Free plan Signups are open now. The full audytx engine — Terraform and CloudFormation — is live. The Free plan is 100 scans a month and stays free — paid tiers arrive Nov 01, 2026 from $20/month for unlimited repositories. Try it on your own code.

Rules

301 checks for AWS Terraform and CloudFormation, read from the same catalog the engine runs. Each page says what the check looks at and how to fix it.

Severity: all criticalhighmediumlow Format: Terraform (all) CloudFormation

81 shown.

BATCH

AWS_BATCH_001AWS Batch job definition should not run privileged containersHIGH

BEDROCK

AWS_BEDROCK_001Bedrock service role trust policy lacks aws:SourceArn scopingHIGH
AWS_BEDROCK_004Bedrock AgentCore code interpreter has public internet accessHIGH
AWS_BEDROCK_005Bedrock AgentCore browser has public internet accessHIGH

CLOUDFRONT

AWS_CLOUDFRONT_001CloudFront distribution viewer protocol policy should redirect HTTP to HTTPSHIGH
AWS_CLOUDFRONT_003CloudFront origin should use HTTPS — not HTTPHIGH

CODEBUILD

AWS_CODEBUILD_001CodeBuild project should not run builds in privileged modeHIGH
AWS_CODEBUILD_002CodeBuild project environment variables should not contain plaintext secretsHIGH

COGNITO

AWS_COGNITO_001Cognito user pool should have advanced security mode set to ENFORCEDHIGH

CT

AWS_CT_001CloudTrail trail should be multi-regionHIGH
AWS_CT_006CloudTrail trail should have logging enabledHIGH

DAX

AWS_DAX_001DynamoDB Accelerator (DAX) cluster should have encryption at rest enabledHIGH

DOCDB

AWS_DOCDB_001DocumentDB cluster should have storage encryption enabledHIGH

EC2

AWS_EC2_001EC2 instance should require IMDSv2 (token-based metadata access)HIGH
AWS_EC2_002EC2 instance should have EBS root volume encryption enabledHIGH
AWS_EC2_006EC2 instance has no metadata options block — IMDSv2 not configuredHIGH
AWS_EC2_008EBS volume should have encryption enabledHIGH
AWS_EC2_009EC2 instance has detailed monitoring explicitly disabledHIGH
AWS_EC2_010Network ACL should not allow 0.0.0.0/0 ingress on SSH (22) or RDP (3389)HIGH

ECS

AWS_ECS_001ECS task definition should not run containers in privileged modeHIGH
AWS_ECS_008ECS task definition EFS volume has transit encryption disabledHIGH

EFS

AWS_EFS_001EFS file system should have encryption at rest enabledHIGH

EKS

AWS_EKS_001EKS cluster Secrets should have envelope encryptionHIGH
AWS_EKS_003EKS cluster API server endpoint should not be publicly accessibleHIGH
AWS_EKS_004EKS cluster should use a supported Kubernetes versionHIGH
AWS_EKS_006EKS cluster with a public endpoint should limit which addresses can reach itHIGH

ELASTICACHE

AWS_ELASTICACHE_001ElastiCache replication group should have at-rest encryption enabledHIGH
AWS_ELASTICACHE_002ElastiCache replication group should have in-transit encryption enabledHIGH
AWS_ELASTICACHE_003ElastiCache replication group should require AUTH or RBACHIGH
AWS_ELASTICACHE_008First AUTH token update should remove passwordless accessHIGH

ELB

AWS_ELB_002Classic ELB listener should not use HTTP — require HTTPSHIGH

GDY

AWS_GDY_001GuardDuty detector should be enabledHIGH

GLUE

AWS_GLUE_004Glue connection password should not be a plaintext literalHIGH
AWS_GLUE_005Glue Data Catalog and connection-password responses should be protectedHIGH
AWS_GLUE_006Glue security configuration should encrypt S3 data at restHIGH

IAM

AWS_IAM_009GitHub OIDC federated role allows assumption from any repository in an orgHIGH
AWS_IAM_010EKS IRSA role trust allows any service account (overly broad subject claim)HIGH

LAKEFORMATION

AWS_LAKEFORMATION_001Lake Formation grant should not use wildcard principalHIGH

LAMBDA

AWS_LAMBDA_001Lambda function should not use an end-of-life runtimeHIGH

MQ

AWS_MQ_001Amazon MQ broker should not be publicly accessibleHIGH

MSK

AWS_MSK_001MSK cluster should not allow unauthenticated client accessHIGH
AWS_MSK_002MSK cluster should enforce TLS encryption for client-to-broker connectionsHIGH
AWS_MSK_003MSK cluster should not have public access enabledHIGH

NEPTUNE

AWS_NEPTUNE_001Neptune cluster should have storage encryption enabledHIGH

OPENSEARCH

AWS_OPENSEARCH_001OpenSearch domain should have encryption at rest enabledHIGH
AWS_OPENSEARCH_002OpenSearch domain should enforce HTTPS with a modern TLS policyHIGH

OPS

AWS_OPS_004RDS instance with no Multi-AZ, no deletion protection and no final snapshotHIGH
AWS_OPS_007ECS task definition with a container not marked essentialHIGH
AWS_OPS_010Lambda Function URL without direct-origin IAM authenticationHIGH
AWS_OPS_024ElastiCache cluster has multiple nodes but automatic failover is turned offHIGH
AWS_OPS_030DynamoDB table has point-in-time recovery turned offHIGH
AWS_OPS_032OpenSearch / Elasticsearch domain runs on a single instanceHIGH

ORGANIZATIONS

AWS_ORGANIZATIONS_002AWS Organizations SCP should declare a root-user denialHIGH

RDS

AWS_RDS_003RDS instance should have automated backups enabledHIGH
AWS_RDS_005RDS deletion protection should be enabledHIGH
AWS_RDS_008RDS DB cluster has deletion protection disabledHIGH
AWS_RDS_018RDS PostgreSQL should enforce TLS connectionsHIGH
AWS_RDS_019RDS MySQL should enforce TLS connectionsHIGH
AWS_RDS_020Aurora PostgreSQL cluster should enforce TLS connectionsHIGH
AWS_RDS_021Aurora MySQL cluster should enforce TLS connectionsHIGH

REDSHIFT

AWS_REDSHIFT_002Redshift cluster should enforce SSL connectionsHIGH
AWS_REDSHIFT_003Redshift cluster should have encryption at rest enabledHIGH

ROLESANYWHERE

AWS_ROLESANYWHERE_001Roles Anywhere trust policy lacks trust-anchor scoping (aws:SourceArn / aws:SourceAccount / sts:SourceIdentity)HIGH

S3

AWS_S3_003S3 bucket should have versioning enabledHIGH
AWS_S3_005S3 bucket policy should deny non-TLS (HTTP) accessHIGH
AWS_S3_010S3 bucket has no Block Public Access companion resourceHIGH
AWS_S3_014S3 bucket should not grant read to any authenticated AWS userHIGH
AWS_S3_015S3 access point disables a Block Public Access settingHIGH

SAGEMAKER

AWS_SAGEMAKER_002SageMaker notebook instance should not allow direct internet accessHIGH

SSM

AWS_SSM_001SSM Parameter with secret-like name should use SecureString typeHIGH
AWS_SSM_002SSM Parameter should not store credential value as plaintext in TerraformHIGH

SSO

AWS_SSO_001SSO permission set inline policy should not grant full administrative privilegesHIGH

VPC

AWS_VPC_004Security group permits 0.0.0.0/0 on a known debug or management portHIGH
AWS_VPC_010Security group inline ingress opens a management port to ::/0HIGH
AWS_VPC_011Security-group ingress CIDRs resolve to the entire address spaceHIGH
AWS_VPC_015Network ACL allows all traffic inbound from the internetHIGH
AWS_VPC_016Standalone network ACL rule allows all traffic inbound from the internetHIGH
AWS_VPC_020Security group opens SQL Server Browser (UDP 1434) to the internetHIGH
AWS_VPC_021Security group opens SQL Server Browser (UDP 1434) to the IPv6 internetHIGH

WAF

AWS_WAF_001WAFv2 web ACL default action is ALLOW with no rules configuredHIGH

WORKSPACES

AWS_WORKSPACES_001WorkSpace should encrypt both its root and user volumesHIGH

Engine-generated findings

These come from the engine's cross-resource analysis rather than the catalog, so their ids are families, not single checks.

ATTACK_PATH_* — Attack paths
Chains that cross resources: an internet-reachable entry point, an identity it can use, and the IAM permissions that lead from there to account-wide control.
AWS_XREF_* — Cross-resource correlations
Issues that are only visible when you look at how several resources interact, not at any one resource on its own.
AWS_FUSION_* — Cost and security together
Findings that need a cost signal and a security signal on different resources in the same code, such as accelerator compute next to an administrator-equivalent IAM policy.
AWS_CRED_* — Credentials written into code
Literal credentials of recognisable shapes (AWS access key ids, private keys, provider tokens) in resource attributes, variable defaults and variable files.
AWS_CFN_* — CloudFormation only
Findings with no Terraform twin, such as a NoEcho parameter whose value flows into Outputs, or a nested stack pulled from an unpinned template URL.