Rules
301 checks for AWS Terraform and CloudFormation, read from the same catalog the engine runs. Each page says what the check looks at and how to fix it.
16 shown.
DMS
| AWS_DMS_001 | DMS replication instance should not be publicly accessible | CRITICAL |
EC2
| AWS_EC2_003 | Security group should not allow 0.0.0.0/0 ingress on SSH (port 22) or RDP (port 3389) | CRITICAL |
IAM
| AWS_IAM_005 | IAM role trust policy should restrict principal to known sources | CRITICAL |
| AWS_IAM_008 | GitHub OIDC federated role allows assumption from any GitHub repository | CRITICAL |
LAMBDA
| AWS_LAMBDA_006 | Lambda function URL should require authentication | CRITICAL |
NEPTUNE
| AWS_NEPTUNE_004 | Neptune cluster instance should not be publicly accessible | CRITICAL |
OPS
| AWS_OPS_036 | IAM user, role, or group has a full-privilege AWS-managed policy attached (AdministratorAccess or IAMFullAccess) | CRITICAL |
RDS
| AWS_RDS_001 | RDS instance storage should be encrypted at rest | CRITICAL |
| AWS_RDS_002 | RDS resource should not be publicly accessible | CRITICAL |
S3
| AWS_S3_001 | S3 bucket should have Block Public Access enabled | CRITICAL |
| AWS_S3_007 | S3 bucket uses a legacy public ACL (inline acl attribute) | CRITICAL |
VPC
| AWS_VPC_006 | Security group allows unrestricted ingress on all ports from the internet | CRITICAL |
| AWS_VPC_017 | Security group allows unrestricted ingress on all ports from the IPv6 internet | CRITICAL |
| AWS_VPC_018 | Security group opens the complete TCP or UDP port range to the internet | CRITICAL |
| AWS_VPC_019 | Security group opens the complete TCP or UDP port range to the IPv6 internet | CRITICAL |
Engine-generated findings
These come from the engine's cross-resource analysis rather than the catalog, so their ids are families, not single checks.
ATTACK_PATH_* — Attack paths- Chains that cross resources: an internet-reachable entry point, an identity it can use, and the IAM permissions that lead from there to account-wide control.
AWS_XREF_* — Cross-resource correlations- Issues that are only visible when you look at how several resources interact, not at any one resource on its own.
AWS_FUSION_* — Cost and security together- Findings that need a cost signal and a security signal on different resources in the same code, such as accelerator compute next to an administrator-equivalent IAM policy.
AWS_CRED_* — Credentials written into code- Literal credentials of recognisable shapes (AWS access key ids, private keys, provider tokens) in resource attributes, variable defaults and variable files.
AWS_CFN_* — CloudFormation only- Findings with no Terraform twin, such as a NoEcho parameter whose value flows into Outputs, or a nested stack pulled from an unpinned template URL.