Rules
301 checks for AWS Terraform and CloudFormation, read from the same catalog the engine runs. Each page says what the check looks at and how to fix it.
114 shown.
ACM
| AWS_ACM_001 | ACM certificate should use DNS validation instead of email validation | MEDIUM |
APIGW
| AWS_APIGW_001 | API Gateway REST stage should have access logging enabled | MEDIUM |
| AWS_APIGW_005 | API Gateway stage has neither X-Ray nor access logs | MEDIUM |
| AWS_APIGW_006 | API Gateway custom domain should not use the legacy TLS 1.0 security policy | MEDIUM |
| AWS_APIGW_007 | API Gateway method cache should be encrypted when caching is enabled | MEDIUM |
ATHENA
| AWS_ATHENA_001 | Athena workgroup should enforce workgroup configuration and encrypt query results | MEDIUM |
BACKUP
| AWS_BACKUP_001 | AWS Backup vault should have Vault Lock enabled for immutable backups | MEDIUM |
BEDROCK
| AWS_BEDROCK_002 | Bedrock agent conversation data not encrypted with a customer-managed key | MEDIUM |
| AWS_BEDROCK_006 | Bedrock AgentCore memory not encrypted with a customer-managed key | MEDIUM |
| AWS_BEDROCK_007 | Bedrock AgentCore gateway not encrypted with a customer-managed key | MEDIUM |
CT
| AWS_CT_002 | CloudTrail trail should have log file validation enabled | MEDIUM |
| AWS_CT_003 | CloudTrail trail should integrate with CloudWatch Logs | MEDIUM |
| AWS_CT_005 | CloudTrail trail should encrypt logs with a KMS key (SSE-KMS) | MEDIUM |
DDB
| AWS_DDB_001 | DynamoDB table should have Point-in-Time Recovery (PITR) enabled | MEDIUM |
| AWS_DDB_003 | DynamoDB table should have deletion protection enabled | MEDIUM |
DOCDB
| AWS_DOCDB_002 | DocumentDB cluster should export audit logs to CloudWatch | MEDIUM |
EC2
| AWS_EC2_004 | EC2 instance uses a GPU or compute-intensive type without a shutdown schedule | MEDIUM |
| AWS_EC2_011 | IMDS hop limit above 1 exposes the instance role to containers on the host | MEDIUM |
| AWS_EC2_013 | EC2 root volume is unencrypted because EBS encryption by default is turned off | MEDIUM |
ECR
| AWS_ECR_001 | ECR repository should have scan-on-push enabled | MEDIUM |
| AWS_ECR_002 | ECR repository should have image tag immutability enabled | MEDIUM |
ECS
| AWS_ECS_002 | ECS task definition container should use a read-only root filesystem | MEDIUM |
| AWS_ECS_004 | ECS task definition should specify a task role for fine-grained IAM access | MEDIUM |
| AWS_ECS_005 | ECS task definition should configure log driver for audit containers | MEDIUM |
| AWS_ECS_006 | ECS Exec (SSM-based shell access) should log to CloudWatch or S3 | MEDIUM |
EFS
| AWS_EFS_002 | EFS file system should have a backup policy enabled | MEDIUM |
EKS
| AWS_EKS_002 | EKS cluster should have control-plane logging enabled | MEDIUM |
| AWS_EKS_005 | EKS node group with SSH access should restrict source security groups | MEDIUM |
ELASTICACHE
| AWS_ELASTICACHE_004 | ElastiCache replication group should have automatic failover enabled | MEDIUM |
| AWS_ELASTICACHE_005 | ElastiCache cluster (standalone) should be upgraded to a replication group | MEDIUM |
| AWS_ELASTICACHE_007 | ElastiCache Redis cluster should retain at least one automatic snapshot | MEDIUM |
ELB
| AWS_ELB_001 | Load balancer should have access logging enabled | MEDIUM |
| AWS_ELB_005 | ALB HTTP listener should redirect to HTTPS | MEDIUM |
EMR
| AWS_EMR_001 | EMR Serverless application should have auto-stop configured | MEDIUM |
| AWS_EMR_002 | EMR Serverless application should have maximum capacity limits set | MEDIUM |
FIREHOSE
| AWS_FIREHOSE_001 | Kinesis Firehose delivery stream should have server-side encryption enabled | MEDIUM |
FSX
| AWS_FSX_001 | FSx file system should use a customer-managed KMS key for encryption | MEDIUM |
GA
| AWS_GA_001 | Global Accelerator should enable flow logs | MEDIUM |
GDY
| AWS_GDY_002 | GuardDuty S3 protection should be enabled | MEDIUM |
| AWS_GDY_003 | GuardDuty EKS protection should be enabled | MEDIUM |
IAM
| AWS_IAM_011 | GitHub OIDC role leaves the branch or environment open with a wildcard | MEDIUM |
KINESIS
| AWS_KINESIS_001 | Kinesis Data Stream should use KMS server-side encryption | MEDIUM |
KMS
| AWS_KMS_001 | KMS key should have automatic rotation enabled | MEDIUM |
| AWS_KMS_003 | KMS multi-region key should restrict replica regions via key policy | MEDIUM |
LAMBDA
| AWS_LAMBDA_004 | Lambda function should have a dead-letter queue configured | MEDIUM |
| AWS_LAMBDA_007 | Lambda function should have an explicitly declared CloudWatch log group | MEDIUM |
LOGS
| AWS_LOGS_001 | CloudWatch log group should have a retention period configured | MEDIUM |
MQ
| AWS_MQ_002 | Amazon MQ for ActiveMQ broker should enable audit logging to CloudWatch | MEDIUM |
MSK
| AWS_MSK_004 | MSK cluster should deliver broker logs to CloudWatch, S3, or Firehose | MEDIUM |
NEPTUNE
| AWS_NEPTUNE_002 | Neptune cluster should have audit logging enabled | MEDIUM |
| AWS_NEPTUNE_003 | Neptune cluster should have IAM database authentication enabled | MEDIUM |
OPS
| AWS_OPS_001 | Long-running Lambda has no DLQ and no reserved concurrency | MEDIUM |
| AWS_OPS_006 | SQS visibility timeout under 60 seconds (including creation default) | MEDIUM |
| AWS_OPS_009 | RDS changes applied immediately instead of in the maintenance window | MEDIUM |
| AWS_OPS_011 | CloudWatch alarm uses Average statistic for a latency-shaped metric | MEDIUM |
| AWS_OPS_012 | CloudWatch alarm on a critical metric treats missing data as missing | MEDIUM |
| AWS_OPS_023 | RDS engine version pinned to the major version only, with automatic minor upgrades on | MEDIUM |
| AWS_OPS_025 | Internet-facing load balancer lacks proven health-aware DNS routing | MEDIUM |
| AWS_OPS_026 | Load balancer has deletion protection turned off | MEDIUM |
| AWS_OPS_027 | Lambda async invocation with no reserved concurrency (retry-storm risk) | MEDIUM |
| AWS_OPS_029 | ECS service runs a single task (no redundancy) | MEDIUM |
| AWS_OPS_034 | Aurora cluster keeps backups for one day or less | MEDIUM |
| AWS_OPS_035 | IAM role or user is missing a permissions boundary | MEDIUM |
| AWS_OPS_037 | IAM user credentials: prefer federation for people and roles for workloads | MEDIUM |
| AWS_OPS_038 | Declared IAM access key should have a documented rotation plan | MEDIUM |
| AWS_OPS_056 | Lambda function is configured with 10,240 MB or more of memory | MEDIUM |
| AWS_OPS_060 | Step Functions Express state machine (5-minute limit) | MEDIUM |
| AWS_OPS_062 | Sharded ElastiCache replication group needs a cluster mode review | MEDIUM |
| AWS_OPS_064 | Aurora Serverless v1 cluster (end of life) | MEDIUM |
| AWS_OPS_067 | Stateful resource has no prevent-destroy guard | MEDIUM |
| AWS_OPS_077 | Secrets Manager access should use a VPC endpoint, not public internet | MEDIUM |
| AWS_OPS_078 | KMS access should use a VPC endpoint, not public internet | MEDIUM |
| AWS_OPS_079 | ECR access should use VPC endpoints to avoid public internet pull | MEDIUM |
| AWS_OPS_084 | AWS Backup vault should use a CMK for encryption | MEDIUM |
RDS
| AWS_RDS_004 | RDS production instance should have Multi-AZ enabled | MEDIUM |
| AWS_RDS_007 | Aurora cluster has no explicit customer-managed key choice | MEDIUM |
| AWS_RDS_010 | Aurora cluster does not enable IAM database authentication | MEDIUM |
| AWS_RDS_011 | Aurora cluster has fewer than two instances — no Multi-AZ failover target | MEDIUM |
| AWS_RDS_013 | RDS Enhanced Monitoring is disabled or the monitoring role is invalid | MEDIUM |
| AWS_RDS_015 | Aurora global cluster has no demonstrated customer-managed key choice | MEDIUM |
| AWS_RDS_016 | RDS automatic minor version upgrades are disabled | MEDIUM |
| AWS_RDS_017 | RDS backup retention period is shorter than 7 days | MEDIUM |
REDSHIFT
| AWS_REDSHIFT_004 | Redshift cluster should have user activity logging enabled | MEDIUM |
ROUTE53
| AWS_ROUTE53_001 | Route53 hosted zone should have DNSSEC signing enabled | MEDIUM |
| AWS_ROUTE53_003 | Route53 failover record with PRIMARY role should have a health check | MEDIUM |
| AWS_ROUTE53_004 | Route53 public hosted zone should log DNS queries | MEDIUM |
S3
| AWS_S3_004 | S3 bucket should have access logging enabled | MEDIUM |
| AWS_S3_011 | S3 audit/compliance bucket has no object-lock configuration | MEDIUM |
| AWS_S3_017 | S3 bucket has no server access logging | MEDIUM |
SAGEMAKER
| AWS_SAGEMAKER_001 | SageMaker domain should be in a VPC with security groups configured | MEDIUM |
| AWS_SAGEMAKER_003 | SageMaker notebook instance should not enable root access | MEDIUM |
SFN
| AWS_SFN_001 | Step Functions state machine should have logging enabled | MEDIUM |
SM
| AWS_SM_001 | Secrets Manager secret should have automatic rotation configured | MEDIUM |
SNS
| AWS_SNS_001 | SNS topic should use a customer-managed KMS key for encryption | MEDIUM |
| AWS_SNS_002 | SNS topic access policy should enforce TLS-only access | MEDIUM |
SQS
| AWS_SQS_001 | SQS queue without inline redrive should specify a KMS encryption key | MEDIUM |
| AWS_SQS_002 | SQS queue should have a dead-letter queue configured | MEDIUM |
| AWS_SQS_003 | SQS queue has server-side encryption explicitly disabled | MEDIUM |
VPC
| AWS_VPC_001 | VPC has no associated flow logs | MEDIUM |
| AWS_VPC_002 | VPC peering connection has no route table entry on requester side | MEDIUM |
| AWS_VPC_005 | VPC subnet automatically assigns public IPs on launch | MEDIUM |
| AWS_VPC_012 | Route to a VPC peering connection should not use an unrestricted CIDR | MEDIUM |
WAF
| AWS_WAF_002 | WAFv2 web ACL rate limit rule threshold is too permissive | MEDIUM |
| AWS_WAF_003 | WAFv2 web ACL should include AWSManagedRulesCommonRuleSet | MEDIUM |
| AWS_WAF_004 | WAFv2 web ACL should have logging enabled | MEDIUM |
Engine-generated findings
These come from the engine's cross-resource analysis rather than the catalog, so their ids are families, not single checks.
ATTACK_PATH_* — Attack paths- Chains that cross resources: an internet-reachable entry point, an identity it can use, and the IAM permissions that lead from there to account-wide control.
AWS_XREF_* — Cross-resource correlations- Issues that are only visible when you look at how several resources interact, not at any one resource on its own.
AWS_FUSION_* — Cost and security together- Findings that need a cost signal and a security signal on different resources in the same code, such as accelerator compute next to an administrator-equivalent IAM policy.
AWS_CRED_* — Credentials written into code- Literal credentials of recognisable shapes (AWS access key ids, private keys, provider tokens) in resource attributes, variable defaults and variable files.
AWS_CFN_* — CloudFormation only- Findings with no Terraform twin, such as a NoEcho parameter whose value flows into Outputs, or a nested stack pulled from an unpinned template URL.