Rules
301 checks for AWS Terraform and CloudFormation, read from the same catalog the engine runs. Each page says what the check looks at and how to fix it.
Severity:
all
criticalhighmediumlow
Format:
Terraform (all)
CloudFormation
62 shown.
ACM
| AWS_ACM_002 | ACM certificate should use RSA 2048 or ECDSA P-256 key algorithm | LOW |
APIGW
| AWS_APIGW_002 | API Gateway stage should have X-Ray tracing enabled | LOW |
BACKUP
| AWS_BACKUP_002 | Backup Vault Lock governance mode remains removable | LOW |
BEDROCK
| AWS_BEDROCK_003 | Bedrock agent idle session TTL exceeds one hour | LOW |
CLOUDFRONT
| AWS_CLOUDFRONT_004 | CloudFront distribution should have access logging configured | LOW |
DDB
| AWS_DDB_002 | DynamoDB table should use a customer-managed KMS key for encryption | LOW |
EC2
| AWS_EC2_005 | EC2 instance uses an oversized compute type (24xlarge or 32xlarge) | LOW |
ECR
| AWS_ECR_003 | ECR repository should use KMS encryption rather than AES256 | LOW |
| AWS_ECR_004 | ECR repository should have a lifecycle policy to expire old images | LOW |
ECS
| AWS_ECS_003 | ECS cluster should have Container Insights enabled | LOW |
EFS
| AWS_EFS_003 | EFS file system should use a customer-managed KMS key | LOW |
ELB
| AWS_ELB_003 | ALB should drop invalid HTTP headers | LOW |
| AWS_ELB_004 | ALB should have deletion protection enabled | LOW |
EMR
| AWS_EMR_003 | EMR cluster should use Spot instances for task nodes to reduce cost | LOW |
EVENTBRIDGE
| AWS_EVENTBRIDGE_002 | Custom EventBridge bus should use a KMS key for encryption | LOW |
FIREHOSE
| AWS_FIREHOSE_002 | Kinesis Firehose delivery stream should have CloudWatch error logging enabled | LOW |
GLUE
| AWS_GLUE_003 | Legacy Glue job should have continuous CloudWatch logging enabled | LOW |
LAMBDA
| AWS_LAMBDA_003 | Lambda function should have X-Ray tracing enabled | LOW |
| AWS_LAMBDA_005 | Lambda function should have code signing enabled | LOW |
MEDIACONVERT
| AWS_MEDIACONVERT_001 | MediaConvert queue in production use should be RESERVED, not ON_DEMAND | LOW |
OPS
| AWS_OPS_002 | Lambda integration timeout shape (timeout config sanity) | LOW |
| AWS_OPS_003 | Long-running Lambda with low memory — likely workload misfit | LOW |
| AWS_OPS_005 | ALB target group deregistration delay exceeds connection draining budget | LOW |
| AWS_OPS_008 | Auto Scaling Group with the same minimum and maximum size (no elasticity) | LOW |
| AWS_OPS_014 | Lambda function has no CloudWatch alarm on Errors metric | LOW |
| AWS_OPS_015 | Lambda function has no CloudWatch alarm on Throttles metric | LOW |
| AWS_OPS_016 | ALB has no CloudWatch alarm on UnHealthyHostCount | LOW |
| AWS_OPS_017 | RDS instance has no declared CloudWatch alarm on CPUUtilization | LOW |
| AWS_OPS_018 | SQS queue has no alarm on ApproximateAgeOfOldestMessage | LOW |
| AWS_OPS_022 | Lambda exists but no CloudWatch dashboard declared in the same plan | LOW |
| AWS_OPS_028 | EKS cluster declares a single node group | LOW |
| AWS_OPS_033 | RDS instance has storage autoscaling turned off | LOW |
| AWS_OPS_045 | Elastic IP declared without instance / NAT / NLB association | LOW |
| AWS_OPS_046 | CloudWatch log group retained for more than a year (audit-tier retention) | LOW |
| AWS_OPS_047 | Kinesis stream has more than one provisioned shard | LOW |
| AWS_OPS_048 | NAT gateway incurs hourly and processing charges | LOW |
| AWS_OPS_049 | Load balancer has no target-group declaration in scanned input | LOW |
| AWS_OPS_050 | CloudFront distribution has compression turned off | LOW |
| AWS_OPS_051 | RDS gp3 with iops at or below the included 3,000 baseline (provisions nothing) | LOW |
| AWS_OPS_052 | Launch template keeps an EBS volume after instance termination | LOW |
| AWS_OPS_053 | S3 bucket uses SSE-KMS without an S3 Bucket Key | LOW |
| AWS_OPS_054 | Review NAT gateway cost for the declared environment | LOW |
| AWS_OPS_057 | ECS task definition allocates 4+ vCPU — review utilization | LOW |
| AWS_OPS_058 | S3 CORS configuration warrants a CloudFront delivery review | LOW |
| AWS_OPS_059 | SQS queue has a delivery delay | LOW |
| AWS_OPS_061 | Lambda VPC placement should match its private-resource requirements | LOW |
| AWS_OPS_063 | Lambda function uses a mounted file system (Amazon EFS or Amazon S3 Files) | LOW |
| AWS_OPS_066 | EventBridge rule with rate(1 minute) schedule (high-cost cron) | LOW |
| AWS_OPS_070 | Hardcoded AWS account ID in resource argument | LOW |
| AWS_OPS_071 | Hardcoded AWS region in resource argument | LOW |
| AWS_OPS_080 | KMS multi-region key should have replicas in DR regions | LOW |
| AWS_OPS_085 | AWS Backup plan should include cross-region copy for DR | LOW |
| AWS_OPS_090 | MemoryDB cluster used as primary data store | LOW |
| AWS_OPS_091 | Lambda timeout of 10 minutes or more (batch-shaped workload likely belongs elsewhere) | LOW |
| AWS_OPS_092 | DynamoDB table with high provisioned read capacity (suggests aggregation queries) | LOW |
RDS
| AWS_RDS_006 | RDS Performance Insights uses AWS-managed key (not CMK) | LOW |
| AWS_RDS_009 | RDS DB cluster backup retention period is 0, outside the 1-35 day range | LOW |
ROUTE53
| AWS_ROUTE53_002 | Route53 health check should use HTTPS with SNI for HTTPS endpoints | LOW |
S3
| AWS_S3_012 | Versioned S3 bucket should enable MFA delete | LOW |
| AWS_S3_016 | S3 bucket has no versioning configured | LOW |
SFN
| AWS_SFN_002 | Step Functions state machine should have X-Ray tracing enabled | LOW |
WAF
| AWS_WAF_005 | WAFv2 web ACL rule should have CloudWatch metrics enabled | LOW |
Engine-generated findings
These come from the engine's cross-resource analysis rather than the catalog, so their ids are families, not single checks.
ATTACK_PATH_*— Attack paths- Chains that cross resources: an internet-reachable entry point, an identity it can use, and the IAM permissions that lead from there to account-wide control.
AWS_XREF_*— Cross-resource correlations- Issues that are only visible when you look at how several resources interact, not at any one resource on its own.
AWS_FUSION_*— Cost and security together- Findings that need a cost signal and a security signal on different resources in the same code, such as accelerator compute next to an administrator-equivalent IAM policy.
AWS_CRED_*— Credentials written into code- Literal credentials of recognisable shapes (AWS access key ids, private keys, provider tokens) in resource attributes, variable defaults and variable files.
AWS_CFN_*— CloudFormation only- Findings with no Terraform twin, such as a NoEcho parameter whose value flows into Outputs, or a nested stack pulled from an unpinned template URL.