled | HIGH |
EFS
| AWS_EFS_001 | EFS file system should have encryption at rest enabled | HIGH |
| AWS_EFS_002 | EFS file system should have a backup policy enabled | MEDIUM |
| AWS_EFS_003 | EFS file system should use a customer-managed KMS key | LOW |
EKS
| AWS_EKS_001 | EKS cluster Secrets should have envelope encryption | HIGH |
| AWS_EKS_002 | EKS cluster should have control-plane logging enabled | MEDIUM |
| AWS_EKS_003 | EKS cluster API server endpoint should not be publicly accessible | HIGH |
| AWS_EKS_004 | EKS cluster should use a supported Kubernetes version | HIGH |
| AWS_EKS_005 | EKS node group with SSH access should restrict source security groups | MEDIUM |
| AWS_EKS_006 | EKS cluster with a public endpoint should limit which addresses can reach it | HIGH |
ELASTICACHE
| AWS_ELASTICACHE_001 | ElastiCache replication group should have at-rest encryption enabled | HIGH |
| AWS_ELASTICACHE_002 | ElastiCache replication group should have in-transit encryption enabled | HIGH |
| AWS_ELASTICACHE_003 | ElastiCache replication group should require AUTH or RBAC | HIGH |
| AWS_ELASTICACHE_004 | ElastiCache replication group should have automatic failover enabled | MEDIUM |
| AWS_ELASTICACHE_005 | ElastiCache cluster (standalone) should be upgraded to a replication group | MEDIUM |
| AWS_ELASTICACHE_007 | ElastiCache Redis cluster should retain at least one automatic snapshot | MEDIUM |
| AWS_ELASTICACHE_008 | First AUTH token update should remove passwordless access | HIGH |
ELB
| AWS_ELB_001 | Load balancer should have access logging enabled | MEDIUM |
| AWS_ELB_002 | Classic ELB listener should not use HTTP — require HTTPS | HIGH |
| AWS_ELB_003 | ALB should drop invalid HTTP headers | LOW |
| AWS_ELB_004 | ALB should have deletion protection enabled | LOW |
| AWS_ELB_005 | ALB HTTP listener should redirect to HTTPS | MEDIUM |
EMR
| AWS_EMR_001 | EMR Serverless application should have auto-stop configured | MEDIUM |
| AWS_EMR_002 | EMR Serverless application should have maximum capacity limits set | MEDIUM |
| AWS_EMR_003 | EMR cluster should use Spot instances for task nodes to reduce cost | LOW |
EVENTBRIDGE
| AWS_EVENTBRIDGE_001 | EventBridge Lambda targets should have invocation authorization | MEDIUM |
| AWS_EVENTBRIDGE_002 | Custom EventBridge bus should use a KMS key for encryption | LOW |
FIREHOSE
| AWS_FIREHOSE_001 | Kinesis Firehose delivery stream should have server-side encryption enabled | MEDIUM |
| AWS_FIREHOSE_002 | Kinesis Firehose delivery stream should have CloudWatch error logging enabled | LOW |
FSX
| AWS_FSX_001 | FSx file system should use a customer-managed KMS key for encryption | MEDIUM |
GA
| AWS_GA_001 | Global Accelerator should enable flow logs | MEDIUM |
GDY
| AWS_GDY_001 | GuardDuty detector should be enabled | HIGH |
| AWS_GDY_002 | GuardDuty S3 protection should be enabled | MEDIUM |
| AWS_GDY_003 | GuardDuty EKS protection should be enabled | MEDIUM |
GLUE
| AWS_GLUE_002 | Glue catalog database table with JSON classifier should use SSE-KMS | MEDIUM |
| AWS_GLUE_003 | Legacy Glue job should have continuous CloudWatch logging enabled | LOW |
| AWS_GLUE_004 | Glue connection password should not be a plaintext literal | HIGH |
| AWS_GLUE_005 | Glue Data Catalog and connection-password responses should be protected | HIGH |
| AWS_GLUE_006 | Glue security configuration should encrypt S3 data at rest | HIGH |
IAM
| AWS_IAM_001 | IAM password policy should require uppercase, lowercase, number, and symbol | HIGH |
| AWS_IAM_002 | IAM password policy maximum age should be positive and no more than 90 days | MEDIUM |
| AWS_IAM_003 | IAM users should not have inline policies attached | MEDIUM |
| AWS_IAM_005 | IAM role trust policy should restrict principal to known sources | CRITICAL |
| AWS_IAM_008 | GitHub OIDC federated role allows assumption from any GitHub repository | CRITICAL |
| AWS_IAM_009 | GitHub OIDC federated role allows assumption from any repository in an org | HIGH |
| AWS_IAM_010 | EKS IRSA role trust allows any service account (overly broad subject claim) | HIGH |
| AWS_IAM_011 | GitHub OIDC role leaves the branch or environment open with a wildcard | MEDIUM |
| AWS_IAM_012 | IAM password policy should prevent password reuse | MEDIUM |
KINESIS
| AWS_KINESIS_001 | Kinesis Data Stream should use KMS server-side encryption | MEDIUM |
KMS
| AWS_KMS_001 | KMS key should have automatic rotation enabled | MEDIUM |
| AWS_KMS_003 | KMS multi-region key should restrict replica regions via key policy | MEDIUM |
LAKEFORMATION
| AWS_LAKEFORMATION_001 | Lake Formation grant should not use wildcard principal | HIGH |
LAMBDA
| AWS_LAMBDA_001 | Lambda function should not use an end-of-life runtime | HIGH |
| AWS_LAMBDA_003 | Lambda function should have X-Ray tracing enabled | LOW |
| AWS_LAMBDA_004 | Lambda function should have a dead-letter queue configured | MEDIUM |
| AWS_LAMBDA_005 | Lambda function should have code signing enabled | LOW |
| AWS_LAMBDA_006 | Lambda function URL should require authentication | CRITICAL |
| AWS_LAMBDA_007 | Lambda function should have an explicitly declared CloudWatch log group | MEDIUM |
LOGS
| AWS_LOGS_001 | CloudWatch log group should have a retention period configured | MEDIUM |
MEDIACONVERT
| AWS_MEDIACONVERT_001 | MediaConvert queue in production use should be RESERVED, not ON_DEMAND | LOW |
MQ
| AWS_MQ_001 | Amazon MQ broker should not be publicly accessible | HIGH |
| AWS_MQ_002 | Amazon MQ for ActiveMQ broker should enable audit logging to CloudWatch | MEDIUM |
MSK
| AWS_MSK_001 | MSK cluster should not allow unauthenticated client access | HIGH |
| AWS_MSK_002 | MSK cluster should enforce TLS encryption for client-to-broker connections | HIGH |
| AWS_MSK_003 | MSK cluster should not have public access enabled | HIGH |
| AWS_MSK_004 | MSK cluster should deliver broker logs to CloudWatch, S3, or Firehose | MEDIUM |
NEPTUNE
| AWS_NEPTUNE_001 | Neptune cluster should have storage encryption enabled | HIGH |
| AWS_NEPTUNE_002 | Neptune cluster should have audit logging enabled | MEDIUM |
| AWS_NEPTUNE_003 | Neptune cluster should have IAM database authentication enabled | MEDIUM |
| AWS_NEPTUNE_004 | Neptune cluster instance should not be publicly accessible | CRITICAL |
OPENSEARCH
| AWS_OPENSEARCH_001 | OpenSearch domain should have encryption at rest enabled | HIGH |
| AWS_OPENSEARCH_002 | OpenSearch domain should enforce HTTPS with a modern TLS policy | HIGH |
| AWS_OPENSEARCH_003 | OpenSearch domain should have node-to-node encryption enabled | MEDIUM |
| AWS_OPENSEARCH_004 | OpenSearch domain should have fine-grained access control enabled | MEDIUM |
| AWS_OPENSEARCH_005 | OpenSearch domain should have audit logging enabled | MEDIUM |
OPS
| AWS_OPS_001 | Long-running Lambda has no DLQ and no reserved concurrency | MEDIUM |
| AWS_OPS_002 | Lambda integration timeout shape (timeout config sanity) | LOW |
| AWS_OPS_003 | Long-running Lambda with low memory — likely workload misfit | LOW |
| AWS_OPS_004 | RDS instance with no Multi-AZ, no deletion protection and no final snapshot | HIGH |
| AWS_OPS_005 | ALB target group deregistration delay exceeds connection draining budget | LOW |
| AWS_OPS_006 | SQS visibility timeout under 60 seconds (including creation default) | MEDIUM |
| AWS_OPS_007 | ECS task definition with a container not marked essential | HIGH |
| AWS_OPS_008 | Auto Scaling Group with the same minimum and maximum size (no elasticity) | LOW |
| AWS_OPS_009 | RDS changes applied immediately instead of in the maintenance window | MEDIUM |
| AWS_OPS_010 | Lambda Function URL without direct-origin IAM authentication | HIGH |
| AWS_OPS_011 | CloudWatch alarm uses Average statistic for a latency-shaped metric | MEDIUM |
| AWS_OPS_012 | CloudWatch alarm on a critical metric treats missing data as missing | MEDIUM |
| AWS_OPS_014 | Lambda function has no CloudWatch alarm on Errors metric | LOW |
| AWS_OPS_015 | Lambda function has no CloudWatch alarm on Throttles metric | LOW |
| AWS_OPS_016 | ALB has no CloudWatch alarm on UnHealthyHostCount | LOW |
| AWS_OPS_017 | RDS instance has no declared CloudWatch alarm on CPUUtilization | LOW |
| AWS_OPS_018 | SQS queue has no alarm on ApproximateAgeOfOldestMessage | LOW |
| AWS_OPS_022 | Lambda exists but no CloudWatch dashboard declared in the same plan | LOW |
| AWS_OPS_023 | RDS engine version pinned to the major version only, with automatic minor upgrades on | MEDIUM |
| AWS_OPS_024 | ElastiCache cluster has multiple nodes but automatic failover is turned off | HIGH |
| AWS_OPS_025 | Internet-facing load balancer lacks proven health-aware DNS routing | MEDIUM |
| AWS_OPS_026 | Load balancer has deletion protection turned off | MEDIUM |
| AWS_OPS_027 | Lambda async invocation with no reserved concurrency (retry-storm risk) | MEDIUM |
| AWS_OPS_028 | EKS cluster declares a single node group | LOW |
| AWS_OPS_029 | ECS service runs a single task (no redundancy) | MEDIUM |
| AWS_OPS_030 | DynamoDB table has point-in-time recovery turned off | HIGH |
| AWS_OPS_032 | OpenSearch / Elasticsearch domain runs on a single instance | HIGH |
| AWS_OPS_033 | RDS instance has storage autoscaling turned off | LOW |
| AWS_OPS_034 | Aurora cluster keeps backups for one day or less | MEDIUM |
| AWS_OPS_035 | IAM role or user is missing a permissions boundary | MEDIUM |
| AWS_OPS_036 | IAM user, role, or group has a full-privilege AWS-managed policy attached (AdministratorAccess or IAMFullAccess) | CRITICAL |
| AWS_OPS_037 | IAM user credentials: prefer federation for people and roles for workloads | MEDIUM |
| AWS_OPS_038 | Declared IAM access key should have a documented rotation plan | MEDIUM |
| AWS_OPS_043 | IAM password policy has no minimum length of its own (the API default of 6 applies) | MEDIUM |
| AWS_OPS_044 | IAM inline policy attached to a role — should use managed policy | LOW |
| AWS_OPS_045 | Elastic IP declared without instance / NAT / NLB association | LOW |
| AWS_OPS_046 | CloudWatch log group retained for more than a year (audit-tier retention) | LOW |
| AWS_OPS_047 | Kinesis stream has more than one provisioned shard | LOW |
| AWS_OPS_048 | NAT gateway incurs hourly and processing charges | LOW |
| AWS_OPS_049 | Load balancer has no target-group declaration in scanned input | LOW |
| AWS_OPS_050 | CloudFront distribution has compression turned off | LOW |
| AWS_OPS_051 | RDS gp3 with iops at or below the included 3,000 baseline (provisions nothing) | LOW |
| AWS_OPS_052 | Launch template keeps an EBS volume after instance termination | LOW |
| AWS_OPS_053 | S3 bucket uses SSE-KMS without an S3 Bucket Key | LOW |
| AWS_OPS_054 | Review NAT gateway cost for the declared environment | LOW |
| AWS_OPS_056 | Lambda function is configured with 10,240 MB or more of memory | MEDIUM |
| AWS_OPS_057 | ECS task definition allocates 4+ vCPU — review utilization | LOW |
| AWS_OPS_058 | S3 CORS configuration warrants a CloudFront delivery review | LOW |
| AWS_OPS_059 | SQS queue has a delivery delay | LOW |
| AWS_OPS_060 | Step Functions Express state machine (5-minute limit) | MEDIUM |
| AWS_OPS_061 | Lambda VPC placement should match its private-resource requirements | LOW |
| AWS_OPS_062 | Sharded ElastiCache replication group needs a cluster mode review | MEDIUM |
| AWS_OPS_063 | Lambda function uses a mounted file system (Amazon EFS or Amazon S3 Files) | LOW |
| AWS_OPS_064 | Aurora Serverless v1 cluster (end of life) | MEDIUM |
| AWS_OPS_066 | EventBridge rule with rate(1 minute) schedule (high-cost cron) | LOW |
| AWS_OPS_067 | Stateful resource has no prevent-destroy guard | MEDIUM |
| AWS_OPS_068 | Provider version constraint allows any minor release (major version only) | LOW |
| AWS_OPS_070 | Hardcoded AWS account ID in resource argument | LOW |
| AWS_OPS_071 | Hardcoded AWS region in resource argument | LOW |
| AWS_OPS_072 | AWS provider block sets no default tags | LOW |
| AWS_OPS_073 | Terraform backend is local (state file on developer's laptop) | HIGH |
| AWS_OPS_074 | Terraform S3 backend without encryption or a state lock | MEDIUM |
| AWS_OPS_075 | Variable declared without type or validation | LOW |
| AWS_OPS_076 | Resource module sourced from raw GitHub URL (no version pin) | MEDIUM |
| AWS_OPS_077 | Secrets Manager access should use a VPC endpoint, not public internet | MEDIUM |
| AWS_OPS_078 | KMS access should use a VPC endpoint, not public internet | MEDIUM |
| AWS_OPS_079 | ECR access should use VPC endpoints to avoid public internet pull | MEDIUM |
| AWS_OPS_080 | KMS multi-region key should have replicas in DR regions | LOW |
| AWS_OPS_084 | AWS Backup vault should use a CMK for encryption | MEDIUM |
| AWS_OPS_085 | AWS Backup plan should include cross-region copy for DR | LOW |
| AWS_OPS_086 | AWS Inspector v2 should be enabled for EC2 and ECR vulnerability scanning | MEDIUM |
| AWS_OPS_090 | MemoryDB cluster used as primary data store | LOW |
| AWS_OPS_091 | Lambda timeout of 10 minutes or more (batch-shaped workload likely belongs elsewhere) | LOW |
| AWS_OPS_092 | DynamoDB table with high provisioned read capacity (suggests aggregation queries) | LOW |
ORGANIZATIONS
| AWS_ORGANIZATIONS_001 | AWS Organization should have all features enabled (not CONSOLIDATED_BILLING_ONLY) | HIGH |
| AWS_ORGANIZATIONS_002 | AWS Organizations SCP should declare a root-user denial | HIGH |
RDS
| AWS_RDS_001 | RDS instance storage should be encrypted at rest | CRITICAL |
| AWS_RDS_002 | RDS resource should not be publicly accessible | CRITICAL |
| AWS_RDS_003 | RDS instance should have automated backups enabled | HIGH |
| AWS_RDS_004 | RDS production instance should have Multi-AZ enabled | MEDIUM |
| AWS_RDS_005 | RDS deletion protection should be enabled | HIGH |
| AWS_RDS_006 | RDS Performance Insights uses AWS-managed key (not CMK) | LOW |
| AWS_RDS_007 | Aurora cluster has no explicit customer-managed key choice | MEDIUM |
| AWS_RDS_008 | RDS DB cluster has deletion protection disabled | HIGH |
| AWS_RDS_009 | RDS DB cluster backup retention period is 0, outside the 1-35 day range | LOW |
| AWS_RDS_010 | Aurora cluster does not enable IAM database authentication | MEDIUM |
| AWS_RDS_011 | Aurora cluster has fewer than two instances — no Multi-AZ failover target | MEDIUM |
| AWS_RDS_013 | RDS Enhanced Monitoring is disabled or the monitoring role is invalid | MEDIUM |
| AWS_RDS_015 | Aurora global cluster has no demonstrated customer-managed key choice | MEDIUM |
| AWS_RDS_016 | RDS automatic minor version upgrades are disabled | MEDIUM |
| AWS_RDS_017 | RDS backup retention period is shorter than 7 days | MEDIUM |
| AWS_RDS_018 | RDS PostgreSQL should enforce TLS connections | HIGH |
| AWS_RDS_019 | RDS MySQL should enforce TLS connections | HIGH |
| AWS_RDS_020 | Aurora PostgreSQL cluster should enforce TLS connections | HIGH |
| AWS_RDS_021 | Aurora MySQL cluster should enforce TLS connections | HIGH |
REDSHIFT
| AWS_REDSHIFT_001 | Redshift cluster should not be publicly accessible | CRITICAL |
| AWS_REDSHIFT_002 | Redshift cluster should enforce SSL connections | HIGH |
| AWS_REDSHIFT_003 | Redshift cluster should have encryption at rest enabled | HIGH |
| AWS_REDSHIFT_004 | Redshift cluster should have user activity logging enabled | MEDIUM |
ROLESANYWHERE
| AWS_ROLESANYWHERE_001 | Roles Anywhere trust policy lacks trust-anchor scoping (aws:SourceArn / aws:SourceAccount / sts:SourceIdentity) | HIGH |
ROUTE53
| AWS_ROUTE53_001 | Route53 hosted zone should have DNSSEC signing enabled | MEDIUM |
| AWS_ROUTE53_002 | Route53 health check should use HTTPS with SNI for HTTPS endpoints | LOW |
| AWS_ROUTE53_003 | Route53 failover record with PRIMARY role should have a health check | MEDIUM |
| AWS_ROUTE53_004 | Route53 public hosted zone should log DNS queries | MEDIUM |
S3
| AWS_S3_001 | S3 bucket should have Block Public Access enabled | CRITICAL |
| AWS_S3_003 | S3 bucket should have versioning enabled | HIGH |
| AWS_S3_004 | S3 bucket should have access logging enabled | MEDIUM |
| AWS_S3_005 | S3 bucket policy should deny non-TLS (HTTP) access | HIGH |
| AWS_S3_006 | S3 bucket ACL is set to public-read or public-read-write | CRITICAL |
| AWS_S3_007 | S3 bucket uses a legacy public ACL (inline acl attribute) | CRITICAL |
| AWS_S3_010 | S3 bucket has no Block Public Access companion resource | HIGH |
| AWS_S3_011 | S3 audit/compliance bucket has no object-lock configuration | MEDIUM |
| AWS_S3_012 | Versioned S3 bucket should enable MFA delete | LOW |
| AWS_S3_013 | S3 bucket ACL should not grant WRITE_ACP to a predefined group | HIGH |
| AWS_S3_014 | S3 bucket should not grant read to any authenticated AWS user | HIGH |
| AWS_S3_015 | S3 access point disables a Block Public Access setting | HIGH |
| AWS_S3_016 | S3 bucket has no versioning configured | LOW |
| AWS_S3_017 | S3 bucket has no server access logging | MEDIUM |
SAGEMAKER
| AWS_SAGEMAKER_001 | SageMaker domain should be in a VPC with security groups configured | MEDIUM |
| AWS_SAGEMAKER_002 | SageMaker notebook instance should not allow direct internet access | HIGH |
| AWS_SAGEMAKER_003 | SageMaker notebook instance should not enable root access | MEDIUM |
| AWS_SAGEMAKER_004 | SageMaker endpoint configuration should specify a KMS key for its storage volume | MEDIUM |
SFN
| AWS_SFN_001 | Step Functions state machine should have logging enabled | MEDIUM |
| AWS_SFN_002 | Step Functions state machine should have X-Ray tracing enabled | LOW |
SM
| AWS_SM_001 | Secrets Manager secret should have automatic rotation configured | MEDIUM |
SNS
| AWS_SNS_001 | SNS topic should use a customer-managed KMS key for encryption | MEDIUM |
| AWS_SNS_002 | SNS topic access policy should enforce TLS-only access | MEDIUM |
SQS
| AWS_SQS_001 | SQS queue without inline redrive should specify a KMS encryption key | MEDIUM |
| AWS_SQS_002 | SQS queue should have a dead-letter queue configured | MEDIUM |
| AWS_SQS_003 | SQS queue has server-side encryption explicitly disabled | MEDIUM |
SSM
| AWS_SSM_001 | SSM Parameter with secret-like name should use SecureString type | HIGH |
| AWS_SSM_002 | SSM Parameter should not store credential value as plaintext in Terraform | HIGH |
| AWS_SSM_004 | SSM document is shared publicly with every AWS account | HIGH |
SSO
| AWS_SSO_001 | SSO permission set inline policy should not grant full administrative privileges | HIGH |
VPC
| AWS_VPC_001 | VPC has no associated flow logs | MEDIUM |
| AWS_VPC_002 | VPC peering connection has no route table entry on requester side | MEDIUM |
| AWS_VPC_003 | Default security group permits any rule (should be no-rules) | MEDIUM |
| AWS_VPC_004 | Security group permits 0.0.0.0/0 on a known debug or management port | HIGH |
| AWS_VPC_005 | VPC subnet automatically assigns public IPs on launch | MEDIUM |
| AWS_VPC_006 | Security group allows unrestricted ingress on all ports from the internet | CRITICAL |
| AWS_VPC_007 | Modern security-group ingress rule opens a management port to 0.0.0.0/0 | HIGH |
| AWS_VPC_008 | Security-group ingress CIDRs are slices of the 0.0.0.0/0 supernet | HIGH |
| AWS_VPC_009 | Modern security-group ingress rule opens a management port to ::/0 | HIGH |
| AWS_VPC_010 | Security group inline ingress opens a management port to ::/0 | HIGH |
| AWS_VPC_011 | Security-group ingress CIDRs resolve to the entire address space | HIGH |
| AWS_VPC_012 | Route to a VPC peering connection should not use an unrestricted CIDR | MEDIUM |
| AWS_VPC_013 | Modern security-group ingress rule opens every port to 0.0.0.0/0 | CRITICAL |
| AWS_VPC_014 | Modern security-group ingress rule opens every port to ::/0 | HIGH |
| AWS_VPC_015 | Network ACL allows all traffic inbound from the internet | HIGH |
| AWS_VPC_016 | Standalone network ACL rule allows all traffic inbound from the internet | HIGH |
| AWS_VPC_017 | Security group allows unrestricted ingress on all ports from the IPv6 internet | CRITICAL |
| AWS_VPC_018 | Security group opens the complete TCP or UDP port range to the internet | CRITICAL |
| AWS_VPC_019 | Security group opens the complete TCP or UDP port range to the IPv6 internet | CRITICAL |
| AWS_VPC_020 | Security group opens SQL Server Browser (UDP 1434) to the internet | HIGH |
| AWS_VPC_021 | Security group opens SQL Server Browser (UDP 1434) to the IPv6 internet | HIGH |
WAF
| AWS_WAF_001 | WAFv2 web ACL default action is ALLOW with no rules configured | HIGH |
| AWS_WAF_002 | WAFv2 web ACL rate limit rule threshold is too permissive | MEDIUM |
| AWS_WAF_003 | WAFv2 web ACL should include AWSManagedRulesCommonRuleSet | MEDIUM |
| AWS_WAF_004 | WAFv2 web ACL should have logging enabled | MEDIUM |
| AWS_WAF_005 | WAFv2 web ACL rule should have CloudWatch metrics enabled | LOW |
WORKSPACES
| AWS_WORKSPACES_001 | WorkSpace should encrypt both its root and user volumes | HIGH |
Engine-generated findings
These come from the engine's cross-resource analysis rather than the catalog, so their ids are families, not single checks.
ATTACK_PATH_*— Attack paths- Chains that cross resources: an internet-reachable entry point, an identity it can use, and the IAM permissions that lead from there to account-wide control.
AWS_XREF_*— Cross-resource correlations- Issues that are only visible when you look at how several resources interact, not at any one resource on its own.
AWS_FUSION_*— Cost and security together- Findings that need a cost signal and a security signal on different resources in the same code, such as accelerator compute next to an administrator-equivalent IAM policy.
AWS_CRED_*— Credentials written into code- Literal credentials of recognisable shapes (AWS access key ids, private keys, provider tokens) in resource attributes, variable defaults and variable files.
AWS_CFN_*— CloudFormation only- Findings with no Terraform twin, such as a NoEcho parameter whose value flows into Outputs, or a nested stack pulled from an unpinned template URL.